1 files changed, 90 insertions, 0 deletions
diff --git a/bin/plugins/filter-aaaa.rst b/bin/plugins/filter-aaaa.rst
new file mode 100644
index 0000000..8cd7556
--- /dev/null
+++ b/bin/plugins/filter-aaaa.rst
@@ -0,0 +1,90 @@
+.. Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+..
+.. SPDX-License-Identifier: MPL-2.0
+..
+.. This Source Code Form is subject to the terms of the Mozilla Public
+.. License, v. 2.0.  If a copy of the MPL was not distributed with this
+.. file, you can obtain one at https://mozilla.org/MPL/2.0/.
+..
+.. See the COPYRIGHT file distributed with this work for additional
+.. information regarding copyright ownership.
+
+.. highlight: console
+
+.. iscman:: filter-aaaa
+.. _man_filter-aaaa:
+
+filter-aaaa.so - filter AAAA in DNS responses when A is present
+---------------------------------------------------------------
+
+Synopsis
+~~~~~~~~
+
+:program:`plugin query` "filter-aaaa.so" [{ parameters }];
+
+Description
+~~~~~~~~~~~
+
+:program:`filter-aaaa.so` is a query plugin module for :iscman:`named`, enabling
+:iscman:`named` to omit some IPv6 addresses when responding to clients.
+
+Until BIND 9.12, this feature was implemented natively in :iscman:`named` and
+enabled with the ``filter-aaaa`` ACL and the ``filter-aaaa-on-v4`` and
+``filter-aaaa-on-v6`` options. These options are now deprecated in
+:iscman:`named.conf` but can be passed as parameters to the
+``filter-aaaa.so`` plugin, for example:
+
+::
+
+   plugin query "filter-aaaa.so" {
+           filter-aaaa-on-v4 yes;
+           filter-aaaa-on-v6 yes;
+           filter-aaaa { 192.0.2.1; 2001:db8:2::1; };
+   };
+
+This module is intended to aid transition from IPv4 to IPv6 by
+withholding IPv6 addresses from DNS clients which are not connected to
+the IPv6 Internet, when the name being looked up has an IPv4 address
+available. Use of this module is not recommended unless absolutely
+necessary.
+
+Note: This mechanism can erroneously cause other servers not to give
+AAAA records to their clients. If a recursing server with both IPv6 and
+IPv4 network connections queries an authoritative server using this
+mechanism via IPv4, it is denied AAAA records even if its client is
+using IPv6.
+
+Options
+~~~~~~~
+
+``filter-aaaa``
+   This option specifies a list of client addresses for which AAAA filtering is to
+   be applied. The default is ``any``.
+
+``filter-aaaa-on-v4``
+   If set to ``yes``, this option indicates that the DNS client is at an IPv4 address, in
+   ``filter-aaaa``. If the response does not include DNSSEC
+   signatures, then all AAAA records are deleted from the response. This
+   filtering applies to all responses, not only authoritative
+   ones.
+
+   If set to ``break-dnssec``, then AAAA records are deleted even when
+   DNSSEC is enabled. As suggested by the name, this causes the response
+   to fail to verify, because the DNSSEC protocol is designed to detect
+   deletions.
+
+   This mechanism can erroneously cause other servers not to give AAAA
+   records to their clients. If a recursing server with both IPv6 and IPv4
+   network connections queries an authoritative server using this
+   mechanism via IPv4, it is denied AAAA records even if its client is
+   using IPv6.
+
+``filter-aaaa-on-v6``
+   This option is identical to ``filter-aaaa-on-v4``, except that it filters AAAA responses
+   to queries from IPv6 clients instead of IPv4 clients. To filter all
+   responses, set both options to ``yes``.
+
+See Also
+~~~~~~~~
+
+BIND 9 Administrator Reference Manual.