198f3ca02SbradThe DNS64 code was written by Viagenie, 2009, by Simon Perrault as part 298f3ca02Sbradof the Ecdysis project. The code is copyright by them, and has the BSD 398f3ca02Sbradlicense (see the dns64/dns64.c file). 498f3ca02Sbrad 598f3ca02SbradTo enable DNS64 functionality in Unbound, two directives in unbound.conf must 698f3ca02Sbradbe edited: 798f3ca02Sbrad 898f3ca02Sbrad1. The "module-config" directive must start with "dns64". For example: 998f3ca02Sbrad 1098f3ca02Sbrad module-config: "dns64 validator iterator" 1198f3ca02Sbrad 1298f3ca02SbradIf you're not using DNSSEC then you may remove "validator". 1398f3ca02Sbrad 1498f3ca02Sbrad2. The "dns64-prefix" directive indicates your DNS64 prefix. For example: 1598f3ca02Sbrad 1698f3ca02Sbrad dns64-prefix: 64:FF9B::/96 1798f3ca02Sbrad 1898f3ca02SbradThe prefix must be a /96 or shorter. 1998f3ca02Sbrad 2098f3ca02SbradTo test that things are working right, perform a query against Unbound for a 2198f3ca02Sbraddomain name for which no AAAA record exists. You should see a AAAA record in 2298f3ca02Sbradthe answer section. The corresponding IPv6 address will be inside the DNS64 2398f3ca02Sbradprefix. For example: 2498f3ca02Sbrad 2598f3ca02Sbrad $ unbound -c unbound.conf 2698f3ca02Sbrad $ dig @localhost jazz-v4.viagenie.ca aaaa 2798f3ca02Sbrad [...] 2898f3ca02Sbrad ;; ANSWER SECTION: 2998f3ca02Sbrad jazz-v4.viagenie.ca. 86400 IN AAAA 64:ff9b::ce7b:1f02 3098f3ca02Sbrad 31*437d2860Ssthen 32*437d2860SsthenNAT64 support was added by David Lamparter in 2022; license(s) of the 33*437d2860Ssthensurrounding code apply. Note that NAT64 is closely related but functionally 34*437d2860Ssthenorthogonal to DNS64; it allows Unbound to send outgoing queries to IPv4-only 35*437d2860Ssthenservers over IPv6 through the configured NAT64 prefix. This allows running 36*437d2860Ssthenan Unbound instance on an IPv6-only host without breaking every single domain 37*437d2860Ssthenthat only has IPv4 servers. Whether that Unbound instance also does DNS64 is 38*437d2860Ssthenan independent choice. 39*437d2860Ssthen 40*437d2860SsthenTo enable NAT64 in Unbound, add to unbound.conf's "server" section: 41*437d2860Ssthen 42*437d2860Ssthen do-nat64: yes 43*437d2860Ssthen 44*437d2860SsthenThe NAT64 prefix defaults to the DNS64 prefix, which in turn defaults to the 45*437d2860Ssthenstandard 64:FF9B::/96 prefix. You can reconfigure it with: 46*437d2860Ssthen 47*437d2860Ssthen nat64-prefix: 64:FF9B::/96 48*437d2860Ssthen 49*437d2860SsthenTo test NAT64 operation, pick a domain that only has IPv4 reachability for its 50*437d2860Ssthennameservers and try resolving any names in that domain. 51