3

We are using IPv4 in our company. Our ISP does not provide IPv6 and this won't change in the next years.

The Best Practices Analyzer (BPA) of our Server 2012 R2 DNS server warns about the IPv6 DNS root hints not responding to the DNS server’s queries. Of course, as we do not have an IPv6 internet access.

I see two solutions:

  1. Ignore the warnings. As long as this does not have an impact on the speed of DNS resolutions. (Something like clients trying IPv6 first, waiting for a timeout and then trying an IPv4 name resolution.)

  2. Remove the IPv6 addressse from the root hints and add them back if we get IPv6 in the future.

Any other solutions? What should I prefer?

1

That nameserver does respond to NS queries for the root zone. I just tried it. The fact that Windows is trying to contact it suggests that the operating system thinks it has IPv6 connectivity. Ensure that you haven't got any IPv6 transition technologies enabled, specifically ISATAP, Teredo, or 6to4.

7
  • All of the root servers except from 2001:503:c27::2:30 and 2001:500:1::803f:235 respond to queries from 2002::/16. Only about half of them respond to queries from 2001::/32. The root operators could easily make the root servers respond to such queries, so I guess they just don't consider it that important.
    – kasperd
    May 13 '15 at 10:04
  • @kasperd That's assuming they receive the queries at all, which for 6to4 and Teredo is not a valid assumption. There's a lot of broken tunnels out there... May 13 '15 at 10:07
  • We do not have IPv6, that is why they do not respond to us.
    – Daniel
    May 13 '15 at 10:08
  • @Daniel If you don't have IPv6 at all, you would never have sent the request! May 13 '15 at 10:20
  • 1
    @Daniel You should have disclosed this at first. And you should be using ULAs for a private IPv6 network. Anyway, it's safe to ignore this if you haven't got global IPv6 connectivity. May 13 '15 at 10:32
1

First of all you are going to need IPv6 in a few years. Based on statistics published by Google my best guess as to when IPv6 adoption will cross the 50% mark is 3 years from now.

Any IPv6 related problem a system administrator is facing needs to be solved, not hidden and ignored. If you take the approach of making changes now that solve your immediate problem but will be getting in the way of upgrading to IPv6 later, then you are setting yourself up for a disaster in a few years when you can no longer remember all the temporary workarounds you applied. Moreover rolling back loads of temporary workarounds and finding real solutions to all of them within a short timeframe will be problematic.

It is perfectly fine to make changes, that don't move you towards running IPv6, as long as you don't make changes, that are moving you away from it.

Running an IPv4-only DNS server with root hints containing both IPv4 and IPv6 addresses is supposed to be a valid configuration. A DNS server is supposed to be able to figure out which of the addresses can be used, and which cannot.

I'm guessing the analyzer you have been running is a bit too verbose for your scenario.

I wouldn't consider removing the IPv6 addresses from the root hints to be an advisable step. If you want the warning to go away, something else need to be done. The other option I can think of would be to get dual stack on the DNS server.

There is also the possibility that the analyzer has detected a real configuration problem in your setup, but that it just doesn't communicate clearly enough what it has found. Documentation about what the analyzer is testing and why could be useful in figuring out if this is the case.

The answer by Michael Hampton have a few suggestions about what configuration problem might have triggered the warning.

0

I ran DNS BPA on Windows Server 2016 Domain controller and got the same result. I also only use IPv4 internally.

Solution 1

I used nslookup and resolved IPv4 names and ip addresses for each of the servers, added new records for the root hints:

a.root-servers.net  198.41.0.4
b.root-servers.net  199.9.14.201
c.root-servers.net  192.33.4.12
d.root-servers.net  199.7.91.13
e.root-servers.net  192.203.230.10
f.root-servers.net  192.5.5.241
g.root-servers.net  192.112.36.4
h.root-servers.net  198.97.190.53
i.root-servers.net  192.36.148.17
j.root-servers.net  192.58.128.30
k.root-servers.net  193.0.14.129
l.root-servers.net  199.7.83.42
m.root-servers.net  202.12.27.33

Solution 2

I discovered after using solution 1, just delete them then add the names back and they will resolve the IPv4 ip addresses, with both methods the IPv6 addresses appeared again so I deleted them again

The DNS BPA now shows no warnings or errors.

1

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.