How do NAT64 and DNS64 work, and what breaks with them?
Show the answer
Say this first
They let IPv6-only clients reach IPv4-only servers. DNS64 answers an AAAA query for a name that has only an
A record by building a synthetic AAAA: the IPv4 address embedded in a NAT64 prefix, usually the well-known
64:ff9b::/96 (RFC 6052). The client sends to that address, and a stateful NAT64 (RFC 6146) translates the
packet to IPv4, keeping port state much like PAT. It breaks anything that does not go through DNS: IPv4
literals, protocols that carry addresses inside the payload, and DNSSEC validation on the client. 464XLAT
fixes most of that by adding a small translator on the client.
Go deeper
The flow
1. Client asks DNS64 for AAAA of app.example.com
2. DNS64 finds no AAAA, finds A 192.0.2.33
3. DNS64 returns AAAA 64:ff9b::c000:221 (192.0.2.33 = c000:0221)
4. Client opens TCP to [64:ff9b::c000:221]:443
5. NAT64 translates to 198.51.100.7:40001 -> 192.0.2.33:443 and keeps the mapping198.51.100.7 is the NAT64's IPv4 pool address.
What breaks
| Case | Why |
|---|---|
IPv4 literals (http://192.0.2.33/) | no DNS lookup, no synthesis |
| Apps that open IPv4-only sockets | the client has no IPv4 |
| SIP, FTP and other protocols with addresses inside | needs an ALG |
| DNSSEC validated on the client | synthetic AAAA records fail validation |
| Logging and abuse handling | many users share one IPv4, as with CGNAT |
464XLAT (RFC 6877)
The client runs a CLAT: a local stateless translator that gives apps a private IPv4 address and turns their IPv4 packets into IPv6 toward the NAT64 (called the PLAT here). IPv4 literals and IPv4-only apps work again. Android has shipped a CLAT for years, and mobile carriers use this to run IPv6-only networks.
Finding the prefix
Clients can discover the NAT64 prefix by looking up ipv4only.arpa (RFC 7050) or from the PREF64 option in
RAs. Operators may use their own network-specific prefix instead of 64:ff9b::/96.
They will ask next
Why not just use NAT-PT?
NAT-PT combined translation and DNS rewriting in one box and was deprecated for its problems. NAT64 and DNS64 separate the two jobs and are what replaced it.
What is the difference between stateful and stateless NAT64?
Stateful NAT64 shares a small IPv4 pool among many IPv6 clients using ports, like PAT. Stateless (SIIT) maps addresses 1:1 with no state, which needs one IPv4 address per IPv6 host it serves.
Traps
- Saying DNS64 translates packets. It only synthesizes DNS answers.
- Forgetting that IPv4 literals bypass DNS64.