DNS64

DNS64 is a DNS extension used in IPv6 transition strategies to enable IPv6-only hosts to reach IPv4 Internet services by synthesizing IPv6 addresses from IPv4 addresses in DNS responses. It is typically deployed together with a NAT64 gateway, which handles the actual translation between IPv6 and IPv4.

How it works: When an IPv6-only client queries for a domain, a DNS64 resolver checks for an AAAA record. If there is no IPv6 address or the domain only has an A record, the resolver fetches the A record from upstream and constructs a synthetic AAAA record by embedding the IPv4 address into the IPv6 prefix 64:ff9b::/96. The client then uses the synthesized IPv6 address to connect. The NAT64 gateway translates the IPv6 traffic to IPv4 for the destination, and the response is translated back along the same path.

Deployment and scope: DNS64 relies on the presence of a NAT64 gateway in the network path and on resolvers capable of synthesizing AAAA records from A records. It is common in networks that aim to provide IPv6 access while the upstream Internet still offers IPv4, such as mobile networks and some enterprises during transition phases. The approach reduces the need for dual-stack hosts but introduces reliance on translation and synthesis systems.

Limitations and considerations: Some protocols or services that depend on end-to-end IPv4 characteristics or on IP-specific behavior may not function seamlessly under translation (for example, certain FTP modes or IPsec NAT traversal scenarios). DNSSEC can complicate DNS64 operation in some setups, requiring careful configuration. TTL handling and cache behavior can also influence performance and reliability.