Home › Docs › What is DNS64 and When is it Used?

What is DNS64 and When is it Used?

Executive Summary

DNS64 is a critical IPv6 transition technology that enables IPv6-only networks to seamlessly access IPv4-only services. By synthesizing AAAA (IPv6) DNS records from A (IPv4) records, DNS64 works in tandem with NAT64 translation gateways to bridge the connectivity gap during the lengthy IPv4-to-IPv6 migration period. This technology has become essential infrastructure for modern carrier networks, enterprise IPv6 deployments, and cloud platforms managing IPv4 address exhaustion.

Technical Definition

DNS64 is a DNS protocol extension defined in RFC 6147 that automatically synthesizes IPv6 addresses (AAAA records) from IPv4 addresses (A records) when an IPv6-only client needs to communicate with an IPv4-only server. The synthesized IPv6 address embeds the IPv4 address within a special prefix, allowing NAT64 gateways to perform the necessary protocol translation.

In practice, DNS64 functions as a transparent intermediary in the DNS resolution process. When an IPv6-only client queries for a hostname and only an A record exists (no AAAA record), the DNS64 server constructs a synthetic AAAA record by algorithmically combining:

  1. A configured IPv6 prefix (typically 64:ff9b::/96)
  2. The 32-bit IPv4 address from the original A record

The resulting IPv6 address directs traffic through a NAT64 gateway capable of translating between IPv6 and IPv4 protocols.

The DNS64/NAT64 Architecture

DNS64 never operates in isolation—it requires a paired NAT64 gateway to function. Understanding their relationship is crucial:

┌─────────────────────────────────────────────────────────────────┐
│                    IPv6-Only Network                            │
│                                                                 │
│  ┌──────────────┐                                              │
│  │ IPv6-Only    │  1. DNS Query: www.ipv4only.com (AAAA?)     │
│  │ Client       │────────────────────────────────────────┐    │
│  └──────────────┘                                         │    │
│         │                                                 ▼    │
│         │                                        ┌──────────────┐│
│         │   2. Synthetic AAAA Response:          │   DNS64      ││
│         │      64:ff9b::203.0.113.1              │   Server     ││
│         │◄───────────────────────────────────────┤              ││
│         │                                        └──────────────┘│
│         │ 3. Connect to 64:ff9b::203.0.113.1                   │
│         │    (Embedded IPv4: 203.0.113.1)                      │
│         ▼                                                       │
│  ┌──────────────────────────────────────┐                      │
│  │         NAT64 Gateway                 │                      │
│  │  • Extracts IPv4: 203.0.113.1        │                      │
│  │  • Translates IPv6 ↔ IPv4 packets    │                      │
│  │  • Maintains session state            │                      │
│  └──────────────────────────────────────┘                      │
│         │                                                       │
└─────────┼───────────────────────────────────────────────────────┘
          │ 4. IPv4 connection to 203.0.113.1
          ▼
   ┌──────────────┐
   │ IPv4-Only    │
   │ Server       │
   │ 203.0.113.1  │
   └──────────────┘

Step-by-Step Process Flow

  1. DNS Resolution Request: IPv6-only client requests AAAA record for an IPv4-only destination
  2. DNS64 Detection: DNS64 server finds only A records (no native IPv6 support)
  3. Address Synthesis: DNS64 creates synthetic AAAA record using configured prefix + IPv4 address
  4. Client Connection: Client connects to synthesized IPv6 address
  5. NAT64 Translation: NAT64 gateway extracts embedded IPv4 address and translates packets
  6. Bidirectional Communication: NAT64 maintains session state for return traffic

The Well-Known Prefix: 64:ff9b::/96

The most critical component of DNS64 is the address synthesis prefix. While DNS64 supports custom prefixes, the Well-Known Prefix (WKP) 64:ff9b::/96 defined in RFC 6052 has emerged as the de facto standard.

Why 64:ff9b::/96?

Address Synthesis Mathematics

The WKP uses the first 96 bits for the prefix, leaving the final 32 bits for the IPv4 address:

IPv4 Address:     203.0.113.1
Binary (32-bit):  11001011.00000000.01110001.00000001

WKP (96-bit):     64:ff9b:0000:0000:0000:0000
IPv4 (32-bit):    cb00:7101

Synthesized IPv6: 64:ff9b::cb00:7101
                  or
                  64:ff9b::203.0.113.1 (mixed notation)

Alternative Prefixes

Organizations may deploy Network-Specific Prefixes (NSP) for:

Common NSP formats include:

Implementation Deployment Models

DNS64 can be deployed in three distinct architectural patterns:

1. Recursive Resolver Deployment (Most Common)

DNS64 functionality integrated into the recursive DNS resolver serving end clients:

Advantages:

Use Cases:

Example Implementations:

2. Authoritative Server Deployment

DNS64 logic embedded in authoritative nameservers:

Advantages:

Disadvantages:

Use Cases:

3. Split/Hybrid Deployment

Combination approach with DNS64 at both recursive and authoritative layers:

Use Cases:

Enterprise and Carrier Use Cases

Cellular Network Operators

Mobile carriers represent the largest DNS64/NAT64 deployment base:

Drivers:

Implementation Pattern:

Real-World Examples:

Enterprise Networks

DNS64 addresses three critical enterprise scenarios:

A. Cloud Migration with IPv6-Only Segments

Modern enterprises deploying IPv6-only subnets for:

Supported Platforms:

B. Branch Office IPv6-Only Connectivity

Remote sites connected via IPv6-only WAN links:

Architecture:

C. IoT and Operational Technology (OT) Networks

IPv6-native IoT devices requiring occasional IPv4 access:

Internet Service Providers (ISPs)

Broadband and fiber ISPs deploy DNS64 for:

Residential Subscribers:

Business Services:

Content Delivery and Cloud Platforms

Public DNS64 Services:

Cloud Platform Integration:

Benefits of DNS64 Deployment

1. Transparent IPv4 Access from IPv6-Only Networks

End users and applications experience seamless connectivity without manual configuration or awareness of translation mechanisms.

2. IPv4 Address Conservation

Organizations eliminate the need to assign IPv4 addresses to:

3. Simplified Network Architecture

Dual-stack complexity reduction in IPv6-only networks:

4. Administrative Efficiency

DNS64 eliminates the need to:

5. Cost Reduction

Measurable savings from:

6. Future-Proof Infrastructure

Supports gradual IPv4 retirement while maintaining backward compatibility.

Limitations and Challenges

1. DNSSEC Validation Conflicts

DNSSEC synthesis can break DNSSEC validation:

Problem: Synthesized AAAA records lack valid DNSSEC signatures

Solutions:

Impact: Enterprise networks with mandatory DNSSEC validation require careful architecture design

2. Application Compatibility Issues

Applications with IPv4 assumptions may fail:

Problematic Patterns:

Mitigation:

3. Performance Considerations

DNS64/NAT64 introduces latency:

Factors:

Typical Impact: 2-10ms additional latency (acceptable for most applications)

Optimization:

4. Stateful NAT64 Scaling

NAT64 gateways maintain per-connection state:

Challenges:

Solutions:

5. Troubleshooting Complexity

DNS64/NAT64 obscures end-to-end connectivity:

Difficulties:

Tools:

6. Well-Known Prefix Limitations

The WKP 64:ff9b::/96 cannot translate:

Solution: Deploy Network-Specific Prefixes (NSP) for private address translation

Testing DNS64 Connectivity

When evaluating your network's IPv6 capabilities, DNS64 detection is crucial. Tools like test-ipv6.run provide comprehensive connectivity testing that includes:

DNS64 Detection Methodology

  1. IPv4-Only Endpoint Test: Verify if IPv4 connectivity works
  2. IPv6-Only Endpoint Test: Confirm native IPv6 functionality
  3. Dual-Stack Endpoint Test: Check which protocol is preferred
  4. Synthetic Address Detection: Identify synthesized AAAA records in the 64:ff9b::/96 range

Interpreting DNS64 Test Results

Scenario A: Native Dual-Stack (No DNS64)

Scenario B: DNS64/NAT64 Active

Scenario C: IPv6-Only Without DNS64

For network administrators, testing with test-ipv6.run helps validate DNS64 deployment and identify configuration issues before production rollout.

Best Practices for DNS64 Deployment

1. Start with the Well-Known Prefix

Use 64:ff9b::/96 unless you have specific requirements for NSP deployment.

2. Deploy DNS64 Close to Clients

Place DNS64 functionality in recursive resolvers serving end users, not in authoritative servers.

3. Ensure NAT64 and DNS64 Prefix Alignment

The NAT64 gateway must use the same prefix configured in DNS64.

4. Implement Monitoring and Alerting

Track key metrics:

5. Plan for DNSSEC Validation

Position DNS64 function after DNSSEC validation in the resolution path.

6. Document and Communicate

Inform application development teams about:

7. Consider 464XLAT for Mobile

Deploy 464XLAT (RFC 6877) alongside DNS64/NAT64 for comprehensive mobile application compatibility.

8. Test Thoroughly Before Production

Validate:

Conclusion

DNS64 has evolved from an experimental transition mechanism to a production-grade technology deployed by major carriers, enterprises, and cloud platforms worldwide. By enabling IPv6-only networks to transparently access the IPv4 internet, DNS64 addresses the practical challenges of IPv4 address exhaustion while supporting the long-term migration to IPv6.

For organizations planning IPv6-only network segments—whether in cellular networks, cloud environments, or enterprise data centers—DNS64 paired with NAT64 provides a proven, scalable solution. While limitations exist, particularly around DNSSEC and application compatibility, the benefits of simplified architecture, cost reduction, and future-proof infrastructure make DNS64 an essential component of modern network design.

As the internet continues its gradual transition to IPv6, DNS64 will remain a critical bridging technology, enabling coexistence between IPv6 innovation and IPv4 legacy systems for years to come.

Further Reading:

Test Your Network: Visit test-ipv6.run to evaluate your IPv6 connectivity and detect DNS64 deployment.