IPv6-only recursive resolving of cache.nixos.org broken

[mweinelt]

Recursively resolving cache.nixos.org in an IPv6-only setup is impossible, since the fastly.com authoritative nameservers don't provide IPv6 connectivity.

# drill -T cache.nixos.org AAAA
.	518400	IN	NS	a.root-servers.net.
.	518400	IN	NS	b.root-servers.net.
.	518400	IN	NS	c.root-servers.net.
.	518400	IN	NS	d.root-servers.net.
.	518400	IN	NS	e.root-servers.net.
.	518400	IN	NS	f.root-servers.net.
.	518400	IN	NS	g.root-servers.net.
.	518400	IN	NS	h.root-servers.net.
.	518400	IN	NS	i.root-servers.net.
.	518400	IN	NS	j.root-servers.net.
.	518400	IN	NS	k.root-servers.net.
.	518400	IN	NS	l.root-servers.net.
.	518400	IN	NS	m.root-servers.net.
org.	172800	IN	NS	a0.org.afilias-nst.info.
org.	172800	IN	NS	a2.org.afilias-nst.info.
org.	172800	IN	NS	b0.org.afilias-nst.org.
org.	172800	IN	NS	b2.org.afilias-nst.org.
org.	172800	IN	NS	c0.org.afilias-nst.info.
org.	172800	IN	NS	d0.org.afilias-nst.org.
nixos.org.	86400	IN	NS	dns1.p02.nsone.net.
nixos.org.	86400	IN	NS	dns2.p02.nsone.net.
nixos.org.	86400	IN	NS	dns3.p02.nsone.net.
nixos.org.	86400	IN	NS	dns4.p02.nsone.net.
cache.nixos.org.	3600	IN	CNAME	dualstack.v2.shared.global.fastly.net.
net.	172800	IN	NS	b.gtld-servers.net.
net.	172800	IN	NS	k.gtld-servers.net.
net.	172800	IN	NS	c.gtld-servers.net.
net.	172800	IN	NS	i.gtld-servers.net.
net.	172800	IN	NS	a.gtld-servers.net.
net.	172800	IN	NS	g.gtld-servers.net.
net.	172800	IN	NS	l.gtld-servers.net.
net.	172800	IN	NS	e.gtld-servers.net.
net.	172800	IN	NS	d.gtld-servers.net.
net.	172800	IN	NS	h.gtld-servers.net.
net.	172800	IN	NS	j.gtld-servers.net.
net.	172800	IN	NS	m.gtld-servers.net.
net.	172800	IN	NS	f.gtld-servers.net.
fastly.net.	172800	IN	NS	ns1.fastly.net.
fastly.net.	172800	IN	NS	ns2.fastly.net.
fastly.net.	172800	IN	NS	ns3.fastly.net.
fastly.net.	172800	IN	NS	ns4.fastly.net.

Debian, they also host their cache at fastly, have their CNAME set to something below fastlydns.net, which does have full IPv6 connectivity.

# drill -T deb.debian.org AAAA
.	518400	IN	NS	a.root-servers.net.
.	518400	IN	NS	b.root-servers.net.
.	518400	IN	NS	c.root-servers.net.
.	518400	IN	NS	d.root-servers.net.
.	518400	IN	NS	e.root-servers.net.
.	518400	IN	NS	f.root-servers.net.
.	518400	IN	NS	g.root-servers.net.
.	518400	IN	NS	h.root-servers.net.
.	518400	IN	NS	i.root-servers.net.
.	518400	IN	NS	j.root-servers.net.
.	518400	IN	NS	k.root-servers.net.
.	518400	IN	NS	l.root-servers.net.
.	518400	IN	NS	m.root-servers.net.
org.	172800	IN	NS	d0.org.afilias-nst.org.
org.	172800	IN	NS	a0.org.afilias-nst.info.
org.	172800	IN	NS	c0.org.afilias-nst.info.
org.	172800	IN	NS	a2.org.afilias-nst.info.
org.	172800	IN	NS	b0.org.afilias-nst.org.
org.	172800	IN	NS	b2.org.afilias-nst.org.
debian.org.	86400	IN	NS	nsp.dnsnode.net.
debian.org.	86400	IN	NS	dns4.easydns.info.
debian.org.	86400	IN	NS	sec1.rcode0.net.
debian.org.	86400	IN	NS	sec2.rcode0.net.
deb.debian.org.	3600	IN	CNAME	debian.map.fastlydns.net.
net.	172800	IN	NS	a.gtld-servers.net.
net.	172800	IN	NS	b.gtld-servers.net.
net.	172800	IN	NS	c.gtld-servers.net.
net.	172800	IN	NS	d.gtld-servers.net.
net.	172800	IN	NS	e.gtld-servers.net.
net.	172800	IN	NS	f.gtld-servers.net.
net.	172800	IN	NS	g.gtld-servers.net.
net.	172800	IN	NS	h.gtld-servers.net.
net.	172800	IN	NS	i.gtld-servers.net.
net.	172800	IN	NS	j.gtld-servers.net.
net.	172800	IN	NS	k.gtld-servers.net.
net.	172800	IN	NS	l.gtld-servers.net.
net.	172800	IN	NS	m.gtld-servers.net.
fastlydns.net.	172800	IN	NS	ns1.fastlydns.net.
fastlydns.net.	172800	IN	NS	ns2.fastlydns.net.
fastlydns.net.	172800	IN	NS	ns3.fastlydns.net.
fastlydns.net.	172800	IN	NS	ns4.fastlydns.net.
debian.map.fastlydns.net.	30	IN	AAAA	2a04:4e42:62::644
fastlydns.net.	86400	IN	NS	ns1.fastlydns.net.
fastlydns.net.	86400	IN	NS	ns2.fastlydns.net.
fastlydns.net.	86400	IN	NS	ns3.fastlydns.net.
fastlydns.net.	86400	IN	NS	ns4.fastlydns.net.

Can we find out what this is, and how we can get it, too?

[zimbatm]

I'm not sure if that's possible. debian.map.fastlydns.net. looks like something custom they got from Fastly.

https://support.fastly.com/hc/en-us/articles/360035069912-IPv6-support doesn't mention fastlydns.

[zimbatm]

I agree that it's weird that ns1.fastly.net doesn't reply AAAA. Luckily, most of the time I would expect an intermediate DNS to reply to the query but still.

[mweinelt]

The problem is that ns1.fastly.net is not reachable via IPv6, not that it does not reply with a AAAA record (which it does for me).

❯ echo ns{1,2,3,4}.fastly.net | xargs -n 1 host -t AAAA
ns1.fastly.net has no AAAA record
ns2.fastly.net has no AAAA record
ns3.fastly.net has no AAAA record
ns4.fastly.net has no AAAA record

[vcunat]

I don't know... so poke their support? https://support.fastly.com

It might work even without any customer account. Any better ideas? EDIT: I did look into their docs further and found nothing.

[vcunat]

Query sent.

[vcunat]

I'll need our account ID, apparently.

We may be able to squeeze you into our IPv6 authoritative DNS delivery beta program, If you're happy to do so. You will need to agree to our Terms of Service conditions which should be with you soon.

Can you confirm your account ID please.

EDIT: I hope "beta" doesn't mean anything risky really.

EDIT2: we're following up the support thread now.

[vcunat]

Nothing risky is involved but we would like to make you aware of the fact that performance is not as tuned as for our IPv4 only DNS answers so you may see something there. You will also need to work with us to provide us with insight into any performance issues you may see. We will use that insight to help improve the performance. If you're are ok with this we are happy to include you.

Sounds OK to me, but I expect that also some else should ACK it before proceeding.

I don't expect that speed of DNS itself could be as significant for us in this case, as there are few names and will be mostly used in large batches (amortization through caching).

[vcunat]

Hmm, their "beta" wording isn't as encouraging as I hoped, e.g.

Fastly strongly advises against using production traffic for Beta products due to their dynamic nature.

[zimbatm]

Yeah, let's wait.

[grahamc]

Happy 1 year anniversary of this issue. Just contacted Fastly support about this to see what they say.

Update: they said I'd hear back tomorrow.

[grahamc]

IPv6 has been enabled on all our distributions. However, it involves a configuration change in our DNS. I'm confirming with Fastly that we should in fact replace the CNAMEs with A's and AAAA's on our end.

[Kabbone]

are there any news on this topic?

[Mic92]

IPv6 has been enabled on all our distributions. However, it involves a configuration change in our DNS. I'm confirming with Fastly that we should in fact replace the CNAMEs with A's and AAAA's on our end.

To me it looks like they are returning different A/AAAA records depending where you resolve the domain from. So I don't this is a good idea.