Unbound AAAA filtering

If you have ever tried to announce an IPv6 prefix into a network without access to the global unicast subnet you will notice many things break as applications assume otherwise. For me this is a problem when announcing a Yggdrasil prefix (200::/7).

Advertising a Yggdrasil prefix

The solution that I've found is to prevent applications from resolving IPv6 addresses by filtering global unicast AAAA records using Unbound.

unbound.conf

server:
  module-config: "respip validator iterator"
  …

rpz:
  name: .
  zonefile: …/ipv6-filter.rpz

ipv6-filter.rpz

$ORIGIN .
3.zz.2000.rpz-ip CNAME *.