dns64.so — perform DNS64 synthesis
+plugin query "dns64.so" [{ parameters }];
+
+ dns64.so is a query plugin module for + named, enabling named + to perform DNS64 address synthesis. +
+
+ Until BIND 9.12, this feature was implemented natively in
+ named and enabled with the
+ dns64 option.
+ This option is now deprecated in named.conf,
+ but can be passed as parameters to the
+ dns64.so plugin, for example:
+
+ acl rfc1918 { 10/8; 192.168/16; 172.16/12; };
+
+ plugin query "/usr/local/lib/dns64.so" {
+ dns64 64:FF9B::/96 {
+ clients { any; };
+ mapped { !rfc1918; any; };
+ exclude { 64:FF9B::/96; ::ffff:0000:0000/96; };
+ suffix ::;
+ };
+
+ dns64-server "dns64.example.net.";
+ dns64-contact "hostmaster.example.net.";
+ };
+
++ This plugin enables named to + return mapped IPv4 addresses to AAAA queries when + there are no AAAA records. It is intended to be + used in conjunction with NAT64. +
++ Each dns64 option defined in the plugin + parameters defines one DNS64 prefix. Multiple DNS64 prefixes + can be defined. +
++ Compatible IPv6 prefixes have lengths of 32, 40, 48, 56, + 64 and 96 as per RFC 6052. +
++ Additionally a reverse IP6.ARPA zone will be created for + the prefix to provide a mapping from the IP6.ARPA names + to the corresponding IN-ADDR.ARPA names using synthesized + CNAMEs. dns64-server and + dns64-contact can be used to specify + the name of the server and contact for the zones. + These are not settable on a per-prefix basis. +
+
+ Each dns64 supports an optional
+ clients ACL that determines which
+ clients are affected by this directive. If not defined,
+ it defaults to any;.
+
+ Each dns64 supports an optional
+ mapped ACL that selects which
+ IPv4 addresses are to be mapped in the corresponding
+ A RRset. If not defined it defaults to
+ any;.
+
+ Normally, DNS64 won't apply to a domain name that + owns one or more AAAA records; these records will + simply be returned. The optional + exclude ACL allows specification + of a list of IPv6 addresses that will be ignored + if they appear in a domain name's AAAA records, and + DNS64 will be applied to any A records the domain + name owns. If not defined, exclude + defaults to ::ffff:0.0.0.0/96. +
+
+ A optional suffix can also
+ be defined to set the bits trailing the mapped
+ IPv4 address bits. By default these bits are
+ set to ::. The bits
+ matching the prefix and mapped IPv4 address
+ must be zero.
+
+ If recursive-only is set to + yes the DNS64 synthesis will + only happen for recursive queries. The default + is no. +
++ If break-dnssec is set to + yes the DNS64 synthesis will + happen even if the result, if validated, would + cause a DNSSEC validation failure. If this option + is set to no (the default), the DO + is set on the incoming query, and there are RRSIGs on + the applicable records, then synthesis will not happen. +
+dns64.so — perform DNS64 synthesis
+hook query "dns64.so" [{ parameters }];
+
+ dns64.so is a query hook module for + named, enabling named + to perform DNS64 address synthesis. +
+
+ Until BIND 9.12, this feature was implemented natively in
+ named and enabled with the
+ dns64 option.
+ This option is now deprecated in named.conf,
+ but can be passed as parameters to the
+ dns64.so module, for example:
+
+ acl rfc1918 { 10/8; 192.168/16; 172.16/12; };
+
+ plugin query "/usr/local/lib/dns64.so" {
+ dns64 64:FF9B::/96 {
+ clients { any; };
+ mapped { !rfc1918; any; };
+ exclude { 64:FF9B::/96; ::ffff:0000:0000/96; };
+ suffix ::;
+ };
+
+ dns64-server "dns64.example.net.";
+ dns64-contact "hostmaster.example.net.";
+ };
+
++ This plugin enables named to + return mapped IPv4 addresses to AAAA queries when + there are no AAAA records. It is intended to be + used in conjunction with NAT64. +
++ Each dns64 option defined in the plugin + parameters defines one DNS64 prefix. Multiple DNS64 prefixes + can be defined. +
++ Compatible IPv6 prefixes have lengths of 32, 40, 48, 56, + 64 and 96 as per RFC 6052. +
++ Additionally a reverse IP6.ARPA zone will be created for + the prefix to provide a mapping from the IP6.ARPA names + to the corresponding IN-ADDR.ARPA names using synthesized + CNAMEs. dns64-server and + dns64-contact can be used to specify + the name of the server and contact for the zones. + These are not settable on a per-prefix basis. +
+
+ Each dns64 supports an optional
+ clients ACL that determines which
+ clients are affected by this directive. If not defined,
+ it defaults to any;.
+
+ Each dns64 supports an optional
+ mapped ACL that selects which
+ IPv4 addresses are to be mapped in the corresponding
+ A RRset. If not defined it defaults to
+ any;.
+
+ Normally, DNS64 won't apply to a domain name that + owns one or more AAAA records; these records will + simply be returned. The optional + exclude ACL allows specification + of a list of IPv6 addresses that will be ignored + if they appear in a domain name's AAAA records, and + DNS64 will be applied to any A records the domain + name owns. If not defined, exclude + defaults to ::ffff:0.0.0.0/96. +
+
+ A optional suffix can also
+ be defined to set the bits trailing the mapped
+ IPv4 address bits. By default these bits are
+ set to ::. The bits
+ matching the prefix and mapped IPv4 address
+ must be zero.
+
+ If recursive-only is set to + yes the DNS64 synthesis will + only happen for recursive queries. The default + is no. +
++ If break-dnssec is set to + yes the DNS64 synthesis will + happen even if the result, if validated, would + cause a DNSSEC validation failure. If this option + is set to no (the default), the DO + is set on the incoming query, and there are RRSIGs on + the applicable records, then synthesis will not happen. +
+BIND 9.13.4 (Development Release)
+ + diff --git a/doc/arm/plugins.xml b/doc/arm/plugins.xml index 507970b85d..2f840edf3b 100644 --- a/doc/arm/plugins.xml +++ b/doc/arm/plugins.xml @@ -26,15 +26,16 @@ in the future.