Configure DNS64

This document describes how to configure and use DNS64 server policies with Virtual Private Cloud (VPC) networks.

Before you begin

  • DNS64 server policies don't apply to dual-stack virtual machine (VM) instances, IPv4-only VM instances, serverless workloads, or requests sent to endpoints created by an inbound DNS server policy.
  • Make sure that you have the required permissions to create a DNS64 server policy.

Create a DNS64 server policy

Create a DNS64 server policy to enable communication between IPv6-only workloads and IPv4-only destinations.

After you create a DNS64 server policy, the following occurs when an IPv6 (AAAA) record is queried:

  • If an AAAA DNS record exists, the DNS server returns an IPv6 address. Your workload connects by using that IPv6 address.
  • If no AAAA DNS record exists, Cloud DNS looks for A records. Cloud DNS then creates IPv6 addresses for the IPv4 addresses in the A record, by using the 64:ff9b::/96 IPv6 prefix.

To create a DNS64 server policy, follow these steps.

gcloud

To create a DNS64 server policy, run the gcloud dns policies create command:

gcloud dns policies create NAME \
    --description=DESCRIPTION \
    --networks=VPC_NETWORK_LIST \
    --enable-dns64-all-queries

Replace the following:

  • NAME: a name for the policy
  • DESCRIPTION: a description for the policy
  • VPC_NETWORK_LIST: a comma-delimited list of VPC networks that the DNS server policy binds to

Terraform 

resource "google_dns_policy" "default" {
  name = "NAME"

  dns64_config {
    scope {
      all_queries = true
    }
  }

  alternative_name_server_config {
    target_name_servers {
      ipv4_address    = "PRIVATE_IP_ADDRESS"
      forwarding_path = "private"
    }
    target_name_servers {
      ipv4_address = "PUBLIC_IP_ADDRESS"
    }
  }

  networks {
    network_url = google_compute_network.default.id
  }
}

resource "google_compute_network" "default" {
  name                    = "network"
  auto_create_subnetworks = false
}

Replace the following:

  • NAME: a name for the outbound DNS64 policy
  • PRIVATE_IP_ADDRESS: the IP address of an alternative name server using a private forwarding path
  • PUBLIC_IP_ADDRESS: the IP address of a different alternative name server

API

To create a DNS64 server policy, use the policies.create method:

POST https://dns.googleapis.com/dns/v1/projects/PROJECT_ID/policies
{
  "kind": "dns#policy",
  "networks": [
    {
      "kind": "dns#policyNetwork",
      "networkUrl": "NETWORK_URL"
    }
  ],
  "dns64Config":
    {
        "scope":
        {
          allQueries: true,
        }
    }
  }

Replace the following:

  • PROJECT_ID: your project ID.
  • NETWORK_URL: the fully qualified URL of the VPC network that your DNS server policy must bind to, formatted as follows: https://www.googleapis.com/compute/v1/projects/PROJECT_ID/global/networks/VPC_NETWORK_NAME. Specify the network that contains the IPv6-only subnets and instances.

Verify if a DNS64 server policy is enabled

gcloud

To list all DNS server policies in your project, run the dns policies list command:

gcloud dns policies list

To get detailed information about a specific DNS64 server policy, run the gcloud dns policies describe command:

gcloud dns policies describe NAME

Replace NAME with the name of the DNS64 server policy about which you want detailed information.

Disable a DNS64 server policy

gcloud

To disable a DNS64 server policy, run the dns policies update command:

gcloud dns policies update NAME \
    --no-enable-dns64-all-queries

Replace NAME with the name of the DNS64 server policy that you want to disable.

What's next