I deployed a ipv6-only network to experiment with and found nat64+dns64 to work with very little trouble. I didn't know about pref64 at the time, but as I understand, without cooperating clients, it would not solve the DNSEC problem.
The pull request helps advertise the NAT64 prefix via router advertisements (while DNS64 uses, well, DNS to advertise it).
The DNSSEC problem is known and has a solution: any stub resolver performing DNSSEC validation should also perform the DNS64 synthesis, should the network be running DNS64/NAT64. The support of DNS64 in stub resolvers is almost nonexistent though (as is the existence of DNSSEC-validating stub resolvers).
2 comments
[ 5.6 ms ] story [ 18.6 ms ] threadThe pull request helps advertise the NAT64 prefix via router advertisements (while DNS64 uses, well, DNS to advertise it).
The DNSSEC problem is known and has a solution: any stub resolver performing DNSSEC validation should also perform the DNS64 synthesis, should the network be running DNS64/NAT64. The support of DNS64 in stub resolvers is almost nonexistent though (as is the existence of DNSSEC-validating stub resolvers).