> for each AAAA lookup, return a new IPv6 address that you'll NAT to the real address (you can use this for NAT64 if you want to let clients connect to IPv4 hos

> for each AAAA lookup, return a new IPv6 address that you'll NAT to the real address (you can use this for NAT64 if you want to let clients connect to IPv4 hosts) We employ exactly this technique for our Android firewall app. It can do IPv4 (by mapping hash(domain) name onto RFC6598 reserved subnet [0]) as number of unique AAAA/A requests on a client seldom exceeds 35k/mo! Another (simpler) control we offer users is, to drop all connections made to IPs that the user-set resolver did not do name resolution for. > (this is going to be a big PITA, but that's how these things go) You don't say. [0] https://github.com/celzero/firestack/blob/2191381f/intra/dnsx/alg.go#L1286-L1299 https://github.com/celzero/firestack/blob/2191381f/intra/dns...