5

If a DNSSEC server has no zones with AAAA records. What potential problems could there be by dropping DNS type AAAA (28; 0x1c) queries at the firewall?

Same as dropping type ANY (255; 0xff). Just replace the type with AAAA (28; 0x1c).

2
  • 17
    What is the purpose of that? What do you have specifically against AAAA records and why to filter those and not others? Why can't you the server reply NODATA or NXDOMAIN as needed? As for ANY please read tools.ietf.org/html/rfc8482 ; most of the time putting a firewall in front of a DNS server is a bad idea until at least you understand fully well how the DNS works. Jul 14, 2020 at 22:57
  • 11
    Also, IPv6 should be the current Internet and IPv4 be legacy. Your nameserver should have IPv6 transport and you should have AAAA records as you should have all your resources available over IPv6. Why such desire to tie you to the past? Jul 14, 2020 at 22:58

1 Answer 1

28

All your clients would wait for a few seconds on every DNS lookup, for starters. IPv6 is not optional and modern operating systems treat it as such. A client looking for an address will look up both AAAA and A records, even if it does not seem to have any IPv6 connectivity at that exact moment. If you drop one of the queries, the client software doing the DNS lookup will wait until a timeout before returning an error. You will thus annoy your users with a needless slowdown.

Back around 2012, some Juniper firewalls did by accident what you propose to do on purpose, and would drop the AAAA response, even though the client specifically requested A and AAAA records. Juniper eventually did fix this, but it caused quite a bit of annoyance to anybody stuck with this malfunctioning equipment.

And of course it's 2020 and your entire network should have already been IPv6 for the last several years, with IPv4 dual stacked or even deprecated to legacy stuff. But some places are extraordinarily slow to join this century, and you're probably working at one...

13
  • 2
    What information is the last paragraph trying to add to this answer in regards to the question asked?
    – Num Lock
    Jul 15, 2020 at 9:13
  • 13
    @NumLock: As the OP seems to think IPv6 isn't worth while to support, or should even be blocked actively, telling them they're wrong is very much in order. Jul 15, 2020 at 9:26
  • 2
    @GuntramBlohmsupportsMonica Probably, I was more focused on the passive-aggressiveness towards implying OP being extraordinarily slow to join this century, though. I am sure it can be phrased more informative and less opinionated/insulting, if not even be left out completely. Like it was before the last edit.
    – Num Lock
    Jul 15, 2020 at 9:43
  • 5
    @NumLock I expect it's his employer rather than him; it usually is. And I did say exactly that in so many words. Most people in IT are quite happy to have shiny new things, even when they're 20 year old shiny new things. And there's nothing passive about it. I've been watching people stumble around in the dark for years now with a wide variety of nasty hacks and workarounds, that they have no need to suffer through, because they are unable or unwilling to deploy IPv6. It's really well past time to move on. Jul 15, 2020 at 11:52
  • 6
    @NumLock You've chosen to see an insult where none exists or was intended. That's all on you. Jul 15, 2020 at 13:18

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .