RFC 5158

6to4 Reverse DNS Delegation Specification

📅 published March 2008, from ietf

6to4 Reverse DNS Delegation Specification 🎀

Okay bestie, let's start with the title block tea ☕ This is RFC 5158 from the Network Working Group, written by G. Huston at APNIC. It's an Informational doc, dated March 2008. It doesn't list any Obsoletes or Updates lines, so it's not replacing or patching any other RFC 💅

RFC: 5158
Title: 6to4 Reverse DNS Delegation Specification
Author: G. Huston (APNIC)
Category: Informational
Date: March 2008
Obsoletes / Updates: none listed

Status of This Memo

Quick legal vibe check 🧚 This memo is here to give the Internet community information. It is not an Internet standard of any kind, and you can share it as much as you want, because distribution is unlimited ✨

Abstract

So this doc is about how you actually set up a delegation of DNS servers for reverse lookups of 6to4 IPv6 addresses, and then how you put that into the 6to4 reverse zone file 🦋 It uses a normal DNS delegation service interface, so the client can enter details for a bunch of DNS servers for the delegated domain. The main thing is that the client gets authenticated by the source address it uses in the delegation request, and it's only allowed to use the function if its IPv6 address prefix matches an address inside the 6to4 delegation address block requested. Iconic security energy 🔥

1. Introduction ✨

Okay, so 6to4 [RFC3056] is the mechanism that lets isolated IPv6 sites talk over IPv6 across the public IPv4 Internet 🌈 It works using a dedicated IPv6 global unicast address prefix. A 6to4 "router" takes its IPv4 address and combines it with that global prefix to make a local IPv6 site prefix, and then local IPv6 hosts build their own local IPv6 addresses from that site prefix 💜

This setup means any site connected to the IPv4 Internet can use IPv6 through automatically created IPv6-over-IPv4 tunnels, which is so good 😭 The big win is that IPv6 can get rolled out piece by piece, with tunnels crossing IPv4 network segments. A local site can join an IPv6 network without having to get IPv6 services from its upstream network provider. Main character behavior, honestly 👑

[6to4-dns] explains the same advantage, and it says:

"it decouples deployment of IPv6 by the core of the network (e.g. Internet Service Providers or ISPs) from deployment of IPv6 at the edges (e.g. customer sites), allowing each site or ISP to deploy IPv6 support in its own time frame according to its own priorities. With 6to4, the edges may communicate with one another using IPv6 even if one or more of their ISPs do not yet provide native IPv6 service."

The actual problem this doc tackles is setting up a group of delegations so that "reverse lookups" work for this address space 🍓

Here's what [6to4-dns] says about it:

"[This] requires that there be a delegation path for the IP address being queried, from the DNS root to the servers for the [DNS] zone which provides the PTR records for that IP address. For ordinary IPv6 addresses, the necessary DNS servers and records for IPv6 reverse lookups would be maintained by the each organization to which an address block is delegated; the delegation path of DNS records reflects the delegation of address blocks themselves. However, for IPv6 addresses beginning with the 6to4 address prefix, the DNS records would need to reflect IPv4 address delegation. Since the entire motivation of 6to4 is to decouple site deployment of IPv6 from infrastructure deployment of IPv6, such records cannot be expected to be present for a site using 6to4 - especially for a site whose ISP did not yet support IPv6 in any form." [6to4-dns]

So what does a good reverse lookup delegation mechanism look like? The doc says the desired characteristics are that it:

is deployable with minimal overhead or tool development
has no impact on existing DNS software and existing DNS operations
performs name lookup efficiently
does not compromise any DNS security functions

Those are the vibes we're going for 🫶

2. Potential Approaches 🌸

There are a bunch of ways to tackle this problem 🦋 They run from a plain, conventional explicit delegation structure all the way to modified server behaviors that try to guess where the servers for non-delegated fragments of this address space are. These options were already explored in detail in [6to4-dns] (their pros and cons are all in there), so this section only gives a quick summary.

2.1. Conventional Address Delegation

The problem with this kind of delegation is the expected piecemeal deployment of 6to4 sites 😭 A site usually uses 6to4 because its upstream Internet Service Provider doesn't offer IPv6 transit, so the site tunnels through 6to4 to get IPv6 connectivity. A conventional end site like this would use provider-based IPv4 addresses, where the site's IPv4 address is a more specific block carved out of the upstream provider's address block. The site would either have an entry in the upstream provider's reverse DNS zone file, or it would have authoritative local name servers delegated from the upstream provider's DNS zone. But with 6to4 mapped IPv6 space, the upstream might not offer any IPv6 services at all, so it wouldn't be expected to have a 6to4 reverse DNS delegation for its IPv4 address block. The big takeaway is that 6to4 IPv6 reverse DNS delegations can't always line up perfectly with the matching IPv4 reverse DNS delegations 🙈

Sub-delegations of IPv4 provider address space aren't consistently recorded. That means any 6to4 reverse zone operator would be required to make reverse zone delegations without reliable, current address assignment information, so they'd have to do a "hop over" of the upstream provider's address block. A delegated entity might need to do the same "hop over" when it makes further delegations in its own reverse zone 💅

2.2. Guessing a Non-Delegated 6to4 Reverse Server

One way to dodge those unreliable delegations is to change how reverse servers behave for this zone 🧚 When the zone file has no explicit delegation information, the server could look up the in-addr.arpa domain for the servers covering the equivalent IPv4 address root used in the 6to4 address. Then those servers could be queried for the IPv6 PTR query.

The issues with running altered server behaviors for this domain are not something to take lightly, and the IPv4 delegation chain won't match 6to4 anyway. An isolated 6to4 site uses a single IPv4 /32 address, and it's pretty unlikely that a single address would have its own explicit in-addr.arpa delegation. In other words, the IPv4 delegation probably won't mirror the 6to4 one 🙃

2.3. Locating Local Servers at Reserved Addresses

Another approach uses an altered server to resolve non-delegated 6to4 reverse queries 🌈 The 6to4 query gets decoded to recover the original 6to4 IP address. The site-specific part of that address is rewritten to a constant value, and that value becomes the target of a lookup query. This means a 6to4 site has to reserve some local addresses and set up reverse servers on them. Honestly though, this is a weak approach, because getting the DNS to query non-delegated addresses just creates spurious traffic 💀

2.4. Synthesized Responses

The last approach covered here is to synthesize an answer when no explicit delegation exists 🍓 It would build a pseudo host name using the IPv6 query address as the seed. But since that host name has no valid forward DNS mapping, you're basically just swapping one invalid DNS object for another 🙈

2.5. Selecting a Reasonable Approach

Out of all these candidates, the most reasonable pick seems to be supporting a model of conventional standard delegation 👑 The next job is to cut down the administrative overhead of managing the zone, and to support delegating reverse zone files by giving each 6to4 site its own direct delegation capability ✨

3. 6to4 Networks Address Use 💖

A 6to4 client network is an isolated IPv6 network made up of a set of IPv6 hosts and a dual stack (IPv4 and IPv6) local router. That router connects to the local IPv6 network and to the external IPv4 network 🦋

Here's what one looks like:

                       +-------------+
   IPv6-in-IPv4 packets (A)|             |     IPv6 packets
   ------------------------| 6to4router  |--------------------------
                           |             |    |  |   |     |   |
                           +-------------+   local IPv6 clients

      IPv4 network                              IPv6 network

                                 Figure 1

The IPv4 address used to generate 6to4 addresses for the local IPv6 network is the external IPv4 network interface address (labelled '(A)' in the diagram above). For example, if interface (A) has the IPv4 address 192.0.2.1, then the local IPv6 clients will use a shared IPv6 address prefix of the form 2002:{192.0.2.1}::/48 (or 2002:C000:201::/48 in hex notation). All the local IPv6 clients share this same /48 address prefix, no matter what local IPv4 address those hosts might use if they're running in dual stack mode 🌸

Here's an example of a 6to4 network with addressing:

                       +-------------+
       IPv4 network (A)|             | IPv6 network
    -------------------| 6to4router  |-------------
              192.0.2.1|             |    |  |   | interface identifier
                       +-------------+   1A  |   | local IPv6 address
                                         2002:C000:201::1A
                                             |   |
                                             1B  |
                                             2002:C000:201::1B
                                                 |
                                                 1C
                                                 2002:C000:201::1C

Figure 2

Part 1 wraps up here, bestie. Part 2 picks up right where this leaves off 🫶

4. Delegation Administration ✨

okay bestie so this spec only uses ONE delegation level in the 2.0.0.2.ip6.arpa zone (the ip6.arpa zone is specified in [RFC3596]) 🌸 and it only delegates zones at the 48th bit position. That lines up with individual delegations tied to a single /32 IPv4 address, aka the equivalent of one 6to4 local site 🎀

the zone files with the end site delegations are supposed to run with a low TTL (we're talking hours, not days or weeks) ⏰ and updates for delegation requests in the 2.0.0.2.ipv6.arpa zone get made with dynamic DNS updates [RFC2136] 💅

the delegation system is self-driven by clients living inside 6to4 networks 🫶 the 6to4 reverse DNS delegation function is only accessible to clients using 6to4 IPv6 source addresses, and the only delegation they can manage is the one matching the /48 prefix of their IPv6 source address. main character energy, but make it secure 😤

this service uses web-based server access over Transport Layer Security (TLS) [RFC4346] (reached through a "https:" URL) 🔐 the point is to make sure the source address-driven delegation selection can't get messed with through proxy caching of the web server's responses, and also to make sure the delegation service can't be easily copied 🙈

the service lives at https://6to4.nro.net 🦋 it runs on web servers that sit on a dual-stack IPv4 / IPv6 server and are accessible via SSL. the web server's actions depend on the client's source address. if the client uses a 6to4 source address, the server shows a delegation interface for the matching 6to4 reverse zone. otherwise, the server just gives a description of the delegation process 📖

when you come in with a 6to4 source address, the interface is a conventional DNS delegation interface, so you can enter the details of a bunch of DNS servers for the matching reverse domain 🍓 the delegation manager checks the targets using IPv4 and IPv6 (depending on their addresses) to make sure they're responding, configured consistently, and authoritative for the delegated domain 🔍 if all that checks out, the delegation details get entered into the zone at the primary master ✅ to keep the server from being abused as a denial of service platform, the server should throttle the number of DNS delegation requests made to any single IP address, and also throttle the number of redelegation requests for any single 6to4 zone 🛑

in every other case, the system gives the client diagnostic information 🧚

the perks of this setup? it's fully automated ✨ the service is on demand, and the system only allows self-operation of the delegation function 💜

now the potential issues (don't worry, we'll talk through them):

Clients inside a 6to4 site could alter the delegation details without the knowledge of the site administrator. It is noted that this is intended for small-scale sites. Where there are potential issues of unauthorized access to this delegation function, the local site administrator could take appropriate access control measures. 🙈
IPv4 DHCP-based 6to4 sites, or any 6to4 site that uses dynamically-assigned external IPv4 interface addresses, could inherit nonsense reverse entries created by previous users of the dynamically assigned address. In this case, the client site could request delegation of the reverse zone as required. More generally, given the potentially for inheritance of 'stale' reverse DNS information in this context, in those cases where the issues of potential inheritance of 'stale' reverse DNS information is a concern, it is recommended that a 6to4 site either use a static IPv4 address in preference to a dynamically-assigned address, or ensure that the reverse delegation information is updated using the service mechanism described here upon each dynamic address assignment event. 💀
The approach does not scale efficiently, as there is the potential that the flat zone file may grow considerably. However, it is noted that 6to4 is intended to be a transition mechanism useful for a limited period of time in a limited context of an isolated network where other forms of a tunnelled connection is not feasible. It is envisaged that at some point the density of IPv6 adoption in stub network would provide adequate drivers for widespread adoption of native IPv6 services, obviating the need for continued scaling of 6to4 support services. An estimate of the upper bound of the size of the 6to4 reverse delegation zone would be of the order of millions of entries. It is also noted that the value of a reverse delegation is a questionable proposition and many deployment environments have no form of reverse delegation. 😭
It is also conceivable that an enterprise network could decide to use 6to4 internally in some form of private context, with the hosts only visible in internal DNS servers. In this mechanism the reverse delegation, if desired, would need to be implemented in an internal private (non-delegated) corresponding zone of the 6to4 reverse domain space. 🌈

there may be circumstances where an IPv4 address controller wants to "block" people using these addresses from using this 6to4 scheme 🚫 scenarios that would motivate this include situations where the IPv4 provider is also offering an IPv6 service, and native IPv6 should be deployed instead of 6to4. in those situations, the 6to4 reverse zone operator should allow for such a 6to4 reverse delegation blocking function upon application to the delegation zone operator 📝

for a delegation to happen, the following conditions should hold:

The 6to4 site must have configured a minimum of one primary and one secondary server for the 6to4 IPv6 reverse address zone.
At the time of the delegation request, the primary and secondary servers must be online, reachable, correctly configured, and in a mutually consistent state with respect to the 6to4 reverse zone. In this context, "mutually consistent" implies the same SOA RR and identical NS RRSets.
The 6to4 reverse delegation service will only accept delegation requests associated with the 6to4 source address of the requesting client. 🔒

the approach here, a fully automated system driven by the site administrators of the 6to4 client networks, seems like an appropriate match for the operational needs of managing reverse DNS domains for 6to4 addresses 💖

for upkeep of the reverse delegation zones, the service keeps an email contact point for each active delegation 📬 that contact is derived from the zone's SOA contact address (SOA RNAME), or explicitly entered in the delegation interface. this contact point gets informed whenever the delegation details change later on.

the 6to4 reverse DNS management system also does a periodic sweep of all active delegations, so every delegation gets checked every 30 days 🗓️ if a delegation fails this integrity check, the email contact point is informed of the problem, and another check is scheduled for 14 days later. if that second check fails too, the delegation is automatically removed, and another notice is sent to the contact point 💅

5. Security Considerations 🚨

this system offers a rudimentary level of assurance 🥺 it tries to make sure that delegation requests from a 6to4 site can only direct the delegation of the matching 6to4 reverse DNS domain and no other.

address-based authentication is not a very robust method from a security perspective, because addresses can be readily spoofed 😱 so reverse delegation information doesn't reliably validate a domain name or an IP address, and no conclusions should be drawn from whether or not a reverse DNS mapping exists for any IP address.

the service management interface lets a 6to4 client insert any server name as a DNS server, which could direct the delegation test system to make a DNS query to any nominated system 👀 the server throttles the number of requests made to any single IP address to reduce the risk of a high volume of bogus DNS queries being generated by the server. for similar reasons, the server also throttles the number of redelegation requests for any single 6to4 zone 🛡️

for a general threat analysis of 6to4, especially the extra risk of address spoofing in 2002::/16, see [RFC3964] 🧐

Section 4 notes that the local site administrator could take appropriate access control measures to stop clients inside a 6to4 site from making unauthorized changes to the delegation details. this could look like a firewall configuration controlling access to the service from inside a 6to4 site, or a similar mechanism that enforces local access policies 🔥

6. IANA Considerations

the IANA has delegated the 2.0.0.2.ip6.arpa domain according to delegation instructions provided by the Internet Architecture Board 🏛️

7. Acknowledgements

the author thanks Keith Moore 🙌 for his earlier work preparing a document that listed a bunch of possible approaches for delegating and discovering reverse zones. the author also appreciates the help of George Michaelson and Andrei Robachevsky in preparing this document, and thanks Peter Koch, Pekka Savola, Jun-ichiro Itojun Hagino, and Catherine Meadows for their helpful review comments 💜

8. References

8.1. Normative References

[RFC2136]   Vixie, P., Thomson, S., Rekhter, Y., and J. Bound,
            "Dynamic Updates in the Domain Name System (DNS UPDATE)",
            RFC 2136, April 1997.

[RFC3056]   Carpenter, B. and K. Moore, "Connection of IPv6 Domains
            via IPv4 Clouds", RFC 3056, February 2001.

[RFC3596]   Thomson, S., Huitema, C., Ksinant, V., and M. Souissi,
            "DNS Extensions to Support IP Version 6", RFC 3596,
            October 2003.

[RFC4346]   Dierks, T. and E. Rescorla, "The Transport Layer Security
            (TLS) Protocol Version 1.1", RFC 4346, April 2006.

8.2. Informative References

[6to4-dns]  Moore, K., "6to4 and DNS", Work in Progress, April 2003.

[RFC3964]   Savola, P. and C. Patel, "Security Considerations for
            6to4", RFC 3964, December 2004.

Author's Address

Geoff Huston
APNIC

EMail: gih@apnic.net
URI:   http://www.apnic.net

Full Copyright Statement

This document is subject to the rights, licenses and restrictions contained in BCP 78, and except as set forth therein, the authors retain all their rights.

This document and the information contained herein are provided on an "AS IS" basis and THE CONTRIBUTOR, THE ORGANIZATION HE/SHE REPRESENTS OR IS SPONSORED BY (IF ANY), THE INTERNET SOCIETY, THE IETF TRUST AND THE INTERNET ENGINEERING TASK FORCE DISCLAIM ALL WARRANTIES, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO ANY WARRANTY THAT THE USE OF THE INFORMATION HEREIN WILL NOT INFRINGE ANY RIGHTS OR ANY IMPLIED WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE.

Intellectual Property ⚖️

bestie, so the IETF is basically saying it's NOT picking a side on whether any IPR (intellectual property rights) or other rights claimed over the tech in this doc are valid or how far they reach, and it's also not saying it went digging to find any of them 🙅‍♀️. If you want the rules on rights for RFC docs, check out BCP 78 and BCP 79 📚.

Copies of IPR disclosures sent to the IETF Secretariat are a whole thing 💅. So are any licensing assurances, and the results of anyone trying to get a general license or permission for implementers or users to use those proprietary rights. All of that lives in the IETF's online IPR repository at http://www.ietf.org/ipr 🔗.

And the IETF genuinely wants to hear from you 🫶. If you know about any copyrights, patents, patent applications, or other proprietary rights that might cover tech you'd need to implement this standard, send that info to ietf-ipr@ietf.org 📬✨. No cap, it's the bestie move 💖.

📦 where this page comes from

ietf: rfc5158 2008-03
💖 girlified by claude-haiku-5-5 on 2026-10-17: a language model's rewrite of the original, under its terms