IPv6 is supported since version 9. Always use newest available version. At least version 9.1.3 must be used, older versions can contain remote exploitable security holes.
Note: unlike in IPv4 current versions doesn't allow to bind a server socket to dedicated IPv6 addresses, so only any or none are valid. Because this can be a security issue, check the Access Control List (ACL) section below, too!
To enable IPv6 for listening, following options are requested to change
options {
# sure other options here, too
listen-on-v6 { any; };
};
|
This should result after restart in e.g.
# netstat -lnptu |grep "named\W*$"
tcp 0 0 :::53 :::* LISTEN 1234/named # incoming TCP requests
udp 0 0 1.2.3.4:53 0.0.0.0:* 1234/named # incoming UDP requests to IPv4 1.2.3.4
udp 0 0 127.0.0.1:53 0.0.0.0:* 1234/named # incoming UDP requests to IPv4 localhost
udp 0 0 0.0.0.0:32868 0.0.0.0:* 1234/named # dynamic chosen port for outgoing queries
udp 0 0 :::53 :::* 1234/named # incoming UDP request to any IPv6
|
And a simple test looks like
# dig localhost @::1
|
and should show you a result.
To disable IPv6 for listening, following options are requested to change
options {
# sure other options here, too
listen-on-v6 { none; };
};
|
IPv6 enabled ACLs are possible and should be used whenever it's possible. An example looks like following:
acl internal-net {
127.0.0.1;
1.2.3.0/24;
3ffe:ffff:100::/56;
::1/128;
::ffff:1.2.3.4/128;
};
acl ns-internal-net {
1.2.3.4;
1.2.3.5;
3ffe:ffff:100::4/128;
3ffe:ffff:100::5/128;
};
|
This ACLs can be used e.g. for queries of clients and transfer zones to secondary name-servers. This prevents also your caching name-server to be used from outside using IPv6.
options {
# sure other options here, too
listen-on-v6 { none; };
allow-query { internal-net; };
allow-transfer { ns-internal-net; };
};
|
It's also possible to set the allow-query and allow-transfer option for most of single zone definitions, too.
This option is not required, but perhaps needed:
query-source-v6 address <ipv6address|*> port <port|*>; |
It's also possible to define per zone some IPv6 addresses.
Transfer source address is used for outgoing zone transfers:
transfer-source-v6 <ipv6addr|*> [port port];
|
Notify source address is used for outgoing notify messages:
notify-source-v6 <ipv6addr|*> [port port];
|
For IPv6 new types and root zones for reverse lookups are defined:
AAAA and reverse IP6.INT: specified in RFC 1886 / DNS Extensions to support IP version 6, usable since BIND version 4.9.6
A6, DNAME and reverse IP6.ARPA: specified in RFC 2874 / DNS Extensions to Support IPv6 Address Aggregation and Renumbering, usable since BIND 9, but see also an information about the current state at draft-ietf-dnsext-ipv6-addresses-00.txt
Perhaps filled later more content, for the meantime take a look at given RFCs and
AAAA and reverse IP6.INT: IPv6 DNS Setup Information
A6, DNAME and reverse IP6.ARPA: take a look into chapter 4 and 6 of the BIND 9 Administrator Reference Manual (ARM) distributed which the bind-package or get this here: BIND version 9 ARM (PDF)
Because IP6.INT is deprecated (but still in use), a DNS server which will support IPv6 information has to serve both reverse zones.
Because there are some troubles around using the new formats, current best practice is:
Forward lookup support:
AAAA
A6 without chaining, means prefix length value set to 0
Reverse lookup support:
Reverse nibble format for zone ip6.int
Reverse nibble format for zone ip6.arpa
To check, whether BIND is listening on an IPv6 socket and serving data see following examples.
Specifying a dedicated server for the query, an IPv6 connect can be forced:
$ host -t aaaa www.6bone.net 3ffe:ffff:200:f101::1
Using domain server:
Name: 3ffe:ffff:200:f101::1
Address: 3ffe:ffff:200:f101::1#53
Aliases:
Host www.6bone.net. not found: 5(REFUSED)
|
Related log entry looks like following:
Jan 3 12:43:32 gate named[12347]: client
¬ 3ffe:ffff:200:f101:212:34ff:fe12:3456#32770:
query denied
|
If you see such entries in the log, check whether requests from this client should be allowed and perhaps review your ACL configuration.
A successful IPv6 connect looks like following:
$ host -t aaaa www.6bone.net 3ffe:ffff:200:f101::1
Using domain server:
Name: 3ffe:ffff:200:f101::1
Address: 3ffe:ffff:200:f101::1#53
Aliases:
www.6bone.net. is an alias for 6bone.net.
6bone.net. has AAAA address 3ffe:b00:c18:1::10
|