Configure DNS64

This document describes how to configure and use DNS64 server policies with Virtual Private Cloud (VPC) networks.

Before you begin

  • DNS64 server policies don't apply to dual-stack virtual machine (VM) instances, IPv4-only VM instances, serverless workloads, or requests sent to endpoints created by an inbound DNS server policy.
  • Make sure that you have the required permissions to create a DNS64 server policy.

Create a DNS64 server policy

Create a DNS64 server policy to enable communication between IPv6-only workloads and IPv4-only destinations.

After you create a DNS64 server policy, the following occurs when an IPv6 (AAAA) record is queried:

  • If an AAAA DNS record exists, the DNS server returns an IPv6 address. Your workload connects by using that IPv6 address.
  • If no AAAA DNS record exists, Cloud DNS looks for A records. Cloud DNS then creates IPv6 addresses for the IPv4 addresses in the A record, by using the 64:ff9b::/96 IPv6 prefix.

To create a DNS64 server policy, follow these steps.

gcloud

To create a DNS64 server policy, run the gcloud dns policies create command:

 gcloud dns policies create NAME \ --description=DESCRIPTION \ --networks=VPC_NETWORK_LIST \ --enable-dns64-all-queries

Replace the following:

  • NAME: a name for the policy
  • DESCRIPTION: a description for the policy
  • VPC_NETWORK_LIST: a comma-delimited list of VPC networks that the DNS server policy binds to

Terraform 

 resource "google_dns_policy" "default" { name = "NAME" dns64_config { scope { all_queries = true } } alternative_name_server_config { target_name_servers { ipv4_address = "PRIVATE_IP_ADDRESS" forwarding_path = "private" } target_name_servers { ipv4_address = "PUBLIC_IP_ADDRESS" } } networks { network_url = google_compute_network.default.id } } resource "google_compute_network" "default" { name = "network" auto_create_subnetworks = false }

Replace the following:

  • NAME: a name for the outbound DNS64 policy
  • PRIVATE_IP_ADDRESS: the IP address of an alternative name server using a private forwarding path
  • PUBLIC_IP_ADDRESS: the IP address of a different alternative name server

API

To create a DNS64 server policy, use the policies.create method:

 POST https://dns.googleapis.com/dns/v1/projects/PROJECT_ID/policies { "kind": "dns#policy", "networks": [ { "kind": "dns#policyNetwork", "networkUrl": "NETWORK_URL" } ], "dns64Config": { "scope": { allQueries: true, } } }

Replace the following:

  • PROJECT_ID: your project ID.
  • NETWORK_URL: the fully qualified URL of the VPC network that your DNS server policy must bind to, formatted as follows: https://www.googleapis.com/compute/v1/projects/PROJECT_ID/global/networks/VPC_NETWORK_NAME. Specify the network that contains the IPv6-only subnets and instances.

Verify if a DNS64 server policy is enabled

gcloud

To list all DNS server policies in your project, run the dns policies list command:

 gcloud dns policies list

To get detailed information about a specific DNS64 server policy, run the gcloud dns policies describe command:

 gcloud dns policies describe NAME

Replace NAME with the name of the DNS64 server policy about which you want detailed information.

Disable a DNS64 server policy

gcloud

To disable a DNS64 server policy, run the dns policies update command:

 gcloud dns policies update NAME \ --no-enable-dns64-all-queries

Replace NAME with the name of the DNS64 server policy that you want to disable.

What's next