Google 公共 DNS64
使用集合让一切井井有条
根据您的偏好保存内容并对其进行分类。
简介
现在，同时具有 IPv6 和 IPv4 连接的双栈网络很常见，但它们远远没有实现通用。为过渡到 IPv6 并部署仅使用 IPv6 的网络，网络运营商仍必须保留对仅使用 IPv4 的网络和服务的访问权限。有多种转换机制可以提供 IPv6 对 IPv4 的访问权限；NAT64 是许多网络运营商越来越受欢迎的选择。使用具有 IPv4-IPv6 翻译功能的 NAT64 网关，仅使用 IPv6 的客户端可以通过合成 IPv6 地址连接到仅使用 IPv4 的服务，这些地址的前缀是将其路由到 NAT64 网关的前缀。
DNS64 是一种 DNS 服务，可针对仅使用 IPv4 的目的地返回使用这些合成 IPv6 地址的 AAAA 记录（DNS 中包含 A 而非 AAAA 记录）。这样，纯 IPv6 客户端就可以使用 NAT64 网关，而无需进行任何其他配置。Google 公共 DNS64 使用预留的 NAT64 前缀 64:ff9b::/96 以全局服务的形式提供 DNS64。
重要提示：准备工作
在将您的系统配置为使用 Google 公共 DNS64 之前，请考虑以下限制，这些限制可能会影响您使用该服务的权限：
Google 公共 DNS64 仅适用于可通过预留的 NAT64 前缀 64:ff9b::/96 访问 NAT64 网关的网络。请勿在无法连接到此类 NAT64 网关的网络上使用它。
Google Public DNS64 不提供对无法通过公共互联网解析的专用网域的访问，尽管它可以针对公共 DNS 响应中返回的专用 (RFC 1918) IPv4 地址返回 AAAA 记录。
双栈网络或主机不需要使用 Google 公共 DNS64，但确实可以，它能返回合成的 AAAA 和原始 A 记录（这可能会导致流量通过 NAT64 而不是 IPv4 直接到达，但通常只有在 NAT64 连接速度更快时）。
配置 Google 公共 DNS64
如果您的系统没有上述 Google 公共 DNS64 限制问题，您可以按照常规的 Google 公共 DNS 使用入门说明进行操作，将标准解析器地址替换为以下代码：
- 2001:4860:4860::6464
- 2001:4860:4860::64
请勿配置任何其他 IPv6 地址：这样做会导致 DNS64 不可靠。如果您还配置了 Google 公共 DNS IPv4 地址（8.8.8.8 或 8.8.4.4），双栈主机有时可能无法获得合成的 AAAA 记录。
某些设备会为 IPv6 地址的所有八个部分使用单独的字段，并且不接受 :: IPv6 缩写语法。对于此类字段，请输入：
- 2001:4860:4860:0:0:0:0:6464
- 2001:4860:4860:0:0:0:0:64
如果需要四个十六进制数字，请将 0 条目扩展为 0000，并将 64 条目展开为 0064。
安全 DNS64
Google 公共 DNS64 支持 DNS over HTTPS (DoH) 和 DNS over TLS (DoT) 安全 DNS 传输，只需使用 dns64.dns.google 网域而不是 dns.google 网域即可。此网域解析为上面列出的 IPv6 地址，这些地址的端口 443 和 853 的 DoH 和 DoT 服务具有 dns64.dns.google 的 TLS 证书。
Google Public DNS64 的 RFC 8484 DoH URI 模板为 https://dns64.dns.google/dns-query{?dns}，JSON API 也受 https://dns64.dns.google/parse?name=ipv4only.arpa&type=AAAA 等网址支持（只能通过支持 IPv6 的系统访问）。
测试您的 DNS64 设置
您可以按照入门指南中的测试步骤来验证您的 DNS64 配置是否正常工作。如果您无法访问 NAT64 网关，Wikipedia 会列出您可以自行部署的多个 NAT64 实现。
已知某些 NAT64 实现不支持 Google 公共 DNS64：
MacOS X 10.11 及更高版本合并了 NAT64/DNS64，但无法传递 IPv6，从而阻止了对 Google 公共 DNS64 解析器的访问。它用于在只有 IPv4 互联网连接的情况下测试仅支持 IPv6 的设备，并且仅适用于随附的 DNS64 设备（连接到 IPv6 的纯 IPv6 设备无法直接使用 Google 公共 DNS），不过您可以将 MacOS X 系统配置为使用 8.8.8.8 和 8.8.4.4。
Cisco ASA 9.0 及更高版本合并了 NAT64，但不支持众所周知的前缀 64:ff9b::/96，并且要求您选择自己的前缀。它不会实现 DNS64，但提供检查和重写通过 NAT64 网关传递的 DNS 流量。
Cisco ASA 后仅支持 IPv6 的设备可以使用 Google 公共 DNS 获取 IPv4 连接，方法是配置以下解析器地址：
这会通过 Cisco ASA NAT64 将查询路由到 Google 公共 DNS。
使用一些其他的 Cisco ASA 配置时，AAAA 查询会转换为 A 查询，A 响应会转回带有已配置的前缀的 AAAA。
同时使用 NAT64 地址和 Google 公共 DNS IPv6 解析器地址（2001:4860:4860::8888 或 2001:4860:4860::8844）是不可行的，因为其中任一项的否定响应不会重新查询。您必须为所有查询选择 IPv6 或 IPv4 DNS 解析。
如未另行说明，那么本页面中的内容已根据知识共享署名 4.0 许可获得了许可，并且代码示例已根据 Apache 2.0 许可获得了许可。有关详情，请参阅 Google 开发者网站政策。Java 是 Oracle 和/或其关联公司的注册商标。
最后更新时间 (UTC)：2022-09-27。
[null,null,["最后更新时间 (UTC)：2022-09-27。"],[[["\u003cp\u003eGoogle Public DNS64 enables IPv6-only clients to access IPv4-only services via a NAT64 gateway using the reserved prefix \u003ccode\u003e64:ff9b::/96\u003c/code\u003e.\u003c/p\u003e\n"],["\u003cp\u003eUse the Google Public DNS64 resolver addresses: \u003ccode\u003e2001:4860:4860::6464\u003c/code\u003e and \u003ccode\u003e2001:4860:4860::64\u003c/code\u003e for IPv6-only client configurations.\u003c/p\u003e\n"],["\u003cp\u003eGoogle Public DNS64 supports secure DNS transports like DNS over HTTPS (DoH) and DNS over TLS (DoT) using the \u003ccode\u003edns64.dns.google\u003c/code\u003e domain.\u003c/p\u003e\n"],["\u003cp\u003eEnsure your network has access to a NAT64 gateway using the \u003ccode\u003e64:ff9b::/96\u003c/code\u003e prefix before using Google Public DNS64, as it's a requirement.\u003c/p\u003e\n"],["\u003cp\u003eCertain NAT64 implementations like MacOS X's built-in version and Cisco ASA may require specific configurations or are incompatible with Google Public DNS64.\u003c/p\u003e\n"]]],["Network operators can deploy IPv6-only networks while maintaining IPv4 access using NAT64 gateways and DNS64 services. Google Public DNS64 provides synthetic IPv6 addresses for IPv4-only destinations, enabling IPv6 clients to connect without extra configuration. To use it, configure systems with specific IPv6 addresses (2001:4860:4860::6464, 2001:4860:4860::64). Secure DNS options like DoH and DoT are available. Testing verifies proper configuration, but some NAT64 implementations are incompatible.\n"],null,["# Google Public DNS64\n\nIntroduction\n------------\n\nDual-stack networks with both IPv6 and IPv4 connectivity are now common,\nbut they are still far from universal.\nTo take the next step of the transition to IPv6 and deploy IPv6-only networks,\nnetwork operators must still preserve access to IPv4-only networks and services.\nThere are several [transition mechanisms](https://en.wikipedia.org/wiki/IPv6_transition_mechanism) to provide [IPv6 access to IPv4](https://tools.ietf.org/html/rfc6144#section-2.1);\nan increasingly popular choice with many network operators is [NAT64](https://tools.ietf.org/html/rfc6146).\nUsing a NAT64 gateway with IPv4-IPv6 [translation capability](https://tools.ietf.org/html/rfc6145) lets\nIPv6-only clients connect to IPv4-only services via synthetic IPv6 addresses\nstarting with a prefix that routes them to the NAT64 gateway.\n\n[DNS64](https://tools.ietf.org/html/rfc6147) is a DNS service that returns AAAA records with these synthetic IPv6\naddresses for IPv4-only destinations (with A but not AAAA records in the DNS).\nThis lets IPv6-only clients use NAT64 gateways without any other configuration.\n**Google Public DNS64** provides DNS64 as a global service using the reserved\nNAT64 prefix [64:ff9b::/96](https://tools.ietf.org/html/rfc6052#section-2.1).\n\nImportant: Before you start\n---------------------------\n\nBefore configuring your systems to use Google Public DNS64,\nconsider the following limitations that may affect your use of the service:\n\n- Google Public DNS64 is intended for use only on networks with access to\n a NAT64 gateway using the reserved NAT64 prefix `64:ff9b::/96`.\n *Do not use it on networks that cannot reach such a NAT64 gateway*.\n\n- Google Public DNS64 does not provide access to private domains that cannot be\n resolved from the public Internet,\n although it *can* return AAAA records for private (RFC 1918) IPv4 addresses\n returned in public DNS responses.\n\n- Google Public DNS64 is not needed for dual-stack networks or hosts,\n but it does work, returning both synthesized AAAA and original A records\n (this can result in traffic to IPv4-only hosts going through NAT64 rather than\n directly via IPv4, but generally only when the NAT64 connection is faster).\n\nConfiguring Google Public DNS64\n-------------------------------\n\nIf your systems have no problems with the above Google Public DNS64 limitations,\nyou can follow the usual Google Public DNS [getting started](/speed/public-dns/docs/using) instructions,\nreplacing the standard resolver addresses with the following:\n\n- 2001:4860:4860::6464\n- 2001:4860:4860::64\n\n*Do not configure any other IPv6 addresses*: doing so makes DNS64 unreliable.\nIf you also configure Google Public DNS IPv4 addresses (8.8.8.8 or 8.8.4.4),\ndual-stack hosts may not get synthesized AAAA records sometimes.\n\nSome devices use separate fields for all eight parts of IPv6 addresses and\ncannot accept the `::` IPv6 abbreviation syntax. For such fields enter:\n\n- 2001:4860:4860:0:0:0:0:6464\n- 2001:4860:4860:0:0:0:0:64\n\nExpand the `0` entries to `0000`\nand the `64` entry to `0064`\nif four hex digits are required.\n\n### Secure DNS64\n\nGoogle Public DNS64 supports [DNS over HTTPS (DoH)](/speed/public-dns/docs/doh) and\n[DNS over TLS (DoT)](/speed/public-dns/docs/dns-over-tls) secure DNS transports using the\n`dns64.dns.google` domain instead of `dns.google`.\nThis domain resolves to the IPv6 addresses listed above, and the DoH and DoT\nservices at ports 443 and 853 for those addresses have TLS certificates for\n`dns64.dns.google`.\n\nThe RFC 8484 DoH URI template for Google Public DNS64 is\n`https://dns64.dns.google/dns-query{?dns}` and the JSON API is also supported\nwith URLs like [https://dns64.dns.google/resolve?name=ipv4only.arpa\\&type=AAAA](https://dns64.dns.google/resolve?name=ipv4only.arpa&type=AAAA)\n(only accessible from IPv6-capable systems).\n\nTest your DNS64 settings\n------------------------\n\nYou can follow the [test steps](/speed/public-dns/docs/using#testing) in the getting started guide to verify that\nyour DNS64 configuration is working.\nIf you don't have access to a NAT64 gateway,\nWikipedia lists several [NAT64 implementations](https://en.wikipedia.org/wiki/NAT64#Implementations) you can deploy yourself.\n\nSome NAT64 implementations are known not to work with Google Public DNS64:\n\n- MacOS X 10.11 and later incorporates NAT64/DNS64 but cannot pass IPv6,\n preventing access to the Google Public DNS64 resolvers.\n It is intended for testing IPv6-only devices when you only have IPv4\n connectivity to the Internet, and only works with the included DNS64\n (IPv6-only devices connected to it cannot use Google Public DNS directly,\n although you can configure the MacOS X system to use 8.8.8.8 and 8.8.4.4).\n\n- Cisco ASA 9.0 and later incorporates NAT64 but does not support the\n well-known prefix `64:ff9b::/96` and requires you to select your own prefix.\n It does not implement DNS64 but provides inspection and NAT rewriting of\n DNS traffic passing through the NAT64 gateway.\n\n IPv6-only devices behind a Cisco ASA can get IPv4 connectivity using\n Google Public DNS by configuring the following resolver addresses:\n - *NAT64-prefix* `::0808:0808` (*8.8.8.8 via Cisco ASA NAT64*)\n\n - *NAT64-prefix* `::0808:0404` (*8.8.4.4 via Cisco ASA NAT64*)\n\n This routes queries to Google Public DNS through the Cisco ASA NAT64.\n With some additional [Cisco ASA configuration](http://geenetworks.tumblr.com/post/35363923666),\n AAAA queries are translated into A queries,\n and A responses are translated back into AAAA with the configured prefix.\n\n Using both NAT64 addresses and Google Public DNS IPv6 resolver addresses\n (2001:4860:4860::8888 or 2001:4860:4860::8844) does not work,\n as negative responses from either one will not be re-queried with the other.\n You must choose either IPv6 or IPv4 DNS resolution for all queries."]]
