Google 公用 DNS64
透過集合功能整理內容
你可以依據偏好儲存及分類內容。
引言
同時，包含 IPv6 和 IPv4 連線的雙重堆疊網路現已十分常見，但與通用連線卻很遠。如要轉換至 IPv6 並部署僅限 IPv6 的網路，網路業者仍須保留僅限 IPv4 的網路和服務的存取權。有數種轉換機制可提供 IPv4 對 IP4 的存取存取權，而且許多網路業者是 NAT64 越來越受歡迎的選擇。使用搭配 IPv4-IPv6 翻譯功能的 NAT64 閘道時，IPv6 專屬用戶端可以透過以 IPv6 位址開頭的合成 IPv6 位址連線至僅限 IPv4 的服務，而且前置字串會轉送到 NAT64 閘道。
DNS64 是 DNS 服務，會使用僅限 IPv4 目的地傳回這些合成 IPv6 位址的 AAAA 記錄 (DNS 中只有 A 但 AAAA 記錄)。因此，僅限 IPv6 的用戶端會使用 NAT64 閘道，不需要任何其他設定。Google 公用 DNS64 透過保留的 NAT64 前置字串 64:ff9b::/96，將 DNS64 做為全球服務來提供。
重要事項：事前準備
在設定系統以使用 Google Public DNS64 之前，請考慮下列可能會影響服務使用情形的下列限制：
Google 公用 DNS64 僅適用於透過預留的 NAT64 前置字串 64:ff9b::/96 的網路存取。請勿在無法連上這類網路位址轉譯 (NAT64) 閘道的網路中使用。
Google 公用 DNS64 不提供無法從公開網際網路解析的私人網域存取權，但可以傳回公開 DNS 回應中傳回的私人 (RFC 1918) IPv4 位址的 AAAA 記錄。
雙重堆疊網路或主機不需要使用 Google Public DNS64，但其可以正常運作，並傳回合成的 AAAA 和原始 A 記錄 (這可能會導致流量透過僅限 IPv44 的主機傳輸，而非直接透過 IPv4，但通常只有在 NAT64 連線速度快時)。
設定 Google 公用 DNS64
如果您的系統沒有上述 Google 公用 DNS64 限制的問題，可以按照一般的 Google 公用 DNS 入門指南，將標準解析器位址替換為下列內容：
- 2001:4860:4860::6464
- 2001:4860:4860::64
不要設定任何其他 IPv6 位址：這樣做會導致 DNS64 不穩定。如果您同時設定 Google 公用 DNS IPv4 位址 (8.8.8.8 或 8.8.4.4)，雙重堆疊主機有時可能無法取得合成的 AAAA 記錄。
部分裝置對 IPv6 位址的所有 8 個部分使用不同的欄位，且不接受 :: IPv6 縮寫語法。如果是這類欄位，請輸入：
- 2001:4860:4860:0:0:0:0:6464
- 2001:4860:4860:0:0:0:0:64
如果所需的四個十六進位數字為 0，請將 0000 項目和 64 項目展開為 0064。
安全 DNS64
Google 公用 DNS64 支援 DNS 透過 HTTPS (DoH) 和
DNS over TLS (DoT) 使用 DNS 傳輸安全性，dns64.dns.google而不是 dns.google。
此網域會解析為上述的 IPv6 位址，而這些位址的通訊埠 443 和 853 的 DoH 與 DoT 服務則具備 dns64.dns.google 的傳輸層安全標準 (TLS) 憑證。
Google 公用 DNS64 的 RFC 8484 DoH URI 範本是 https://dns64.dns.google/dns-query{?dns}，而 JSON API 也支援 https://dns64.dns.google/Resolve?name=ipv4only.arpa&type=AAAA 等網址，此網址只能透過 IPv6 系統存取。
測試 DNS64 設定
您可以按照入門指南中的測試步驟，驗證 DNS64 設定是否正常運作。如果您無法存取 NAT64 閘道，維基百科會列出數個可以部署的 NAT64 實作。
目前已知部分 NAT64 實作無法與 Google 公用 DNS64 搭配使用：
MacOS X 10.11 以上版本整合了 NAT64/DNS64，但無法傳遞 IPv6，因此無法存取 Google Public DNS64 解析器。
此功能旨在測試只有網路連線的 IPv4 連線裝置時，才會測試已啟用 IPv6 的裝置，且只適用於隨附 DNS64 連線裝置 (僅限與 IPv6 連線的裝置無法直接使用 Google 公用 DNS)，不過您可以將 MacOS X 系統設為使用 8.8.8.8 及 8.8.4.4)。
Cisco ASA 9.0 以上版本整合了 NAT64，但不支援已知的前置字串 64:ff9b::/96，並需要您自行選取前置字串。伺服器不會導入 DNS64，但會提供通過 NAT64 閘道的 DNS 流量檢查與網路位址轉譯 (NAT) 重寫。
Cisco ASA 後方的 IPv6 裝置僅能透過 Google 公用 DNS 設定 IPv4 連線，並採用以下解析器位址：
這會透過 Cisco ASA NAT64 將查詢轉送至 Google 公用 DNS。使用一些額外的 Cisco ASA 設定時，AAAA 查詢會轉譯為 A 查詢，而 A 回應則會透過已設定的前置字串翻譯回 AAAA。
使用 NAT64 位址和 Google 公用 DNS IPv6 解析器位址 (2001:4860:4860::8888 或 2001:4860:4860::8844) 不會生效，因為其中一個結果的負數回應不會被重新查詢。所有查詢都必須選擇 IPv6 或 IPv4 DNS 解析。
除非另有註明，否則本頁面中的內容是採用創用 CC 姓名標示 4.0 授權，程式碼範例則為阿帕契 2.0 授權。詳情請參閱《Google Developers 網站政策》。Java 是 Oracle 和/或其關聯企業的註冊商標。
上次更新時間：2022-09-27 (世界標準時間)。
[null,null,["上次更新時間：2022-09-27 (世界標準時間)。"],[[["\u003cp\u003eGoogle Public DNS64 enables IPv6-only clients to access IPv4-only services via a NAT64 gateway using the reserved prefix \u003ccode\u003e64:ff9b::/96\u003c/code\u003e.\u003c/p\u003e\n"],["\u003cp\u003eUse the Google Public DNS64 resolver addresses: \u003ccode\u003e2001:4860:4860::6464\u003c/code\u003e and \u003ccode\u003e2001:4860:4860::64\u003c/code\u003e for IPv6-only client configurations.\u003c/p\u003e\n"],["\u003cp\u003eGoogle Public DNS64 supports secure DNS transports like DNS over HTTPS (DoH) and DNS over TLS (DoT) using the \u003ccode\u003edns64.dns.google\u003c/code\u003e domain.\u003c/p\u003e\n"],["\u003cp\u003eEnsure your network has access to a NAT64 gateway using the \u003ccode\u003e64:ff9b::/96\u003c/code\u003e prefix before using Google Public DNS64, as it's a requirement.\u003c/p\u003e\n"],["\u003cp\u003eCertain NAT64 implementations like MacOS X's built-in version and Cisco ASA may require specific configurations or are incompatible with Google Public DNS64.\u003c/p\u003e\n"]]],["Network operators can deploy IPv6-only networks while maintaining IPv4 access using NAT64 gateways and DNS64 services. Google Public DNS64 provides synthetic IPv6 addresses for IPv4-only destinations, enabling IPv6 clients to connect without extra configuration. To use it, configure systems with specific IPv6 addresses (2001:4860:4860::6464, 2001:4860:4860::64). Secure DNS options like DoH and DoT are available. Testing verifies proper configuration, but some NAT64 implementations are incompatible.\n"],null,["# Google Public DNS64\n\nIntroduction\n------------\n\nDual-stack networks with both IPv6 and IPv4 connectivity are now common,\nbut they are still far from universal.\nTo take the next step of the transition to IPv6 and deploy IPv6-only networks,\nnetwork operators must still preserve access to IPv4-only networks and services.\nThere are several [transition mechanisms](https://en.wikipedia.org/wiki/IPv6_transition_mechanism) to provide [IPv6 access to IPv4](https://tools.ietf.org/html/rfc6144#section-2.1);\nan increasingly popular choice with many network operators is [NAT64](https://tools.ietf.org/html/rfc6146).\nUsing a NAT64 gateway with IPv4-IPv6 [translation capability](https://tools.ietf.org/html/rfc6145) lets\nIPv6-only clients connect to IPv4-only services via synthetic IPv6 addresses\nstarting with a prefix that routes them to the NAT64 gateway.\n\n[DNS64](https://tools.ietf.org/html/rfc6147) is a DNS service that returns AAAA records with these synthetic IPv6\naddresses for IPv4-only destinations (with A but not AAAA records in the DNS).\nThis lets IPv6-only clients use NAT64 gateways without any other configuration.\n**Google Public DNS64** provides DNS64 as a global service using the reserved\nNAT64 prefix [64:ff9b::/96](https://tools.ietf.org/html/rfc6052#section-2.1).\n\nImportant: Before you start\n---------------------------\n\nBefore configuring your systems to use Google Public DNS64,\nconsider the following limitations that may affect your use of the service:\n\n- Google Public DNS64 is intended for use only on networks with access to\n a NAT64 gateway using the reserved NAT64 prefix `64:ff9b::/96`.\n *Do not use it on networks that cannot reach such a NAT64 gateway*.\n\n- Google Public DNS64 does not provide access to private domains that cannot be\n resolved from the public Internet,\n although it *can* return AAAA records for private (RFC 1918) IPv4 addresses\n returned in public DNS responses.\n\n- Google Public DNS64 is not needed for dual-stack networks or hosts,\n but it does work, returning both synthesized AAAA and original A records\n (this can result in traffic to IPv4-only hosts going through NAT64 rather than\n directly via IPv4, but generally only when the NAT64 connection is faster).\n\nConfiguring Google Public DNS64\n-------------------------------\n\nIf your systems have no problems with the above Google Public DNS64 limitations,\nyou can follow the usual Google Public DNS [getting started](/speed/public-dns/docs/using) instructions,\nreplacing the standard resolver addresses with the following:\n\n- 2001:4860:4860::6464\n- 2001:4860:4860::64\n\n*Do not configure any other IPv6 addresses*: doing so makes DNS64 unreliable.\nIf you also configure Google Public DNS IPv4 addresses (8.8.8.8 or 8.8.4.4),\ndual-stack hosts may not get synthesized AAAA records sometimes.\n\nSome devices use separate fields for all eight parts of IPv6 addresses and\ncannot accept the `::` IPv6 abbreviation syntax. For such fields enter:\n\n- 2001:4860:4860:0:0:0:0:6464\n- 2001:4860:4860:0:0:0:0:64\n\nExpand the `0` entries to `0000`\nand the `64` entry to `0064`\nif four hex digits are required.\n\n### Secure DNS64\n\nGoogle Public DNS64 supports [DNS over HTTPS (DoH)](/speed/public-dns/docs/doh) and\n[DNS over TLS (DoT)](/speed/public-dns/docs/dns-over-tls) secure DNS transports using the\n`dns64.dns.google` domain instead of `dns.google`.\nThis domain resolves to the IPv6 addresses listed above, and the DoH and DoT\nservices at ports 443 and 853 for those addresses have TLS certificates for\n`dns64.dns.google`.\n\nThe RFC 8484 DoH URI template for Google Public DNS64 is\n`https://dns64.dns.google/dns-query{?dns}` and the JSON API is also supported\nwith URLs like [https://dns64.dns.google/resolve?name=ipv4only.arpa\\&type=AAAA](https://dns64.dns.google/resolve?name=ipv4only.arpa&type=AAAA)\n(only accessible from IPv6-capable systems).\n\nTest your DNS64 settings\n------------------------\n\nYou can follow the [test steps](/speed/public-dns/docs/using#testing) in the getting started guide to verify that\nyour DNS64 configuration is working.\nIf you don't have access to a NAT64 gateway,\nWikipedia lists several [NAT64 implementations](https://en.wikipedia.org/wiki/NAT64#Implementations) you can deploy yourself.\n\nSome NAT64 implementations are known not to work with Google Public DNS64:\n\n- MacOS X 10.11 and later incorporates NAT64/DNS64 but cannot pass IPv6,\n preventing access to the Google Public DNS64 resolvers.\n It is intended for testing IPv6-only devices when you only have IPv4\n connectivity to the Internet, and only works with the included DNS64\n (IPv6-only devices connected to it cannot use Google Public DNS directly,\n although you can configure the MacOS X system to use 8.8.8.8 and 8.8.4.4).\n\n- Cisco ASA 9.0 and later incorporates NAT64 but does not support the\n well-known prefix `64:ff9b::/96` and requires you to select your own prefix.\n It does not implement DNS64 but provides inspection and NAT rewriting of\n DNS traffic passing through the NAT64 gateway.\n\n IPv6-only devices behind a Cisco ASA can get IPv4 connectivity using\n Google Public DNS by configuring the following resolver addresses:\n - *NAT64-prefix* `::0808:0808` (*8.8.8.8 via Cisco ASA NAT64*)\n\n - *NAT64-prefix* `::0808:0404` (*8.8.4.4 via Cisco ASA NAT64*)\n\n This routes queries to Google Public DNS through the Cisco ASA NAT64.\n With some additional [Cisco ASA configuration](http://geenetworks.tumblr.com/post/35363923666),\n AAAA queries are translated into A queries,\n and A responses are translated back into AAAA with the configured prefix.\n\n Using both NAT64 addresses and Google Public DNS IPv6 resolver addresses\n (2001:4860:4860::8888 or 2001:4860:4860::8844) does not work,\n as negative responses from either one will not be re-queried with the other.\n You must choose either IPv6 or IPv4 DNS resolution for all queries."]]
