During the Joint Techs meeting at Fermilab Ron Broersma of Defense Research and Engineering Network (DREN) included a scorecard in his presentation that tried to quantify how well major organisations were embracing IPv6. I thought that this was such a fine idea that I’ve decided to replicate it here.

While some ISPs might argue that their networks support IPv6 (and that they use it every day) because they have an IPv6 prefix that is announced to the world I tend to believe in “eating ones own dog food” and so it’s more important to be seen to be using it in some meaningful way rather than potentially have a single host generate a suitable BGP announcement. Therefore like Ron I have identified some services and use them as an indicator of usage.

• Web server accessible via IPv6;
• Email deliverable via IPv6;
• DNS name servers accessible via IPv6;
• An NTP service accessible via IPv6;
• A Jabber service accessible via IPv6; and
• Email client access via IMAP or POP3

Partial points are awarded if you have an accessible “www.ipv6.$domain” site. I also now look for “ipv6.$domain” and a variety of other alternatives that might show that an organisation is trying although I think a “normal” user wouldn’t attempt to use them.

Similarly partial points are also awarded if a secondary MX supports IPv6 but the primary does not. In reality an IPv6 only host can communicate with the domain if the secondary is accessible via IPv6 and the secondary can then use some other method to reach the primary to deliver the email. Partial in this case is just used to indicate this difference.

Partial points are also awarded if some but not all DNS name servers have IPv6 addresses. I attempt to check if it is the organisation who has the IPv6 accessible DNS servers or if it’s just a secondary (this falls down if the organisation uses a different domain for it’s services). The first two numbers in the cell are the organisation’s DNS servers (using their domain name) with IPv6 access and the total organisational DNS servers and and the second two numbers relate to DNS servers irrespective of who is providing the server.

For a NTP service I look for a SRV DNS record. I'm not sure if many organisations use this method (or if it's recognised) but it is a way to try to find where a NTP service might be hidden. If the SRV record doesn't exist then I attempt a few well known labels, ntp, clock, time, chime. If I find a AAAA record I attempt to perform a “ntpdate” to it. If the stratum looks OK then you get a green cell.

For a Jabber service (xmpp-client), this is tested by looking for an appropriate SRV DNS resource record. If there isn’t a record then the cell will be empty (status unknown). If there is only IPv4 addresses listed then the cell is red (fail). If it’s inaccessible, possibly caused by a firewall, that results in an orange (partial) cell and finally if the service is accessible via IPv6 then success is claimed and the cell is green.

Finally the Access and Submit categories relate to access for email clients. While it is likely that organisations don't expose these services even if there are SRV entries in the DNS I look up the appropriate SRV records. For access I check for imaps, imap, pop3s and pop3 and sort them as a client would, while for submit I look for submission. The assumption is that a similar service should be accessible via both IPv4 and IPv6 and so "FAIL" is based on a IPv4 based service being accessible but there not being a similar service accessible via IPv6 while "PROBLEM" is normally indicative of a service not being accessible via IPv4 but a service being exposed by IPv6.

Orange "PROBLEM" cells indicate some sort of problem, possibly network connectivity. If you click through the domain name you will reach a "diagnostics" page that might provide some useful information.

If it is detected that the site has out sourced the service to another provider then some "special" codes may appear if the test fails. These codes, which take the form "FAIL (x)", indicate the out source provider. In these cases the code "x" stands for the following:

• C - CS186
• M - MESSAGELABS
• MA - MCAFEE
• MQ - MACQUARIE
• MS - MICROSOFT
• N - NSATC
• P - POSTINI
• PP - PROOFPOINT
• RC - REDCONDOR
• W - WEBSENSE

The service could also be out sourced to Akamai or Google but as both of these companies are providing an IPv6 variant of the service SUCCESS or FAIL will be indicated with the usual colour scheme but with their name replacing the words "SUCCESS" or "FAIL".

An experimental test for DNSSEC support has been added. While this is not testing IPv6 per se it is interesting to compare IPv6 deployment versus DNSSEC deployment. At present a RRSIG on the SOA indicates that DNSSEC is being attempted and a correctly signed SOA and DNSKEY plus a full chain of trust via DS records to the root implies SUCCESS. Other configurations may be tagged as FAIL or PROBLEM.

As I'm trying to secure my email service I decided to also look at SPF and DMARC usage. Like DNSSEC this isn't an IPv6 specific service but it's interesting to me so I have tacked it onto the Mail reports. It should show the type of SPF policy if there is one and the type of DMARC policy, again if there is one (I don't check if there is a subdomain policy). I possibly should give bonus points if the domain is also secured by DNSSEC but you can look at the table and figure it out. DKIM is the other service of interest but that's hard to check passively as you need to know the selector.

The list should update daily and suggestions for additions are welcome.

There is also a CGI script to test a domain that is not already in the list at https://www.mrp.net/cgi-bin/ipv6-status.cgi