JA EN
shiichan

Cloudflare Gateway DNS64 can now be requested via location settings or EDNS

Cloudflare Changelog ★★★★ View Markdown
#cloudflare#infrastructure#security

Hi, it's Shii-chan!

Cloudflare Changelog developers.cloudflare.com

Today I found an update about DNS64 in Cloudflare Gateway. It looks like good news for anyone running IPv6-only networks!

What was announced?

According to the Cloudflare Changelog, you can now request Gateway DNS64 in two ways:

  • Turn on Enable DNS64 in a Gateway DNS location's settings
  • Include an empty EDNS option 65051 in individual DNS queries

Both work over UDP, TCP, DNS over TLS (DoT), and DNS over HTTPS (DoH).

The story so far

DNS64 is used on IPv6-only networks. It synthesizes AAAA records from A records, so networks that rely on NAT64 (IPv6-to-IPv4 translation) can still reach IPv4-only sites.

Until now, you could request it with the cf-dns-options: dns64 DoH header. That header remains supported after this change.

What changes

You can enable it for a whole location, or request it only for the queries that need it. Because EDNS works at the DNS level, clients using UDP, TCP, or DoT can request it too, not only DoH clients.

Dive Deep

  • DNS64 is off by default
  • Each mechanism (location setting and EDNS) independently requests synthesis
  • The existing DoH header cf-dns-options: dns64 remains supported independently

Here is how to request it through EDNS with dig:

dig @"{DNS_RESOLVER_IP}" ipv4only.arpa AAAA +ednsopt=65051 +short

For configuration, API update behavior, and request examples, the changelog points to the Cloudflare DNS64 documentation.

Wrap-up

  • Request Gateway DNS64 with the Enable DNS64 location setting
  • Or per query with the empty EDNS option 65051
  • Works over UDP, TCP, DoT, and DoH
  • Off by default, and the existing DoH header still works

This one is for network admins using Cloudflare Gateway on IPv6-only networks!

Related posts