ECS/EDNS0 Client Subnet and IPv6

Help Community Help
1

I tried to configure ECS data for my queries sent by Pi-Hole via Unbound.

I followed this thread:
Support for add-subnet option from dnsmasq (ECS/EDNS0 Client Subnet)
and the dnsmasq man page.

So I added both IPv4 and IPv6 subnet of my ISP, for example:
add-subnet= 212.144.0.0/16,2a00::/27
to the dnsmasq config of my Pi-Hole.

This works fine for IPv4. When querying
dig TXT whoami.ipv4.akahelp.net
I get "ip", "ns" and "ecs" values in return as configured.

But when I do the same with Ipv6
dig TXT whoami.ipv6.akahelp.net
or
dig TXT whoami.ds.akahelp.net
I get only "ns" as the answer, without any "ecs" info.

The man page for dnsmasq confuses my regarding the correct configuration for dnsmasq. It writes:
Quote: "For example, ... --add-subnet=1.2.3.4/24,1.2.3.4/24 will add 1.2.3.0/24 for both IPv4 and IPv6 requestors."
Am I wrong adding an IPv6 subnet to "add-subnet", instead of an IPv4 address as shown in the man page example? But why should I add an IPv4 subnet for IPv6?

What did I wrong here?

2

For IPv6 to succeed, you want to make sure that the DNS request is transported via IPv6.

You may force dig to use IPv6 as transport protocol, e.g.

dig  -6 TXT whoami.ipv6.akahelp.net

However, that would only control the transport path to the system's DNS resolver, and that resolver may decide to forward the request via IPv4 or IPv6.

You could opt to send that dig to an IPv6 address of a public DNS resolver, e.g.

dig -6 TXT whoami.ipv6.akahelp.net @2001:4860:4860::8888

But depending on your intentions, that may not be what you want to test.

What's your goal for adding those dnsmasq add-subnet options?
And what do you intend to verify by those *dig*s?

3

Thanks a lot. I want to learn about if sending over the ECS data makes any difference when using sites that use any content delivery network and therefore maybe use a more nearby server than with just the IP. With dig I try to find out if the server receive the ECS data.

4

You wouldn't need to add any options at all to Pi-hole in that case.

A public DNS server would already be able to use your IP address information from the DNS requests that your Pi-hole is sending.

5

This topic was automatically closed 21 days after the last reply. New replies are no longer allowed.