Keep reverse DNS and access controls explicit
05Domain Name System (DNS) lookups and service authorization are separate from choosing an IPv6 prefix. A local address is neither a private tunnel nor proof that a peer is trusted.
Separate configured policy rejects an unauthorized request before the service accepts it. The visible stop belongs to this explicit policy, not to fd address bits.
Source for this drawing: RFC 4193 · Read RFC section 4.4 ↗
New to this? Start hereA quick picture + helpful background
A message needs an address.
Think of a packet as a small addressed envelope. Devices pass it onward; transport protocols decide what delivery promises an application gets.
Helpful first, if these ideas are unfamiliar
These pictures are analogies to help you learn. The linked RFC explains the actual rules.
Terms in this drawing
Related RFCs and changes
“Updates” changes part of an earlier RFC. “Obsoletes” replaces it. This list shows selected related documents.
Stop reverse-query leakage, and enforce service policy separately.
- Reverse queries ask for a name belonging to an address. Locally assigned ULA reverse queries MUST NOT be sent to global DNS name servers.
- Section4.4 recommends an empty d.f.ip6.arpa reverse zone returning RCODE3 by default, with an override for configured local reverse data. Global AAAA/PTR publication is not recommended.
- ULA use must be deliberately enabled; it is not automatic link-local addressing (§4.6). Section7 says local addresses provide no inherent security: filters and authentication still need configuration.
The local reverse response assumes configured data. The final two states are separate illustrative service-policy examples, not new requirements in RFC4193. Full DNS configuration, address selection and VPN cryptography are outside this guide.
Read the RFC section ↗