I'm in Ireland, and my current ISP doesn't provide native IPv6 access -- even if I wanted their consumer implementation of it (which is apparently DualStack-Lite). So I'm using Hurricane Electric's TunnelBroker, with endpoint in UK, for my home network.
Except I'm not using it on my main network, only on a dedicated SSID, which also has a different IPv4 netblock.
This is because Netflix breaks horribly if I dare to use it on the IPv6-enabled network. The content directory seems to be using IPv6, so I get UK listing, while the content itself tries to play over IPv4 (or at least DRM tries to geolocate me based on IPv4 address).
I'm perfectly happy with using Irish Netflix in Ireland. I'm not that happy with not being able to use Netflix.
I suspect it would be sufficient to block IPv6 DNS lookups. I have a BIND9 server running to which I can switch recursive lookups. (No worries, it's not an open resolver.) So I'd like to use it to block AAAA queries for
netflix.com (and subdomains).
On a BIND9 server, how do I block AAAA lookups for a particular zone?