[as112-ops] AS112 and IPv6

[Paul Vixie]

> Date: Sun, 7 Mar 2010 15:28:06 +0100
> From: md at Linux.IT (Marco d'Itri)
> 
> This has already been discussed in the past. The problem is that it
> would be hard to coordinate adding more zones to the many AS112 servers
> currently deployed, so many users would just see lame delegations.

it's difficult for me to understand how users will be more hurt by a 
SERVFAIL from an AS112 server than by an NXDOMAIN from a root server.
yes, NXDOMAIN is more likely to be cached, and so they'll send more
queries off-net until their local AS112 server picks up this change,
but in that case we can hope they'll notice what they're leaking.

> I am not sure that there is a consensus that this is acceptable: while
> the main goal of AS112 is to protect the root servers and not to provide
> service to misconfigured network, some people stronly feel that
> misconfigured networks should not be damaged by changes in the AS112
> service.

we have pretty good contacts with the AS112 operators.  if we want to add
this it'll take a year or two to find and fix the last private unlisted
server, but that's still finite, and in the interrim we'll be doing some
good and no new harm.

> Providing IPv6 connectivity to the AS112 servers would be easy, but I am
> not sure that it would be useful as long as they will only host the v4
> zones.

to support ipv6-only endpoints, we have to have ipv6 transport to all name
servers, even those which only serve ipv4 in-addr zones.  there's a strong
relationship between ipv4 transport and ipv4 in-addr lookups, but not an
identity relationship.  someone using rfc1918 ipv4 internally and who only
has ipv6 connectivity to the world, should still be able to get our NXDOMAINs.