Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have a mail server for which I need to create the AAAA DNS record and update the SPF record to include its IPv6 address.

An ifconfig command shows a Scope:Link IPv6 address and a Scope:Global IPv6 address. Which one should I put in the AAAA and SPF records?

The Scope:Global is a /128 address and the scope:Link a /64.

The Scope:Link address is a FE80 address which means none routable. Does it mean I have to put the Scope:Global address?

share|improve this question
    
Did you mean to say: "The Scope:Link addresses is in the FE80::/64 prefix"? – kasperd Jan 30 at 16:44
    
Yes @kasperd, it was an error. I fixed it. – chmike Jan 30 at 16:54
up vote 12 down vote accepted

Yes, precisely so. The globally-scoped address is the one you advertise to the world (which in this case, means list in your AAAA record). The link-scoped address is a very useful feature of ipv6 which makes setting up point-to-point links elegant, but it isn't, as you say, globally-routable, and advertising it to the world will not get you any visitors.

As for SPF, you would certainly want to list the globally-scoped address. I can't offhand think of any circumstances under which you would preferentially make connections to another local mail server from your link-scoped address, so I see no point in listing it, but others might know better than I (I'm talking to you, @SanderStefann).

share|improve this answer
2  
I feel summoned :) – Sander Steffann Jan 30 at 14:47
    
For anything "on the internet" you always use global scope addresses (and only a subset of those. I.e. ULA addresses are global scope but not routed on the internet). So in public DNS records etc the addresses are almost always from 2000::/3. – Sander Steffann Jan 30 at 14:53
2  
Besides that: when running a mail server make sure you use static addresses for sending mail. If your server has IPv6 SLAAC enabled and your mail server software isn't configured to use a fixed source address when sending mail then it will make outbound connections from your temporary IPv6 addresses, which will probably not have reverse DNS set up and will not match your SPF record. So always use a fixed source address and put that in SPF, reverse DNS etc. – Sander Steffann Jan 30 at 14:57
    
The part about your globally-scoped address being an fe80:: address looks like a typo in the question. – kasperd Jan 30 at 16:47
    
Indeed. It was a typo. Sorry. I fix it. – chmike Jan 30 at 16:52

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.