On Sat, 13 Jun 2015, Dave Taht wrote:
I don't understand how badly this is going to break dnssec. dnsmasq in particular has been dealing with edge case after edge case on dnssec for the last few months, and it was my hope we'd finally got them all.
DNS64 breaks DNSSEC because it creates an AAAA response where none is present in the zone being queried. It's basically doing MITM for DNS, which is exactly what DNSSEC was supposed to fix.
DNSSEC would work if Apple decided to just do NAT64 discovery and then do their own DNS64 in the host, but I have no information as to what is being done here.
At least DNSSEC still works between the Internet and the ISP DNS64 resolver, but the end host won't be able to verify the response using DNSSEC.
-- Mikael Abrahamsson email: [email protected] _______________________________________________ Bloat mailing list [email protected] https://lists.bufferbloat.net/listinfo/bloat
