0

I use SixXS and delegated the reverse PTR ip6.arpa zone to my own NS servers, so I am able to set up forward-confirmed hostnames within my subnet. This is great. A particular /64 subnet I designated is primarily used by hosts those configure themselves with SLAAC + Privacy Extensions. This means, these hosts pick random addresses and keep changing them as they expire. To be compliant with Internet etiquette, all these addresses should have a forward-confirmed reverse hostname at all the times.

E.g.: 2a01:xxxx:xxxx:xxxx:5374:6172:6761:7465 should have a reverse PTR like:

5.6.4.7.1.6.7.6.2.7.1.6.4.7.3.5.x.x.x.x.x.x.x.x.x.x.x.x.1.0.a.2.ip6.arpa. IN PTR host-5374617267617465.ip6pool.mydomain.tld.

And all the 2 ^ 64 addresses in the /64 subnet should have reverse records like this, except for some unique hosts. E.g. reverse records for 2a01:xxxx:xxxx:xxxx::88 and 2a01:xxxx:xxxx:xxxx::99 should point to server1.mydomain.tld and server2.mydomain.tld respectively.

Corresponding forward records should also be set up to point to the respective IPs.

Is there already an efficient way to do this?

I've seen generators but those would actually generate all the 2 ^ 64 records for me, which I don't think would be efficient. There is no point to cache and store that much data when only a very small fraction of it is being used by once. So I need a DNS server that generates records on-the-fly (request comes for particular reverse record, the server generates and sends response as host-${IP6-SUFFIX}.ip6pool.mydomain.tld scheme). I'm not sure if BIND could do that.

Alternatively, but this would be a very inconvenient solution, I could watch for new addresses on the network, and add them to the reverse zone as I see them. Then, only those addresses would have a reverse PTR which are actually used on the network. But this could be very cumbersome to implement.

Any ideas for a smooth implementation?

  • With IPv6 it is common to not provide reverse DNS for privacy addresses, only for fixed/static addresses for servers, network equipment etc. – Sander Steffann May 14 '16 at 14:33
  • @MegaBrutal from a Spam avoidance standpoint this is a bad practice. One common and quite effective spam avoidance technique is to check rDNS validation. Relatively few non-SMTP hosts pass rDNS. It is common to have PTR records that don't pass rDNS for hosts that don't have static IP addresses. – BillThor May 15 '16 at 0:08
1

Actually, this is weird. If you are serving things from your network, your servers should be in fixed addresses. So easy to have PTR as well.

Opposite, using random privacy addresses, you should not provide them PTR, as it, sort of, breaks anonymity.
(This may be up to discussion and I am waiting for the comments).

Out of this concern, the simple use of Dnsmasq as DNS authoritive and dhcp+radvd makes great (as long as you don't use privacy ipv6).

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.