Keep DNS and reachability in scope

Keep external DNS and reverse queries contained, while distinguishing MUST NOT from SHOULD filtering.

• With a single DNS infrastructure, providers MUST NOT include Shared Address Space in zone files (§4). With split DNS, providers MUST NOT include it in external-facing zone files. The single-DNS rule is broader than merely hiding an address in one public response.
• These default DNS containment rules are read with §6’s except-where-required hosted-CGN or similar business-relationship qualification. The drawings assume no such exception. A split internal view can be kept separate from the external view; this does not authorize leaking shared addresses into the external zone. The drawing distinguishes views, not a recipe for configuring a particular DNS server or a guarantee that every internal record is safe.
• Reverse DNS queries for shared addresses MUST NOT be forwarded to global DNS infrastructure. DNS Providers SHOULD filter these requests on recursive nameservers (§§4,6). The forwarding prohibition is MUST NOT; the recursive-filter recommendation remains SHOULD.
• A reverse lookup for100.64.1.2 uses2.1.64.100.in-addr.arpa. Reversing labels is a chosen worked example of the query to contain; the RFC’s rule applies to all addresses in the shared /10, not only this spelling.
• §5.1 explains why an application that discovers the CPE outside shared address should not treat it as a direct global endpoint. Conversely, a non-special-use address is not a reachability guarantee when hidden behind CGN or absent from global routing. Classifying an address does not create an incoming NAT mapping.
• §5.2 describes application and6to4 impacts discussed in2012, not current measurements or a promise that every named application fails. This guide gives no new6to4 setup advice. The IESG note retains the commitment to IPv6; Shared Address Space neither fixes all CGN limitations nor supplies authentication/encryption.