22.1.1. Listening on IPv6 addresses

Note: unlike in IPv4 current versions doesn't allow to bind a server socket to dedicated IPv6 addresses, so only any or none are valid. Because this can be a security issue, check the Access Control List (ACL) section below, too!

options {
        # sure other options here, too
        listen-on-v6 { any; };
};

# netstat -lnptu |grep "named\W*$" 
tcp 0 0 :::53         :::*      LISTEN 1234/named
¬ # incoming TCP requests
udp 0 0 1.2.3.4:53    0.0.0.0:*        1234/named
¬ # incoming UDP requests to IPv4 1.2.3.4
udp 0 0 127.0.0.1:53  0.0.0.0:*        1234/named
¬ # incoming UDP requests to IPv4 localhost
udp 0 0 0.0.0.0:32868 0.0.0.0:*        1234/named
¬ # dynamic chosen port for outgoing queries
udp 0 0 :::53         :::*             1234/named
¬ # incoming UDP request to any IPv6

# dig localhost @::1

options {
        # sure other options here, too
        listen-on-v6 { none; };
};

22.1.2. IPv6 enabled Access Control Lists (ACL)

IPv6 enabled ACLs are possible and should be used whenever it's possible. An example looks like following:

acl internal-net { 
        127.0.0.1; 
        1.2.3.0/24;  
        2001:0db8:100::/56; 
        ::1/128; 
        ::ffff:1.2.3.4/128; 
};
acl ns-internal-net { 
        1.2.3.4;  
        1.2.3.5;  
        2001:0db8:100::4/128; 
        2001:0db8:100::5/128; 
};

This ACLs can be used e.g. for queries of clients and transfer zones to secondary name-servers. This prevents also your caching name-server to be used from outside using IPv6.

options {
        # sure other options here, too
        listen-on-v6 { none; };
        allow-query { internal-net; }; 
        allow-transfer { ns-internal-net; }; 
};

It's also possible to set the allow-query and allow-transfer option for most of single zone definitions, too.

22.1.3. Sending queries with dedicated IPv6 address

This option is not required, but perhaps needed:

query-source-v6 address <ipv6address|*> port <port|*>;

22.1.4. Per zone defined dedicated IPv6 addresses

It's also possible to define per zone some IPv6 addresses.

transfer-source-v6 <ipv6addr|*> [port port];

notify-source-v6 <ipv6addr|*> [port port];

22.1.5. IPv6 DNS zone files examples

Some information can be also found at IPv6 DNS Setup Information (article). Perhaps also helpful is the IPv6 Reverse DNS zone builder for BIND 8/9 (webtool).

22.1.6. Serving IPv6 related DNS data

For IPv6 new types and root zones for reverse lookups are defined:

• AAAA and reverse IP6.INT: specified in RFC 1886 / DNS Extensions to support IP version 6, usable since BIND version 4.9.6

• A6, DNAME (DEPRECATED NOW!) and reverse IP6.ARPA: specified in RFC 2874 / DNS Extensions to Support IPv6 Address Aggregation and Renumbering, usable since BIND 9, but see also an information about the current state at Domain Name System Extension (dnsext)

Perhaps filled later more content, for the meantime take a look at given RFCs and

• AAAA and reverse IP6.INT: IPv6 DNS Setup Information

• A6, DNAME (DEPRECATED NOW!) and reverse IP6.ARPA: take a look into chapter 4 and 6 of the BIND 9 Administrator Reference Manual (ARM) distributed with the bind-package or get this here: BIND manual version 9.3

Because IP6.INT is deprecated (but still in use), a DNS server which will support IPv6 information has to serve both reverse zones.

22.1.7. Checking IPv6-enabled connect

To check, whether BIND named is listening on an IPv6 socket and serving data see following examples.

$ host -t aaaa www.6bone.net 2001:0db8:200:f101::1 
Using domain server: 
Name: 2001:0db8:200:f101::1 
Address: 2001:0db8:200:f101::1#53 
Aliases:

Host www.6bone.net. not found: 5(REFUSED)

Jan 3 12:43:32 gate named[12347]: client
¬ 2001:0db8:200:f101:212:34ff:fe12:3456#32770: 
 query denied

$ host -t aaaa www.6bone.net 2001:0db8:200:f101::1 
Using domain server: 
Name: 2001:0db8:200:f101::1 
Address: 2001:0db8:200:f101::1#53 
Aliases:

www.6bone.net. is an alias for 6bone.net. 
6bone.net. has AAAA address 3ffe:b00:c18:1::10