20.1. Berkeley Internet Name Daemon BIND (named)

20.1.1. Listening on IPv6 addresses

Note: unlike in IPv4 current versions doesn't allow to bind a server socket to dedicated IPv6 addresses, so only any or none are valid. Because this can be a security issue, check the Access Control List (ACL) section below, too!

options {
        # sure other options here, too
        listen-on-v6 { any; };
};
    

# netstat -lnptu |grep "named\W*$" 
tcp 0 0 :::53         :::*      LISTEN 1234/named
¬ # incoming TCP requests
udp 0 0 1.2.3.4:53    0.0.0.0:*        1234/named
¬ # incoming UDP requests to IPv4 1.2.3.4
udp 0 0 127.0.0.1:53  0.0.0.0:*        1234/named
¬ # incoming UDP requests to IPv4 localhost
udp 0 0 0.0.0.0:32868 0.0.0.0:*        1234/named
¬ # dynamic chosen port for outgoing queries
udp 0 0 :::53         :::*             1234/named
¬ # incoming UDP request to any IPv6
    

# dig localhost @::1
    

options {
        # sure other options here, too
        listen-on-v6 { none; };
};
    

20.1.2. IPv6 enabled Access Control Lists (ACL)

IPv6 enabled ACLs are possible and should be used whenever it's possible. An example looks like following:

acl internal-net { 
        127.0.0.1; 
        1.2.3.0/24;  
        3ffe:ffff:100::/56; 
        ::1/128; 
        ::ffff:1.2.3.4/128; 
};
acl ns-internal-net { 
        1.2.3.4;  
        1.2.3.5;  
        3ffe:ffff:100::4/128; 
        3ffe:ffff:100::5/128; 
};
   

This ACLs can be used e.g. for queries of clients and transfer zones to secondary name-servers. This prevents also your caching name-server to be used from outside using IPv6.

options {
        # sure other options here, too
        listen-on-v6 { none; };
        allow-query { internal-net; }; 
        allow-transfer { ns-internal-net; }; 
};
   

It's also possible to set the allow-query and allow-transfer option for most of single zone definitions, too.

20.1.3. Sending queries with dedicated IPv6 address

This option is not required, but perhaps needed:

query-source-v6 address <ipv6address|*> port <port|*>;
   

20.1.4. Per zone defined dedicated IPv6 addresses

It's also possible to define per zone some IPv6 addresses.

transfer-source-v6 <ipv6addr|*> [port port];
    

notify-source-v6 <ipv6addr|*> [port port];
    

20.1.5. IPv6 DNS zone files examples

Some information can be also found at IPv6 DNS Setup Information (article). Perhaps also helpful is the IPv6 Reverse DNS zone builder for BIND 8/9 (webtool).

20.1.6. Serving IPv6 related DNS data

For IPv6 new types and root zones for reverse lookups are defined:

• AAAA and reverse IP6.INT: specified in RFC 1886 / DNS Extensions to support IP version 6, usable since BIND version 4.9.6

• A6, DNAME (DEPRECATED NOW!) and reverse IP6.ARPA: specified in RFC 2874 / DNS Extensions to Support IPv6 Address Aggregation and Renumbering, usable since BIND 9, but see also an information about the current state at draft-ietf-dnsext-ipv6-addresses-00.txt

Perhaps filled later more content, for the meantime take a look at given RFCs and

• AAAA and reverse IP6.INT: IPv6 DNS Setup Information

• A6, DNAME (DEPRECATED NOW!) and reverse IP6.ARPA: take a look into chapter 4 and 6 of the BIND 9 Administrator Reference Manual (ARM) distributed which the bind-package or get this here: BIND version 9 ARM (PDF)

Because IP6.INT is deprecated (but still in use), a DNS server which will support IPv6 information has to serve both reverse zones.

20.1.7. Checking IPv6-enabled connect

To check, whether BIND is listening on an IPv6 socket and serving data see following examples.

$ host -t aaaa www.6bone.net 3ffe:ffff:200:f101::1 
Using domain server: 
Name: 3ffe:ffff:200:f101::1 
Address: 3ffe:ffff:200:f101::1#53 
Aliases:
Host www.6bone.net. not found: 5(REFUSED)
    

Jan 3 12:43:32 gate named[12347]: client
¬ 3ffe:ffff:200:f101:212:34ff:fe12:3456#32770: 
 query denied
    

$ host -t aaaa www.6bone.net 3ffe:ffff:200:f101::1 
Using domain server: 
Name: 3ffe:ffff:200:f101::1 
Address: 3ffe:ffff:200:f101::1#53 
Aliases:
www.6bone.net. is an alias for 6bone.net. 
6bone.net. has AAAA address 3ffe:b00:c18:1::10