Blocking AAAA responses for certain domains

Question

I'm in Ireland, and my current ISP doesn't provide native IPv6 access -- even if I wanted their consumer implementation of it (which is apparently DualStack-Lite). So I'm using Hurricane Electric's TunnelBroker, with endpoint in UK, for my home network.

Except I'm not using it on my main network, only on a dedicated SSID, which also has a different IPv4 netblock.

This is because Netflix breaks horribly if I dare to use it on the IPv6-enabled network. The content directory seems to be using IPv6, so I get UK listing, while the content itself tries to play over IPv4 (or at least DRM tries to geolocate me based on IPv4 address).

I'm perfectly happy with using Irish Netflix in Ireland. I'm not that happy with not being able to use Netflix.

I suspect it would be sufficient to block IPv6 DNS lookups. I have a BIND9 server running to which I can switch recursive lookups. (No worries, it's not an open resolver.) So I'd like to use it to block AAAA queries for netflix.com (and subdomains).

On a BIND9 server, how do I block AAAA lookups for a particular zone?

Answer 1

I don't know if BIND is able to block AAAA zone, but I propose to you other solution:

One time ago I was using ipv6 and Wikipedia Servers doesn't work fine with ipv6. I resolved it establishing a manual route to wikipedia range with unreachable config

ip route add unreachable n.et.fli.x/YY

Then, Firefox automatically change to ipv4 connection Try it please and feedback us!

PD: Actually wikipedia is working fine with ipv6

Answer 2

On my "normal" DNS server I have added forward zones for the Netflix domains:

zone "netflix.com" {
    type forward;
    forward only;
    forwarders { 127.0.0.1 port 55353; };
};

(Repeated for nflximg.com and nflxext.com copying the Python filter script which is available)

I then run a second instance of bind on 127.0.0.1:55353 which has a caching-only configuration but has filter-aaaa-on-v4 yes; so AAAA records are stripped.