1. You create a ULA prefix (fc00:/7) on your local network. See https://en.m.wikipedia.org/wiki/Unique_local_address https://en.m.wikipedia.org/wiki/Unique_loc

1. You create a ULA prefix (fc00:/7) on your local network. See https://en.m.wikipedia.org/wiki/Unique_local_address https://en.m.wikipedia.org/wiki/Unique_local_address 2. Then you have your router advertise that prefix. 3. Then you have your DNS server pick a non-temporary address within that prefix (either manually set it, or let the OS pick one). 4. Then you tell your router to advertise that address as the DNS server in the RA. Depending on how you have your network set up, your DNS server will have probably four IPv6 addresses: A link-local one; one on the ULA prefix you created; a non-temporary address on the prefix delegated by your ISP; and one or more temporary addresses on the prefix delegated by your ISP. Outgoing connections (for recursive resolving) will be on one of the temporary addresses from the PD prefix. The DNS server listens on the static ULA address. You need to configure your firewall such that traffic from the delegated prefix can get to the ULA one, and vice versa. This usually just means blocking traffic from the WAN port to the ULA prefix.