Articles: IPv6 Deployment Status
There is a grand number of malicious AAAA records which hinders the deployment of IPv6.
Added: 2009-06-06 19:26:17 - Modified: 2009-08-05 18:59:16 - Level: Intermediate
![]()
Recommend this article to a friend.
Toggle more
Introduction
This article assumes that the reader has a basic grasp of what IPv6 is, and concerns various odd behavior in deployment of such. This study is focused on the .net top level domain. The reason for .net being tested is its intention of being infrastructure carrying, as well as containing a number of domains corresponding to 15% of the .com top level domain. If enough interest is shown a similar study might be conducted on the .com top level domain at a later time.
The process is relatively simple, download the .net TLD zonefile and load it into a DNS server, then start crunching out AAAA queries before looking at the results. I'm performing two queries for each domain name, checking the root record of the domain as well as the www subdomain for AAAA. This was performed on all the unique domains in the .net TLD, which at the time of download corresponded to 12,259,907 domain names (note: this does not reflect all registered domain names, but merely those with corresponding nameserver records). The .net zone file contains 437 AAAA glue records for .net nameservers. For comparison the .com zone file, at the time of download, included 80,811,887 domain names and 283 AAAA glue records.
This study ran DNS queries against 5,315,338 domain names in the net zonefile, corresponding to 43.4 per cent of the total names in the zone. Of these 68,405 responded to AAAA entries.
KF Webs previously (2006) produced two articles regarding the .com and .net zonefiles, which can be found at www.kfwebs.net and www.kfwebs.net
Problematic AAAA records
There are in particular two sets of AAAA records that seems counter-intuitive to the deployment of IPv6. Mainly these are records in the natures ::ffff: and ::1. As individuals familiar with IPv6 know ::ffff: is an IPv6-IPv4-mapping, while ::1 is similar to the IPv4 127.0.0.1 loopback interface address. The use of ipv4 mapping is counter-intuitive on two counts
1) Some common IPv6 stacks do not support the IPv4 mapped address feature, either because the IPv6 and IPv4 stacks are separate implementations (Microsoft Windows prior to Vista/Longhorn: e.g. XP/2003), or because of security concerns (OpenBSD). On these operating systems, it is necessary to open a separate socket for each IP protocol that is to be supported. On some systems (e.g., Linux, NetBSD, FreeBSD) this feature is controlled by the socket option IPV6_V6ONLY. The DNS system will handle a v6 mapped v4 address as any other v6 address. [1]
2) IPv4 mapping is redundant and should simply be an A record in the DNS system. IPv6-only clients will not be able to access ipv4-mapped addresses.
There is an argument for using a dualstack listening / ipv4-mapping on the actual server, as this requires opening only one socket for both IPv6 and IPv4. However, any address included for global DNS servers shoudl also be globally routable.
The use of ::1 AAAA records should be reserved for use in /etc/hosts files and similar as it has no value for other computers. The addition of a ::1 AAAA record will break connectivity to the website for IPv6-enabled users, and as such should be avoided (unless this is the intention, although there doesn't seem too much of a point for this).
A total of 11,780 domain names contained AAAA records starting with ::ffff:, representing 17.22 per cent of the total AAAA respondants.
5,084 queries (7.43 per cent of the total AAAA records) returned ::1 AAAA records
A large share of the domain names using these AAAA values are, in particular, associated with the two domain name registrars DirectNIC (for ::ffff:) and GoDaddy (for ::1). This can suggest Search Engine Optimization being one of the reasons for such entries (it was mainly for domain parking sites). Upon contacting GoDaddy about the incentives for such records, the response was merely "Unfortunatly we are not able to respond to the incentives of creating this type of A (sic) record. However, you can find more infomration(sic) by conducting a search with your favorite search engine."
Trivial information about the process
Sources
- bgp.he.net
- VeriSign TLD Zone Files
- [1] IPv6 on wikipedia
Related articles:
[Sitemap]


