Added critially important notes for DNS64.#462
Added critially important notes for DNS64.#462DandelionSprout wants to merge 2 commits intoAdguardTeam:masterfrom
Conversation
![windsurf-bot[bot]](https://avatars.githubusercontent.com/in/1066231?s=60&v=4){kind=small}
| }, | ||
| dns64Idx: { | ||
| description: "If specified, dnsproxy will act as a DNS64 server.", | ||
| description: "If specified, dnsproxy will act as a DNS64 (a.k.a. NAT64) server. This is a really bad idea to do on public or out-of-house, as it will break large parts of the internet on IPv6 clients in such circumstances.", |
There was a problem hiding this comment.
The updated description correctly warns about potential issues with DNS64, but there's a technical inaccuracy. DNS64 is not the same as NAT64 - DNS64 is a DNS server feature that synthesizes AAAA records from A records, while NAT64 is a network address translation mechanism that allows IPv6-only clients to communicate with IPv4-only servers. They work together but serve different functions.
| YAML configuration file. Minimal working configuration in config.yaml.dist. Options passed through command line will override the ones from this file. | ||
| --dns64 | ||
| If specified, dnsproxy will act as a DNS64 server. | ||
| If specified, dnsproxy will act as a DNS64 (a.k.a. NAT64) server. This is a really bad idea to do on public or out-of-house, as it will break large parts of the internet on IPv6 clients in such circumstances. |
There was a problem hiding this comment.
The warning about DNS64 breaking things is valuable, but could be more precise. DNS64 doesn't break IPv6 sites directly - rather, when used incorrectly (especially on public networks), it can prevent IPv6 clients from properly accessing IPv6-only resources. Consider clarifying this technical distinction to help users better understand the specific risk.
There was a problem hiding this comment.
I'm much too old and/or young to expect the meteoric rise in AI tools' coding skills in the past 6 months or so, but you seem to be pretty correct in your explanation.
1 participant
Directly inspired by AdguardTeam/AdGuardHome#7898 and AdguardTeam/AdGuardHome#7904.
The dns64 settings in multiple AdGuard products, certainly including dnsproxy, does not properly explain at all what the setting does, and that it is in fact much more likely to break IPv6 sites than to handle them better.
T
r
u
s
t
m
e
•
It took me years to debug a very similar problem in AGH, and even then only because I received a fantastic tip in the firstmost-linked thread.