- Welcome to Hurricane Electric's IPv6 Tunnel Broker Forums.
News:
Welcome to Hurricane Electric's Tunnelbroker.net forums!
Recent posts
#1
General Questions & Suggestions / Re: DNSSEC support?
Last post by SoLoR - July 30, 2026, 02:27:27 AMQuote from: jostreff on June 09, 2026, 10:54:13 AMI am experiencing the exact same issue with my slave zones transferred from a PowerDNS master.
The zone transfers (AXFR) complete successfully, and the SOA serial numbers match perfectly across all nsX.he.net nodes. However, any external DNSSEC validation tool (like DNSViz) throws an ECONNREFUSED error specifically when querying the Hurricane Electric Anycast IPs (e.g., 216.66.1.2) for DNSKEY records.
My zones are signed using Algorithm 13 (ECDSA Curve P-256 with SHA-256), which is the current modern standard. It seems that the HE Anycast edge servers either drop/refuse requests for these crypto keys or fail to parse the DNSSEC records properly if the algorithm isn't explicitly supported by the underlying legacy software version running on the nodes.
It's 2026, and it's quite disappointing that we still cannot properly host a modern DNSSEC-signed slave zone on HE's Free DNS platform without down-grading to obsolete algorithms like RSASHA1. Any chance the backend software will be updated to support current PowerDNS/BIND DNSSEC deployments?
Best regards,
Jordan
It only error out for UDP on that specific server, maybe dnsviz ip is blocked or something. Because you can manually test it with dig and it works just fine.
dig @216.66.1.2 yourdomain.com NS
dig @216.66.1.2 yourdomain.com NS +tcp
both will resolve (first one uses default udp query)
#2
General Discussion / t-shirt batch end of 2025
Last post by mvasek - July 26, 2026, 08:31:37 AMHello,
has anybody received their t-shirt that was shipped around end of year 2025?
My shirt has been in shipping state for quite some time.
I asked support but they do not track the shipment.
I suspect that post service in my country lost it.
Thanks.
has anybody received their t-shirt that was shipped around end of year 2025?
My shirt has been in shipping state for quite some time.
I asked support but they do not track the shipment.
I suspect that post service in my country lost it.
Thanks.
#3
Questions & Answers / Need help with SMTP unblock
Last post by mitkait - July 14, 2026, 06:49:35 PMHello,
I have been trying to request the removal of the outbound SMTP (port 25) filtering on my tunnel for over a week, but I haven't received any response.
Account name: mitkait
Tunnel ID: 1032386
Certification level: Sage (attained on 2026-07-08)
I received an automated reply after emailing ipv6@he.net, but there has been no follow-up since then.
Could an administrator please assist me in enabling SMTP functionality for my tunnel?
Thank you!
I have been trying to request the removal of the outbound SMTP (port 25) filtering on my tunnel for over a week, but I haven't received any response.
Account name: mitkait
Tunnel ID: 1032386
Certification level: Sage (attained on 2026-07-08)
I received an automated reply after emailing ipv6@he.net, but there has been no follow-up since then.
Could an administrator please assist me in enabling SMTP functionality for my tunnel?
Thank you!
#4
Questions & Answers / Re: The IP address under AS413...
Last post by agehall - July 02, 2026, 02:11:23 AMI'm getting the same error message when attempting to create a new tunnel. My old tunnel expired and was deleted as I had to have it down for an extended period of time but now I'm ready to re-create a new tunnel.
#5
General Questions & Suggestions / Re: subdomain for my own bind9...
Last post by rakogels - June 26, 2026, 07:55:04 AMThanks Snarked. By removing sub.example.com from he.net it started to work.
sub.example.com is now served by my bind dns server while example.com is served by he.net as required.
I guess I got confused with the assumption that you need to add a subdomain to he.net first and in that subdomain you need to put the details for your own DNS server.
sub.example.com is now served by my bind dns server while example.com is served by he.net as required.
I guess I got confused with the assumption that you need to add a subdomain to he.net first and in that subdomain you need to put the details for your own DNS server.
#6
General Questions & Suggestions / Re: subdomain for my own bind9...
Last post by snarked - June 26, 2026, 01:20:39 AMStep 3 doesn't make sense. Action 3 you took implies that HE's servers are primary for the zone. However, actions 1 & 2 plus your opening statement implies that your private server is primary and HE's servers are secondary. Please restate your question if this is wrong.
One does not add any RRs in HE's web interface for secondary zones; only name server addresses (names get resolved to addresses) and a TSIG key (if used).
If HE asked you to add a TXT record, that goes into the zone file, not the server configuration file.
One does not add any RRs in HE's web interface for secondary zones; only name server addresses (names get resolved to addresses) and a TSIG key (if used).
If HE asked you to add a TXT record, that goes into the zone file, not the server configuration file.
#7
General Questions & Suggestions / subdomain for my own bind9 ser...
Last post by rakogels - June 25, 2026, 01:27:57 AMHi all,
I am having issues setting up DNS for my subdomain, using my own bind9 server.
It seems that the delegation part is not working.
This is what I have done:
1. In parent zone (example.com) I added a NS records for the subdomain delegation:
Name: sub.example.com
Type: NS
Value: ns1.sub.example.com
2. Added glue record in parent zone (example.com):
Name: ns1.sub.example.com
Type: A, Value: MY_SERVER_PUBLIC_IP
3. Added sub.example.com via he.net webportal to my main domain (example.com)
Note that the webportal tells me to add a TXT record with name dnshenet-key and value they provided.
I added this record to my bind config for this subdomain.
Any suggestions why this is not working?
Thanks.
I am having issues setting up DNS for my subdomain, using my own bind9 server.
It seems that the delegation part is not working.
This is what I have done:
1. In parent zone (example.com) I added a NS records for the subdomain delegation:
Name: sub.example.com
Type: NS
Value: ns1.sub.example.com
2. Added glue record in parent zone (example.com):
Name: ns1.sub.example.com
Type: A, Value: MY_SERVER_PUBLIC_IP
3. Added sub.example.com via he.net webportal to my main domain (example.com)
Note that the webportal tells me to add a TXT record with name dnshenet-key and value they provided.
I added this record to my bind config for this subdomain.
Any suggestions why this is not working?
Thanks.
#8
Questions & Answers / The IP address under AS4134 di...
Last post by HerobrineWhite - June 10, 2026, 11:07:56 AMHi, engineers from the TunnelBroker team.
A friend of mine created an IP tunnel years ago and has been using it ever since.
His upstream router does not support IPv6 distribution, and he has recently found that he is unable to update the "Client IPv4 Address" using the website API. When he browses or uses "cURL" to access the Update URL, he receives an abuse warning message.
I'd like to ask what happened. Is it still possible to restore the AS4134 dynamic update for "Client IPv4 Address"?
A friend of mine created an IP tunnel years ago and has been using it ever since.
His upstream router does not support IPv6 distribution, and he has recently found that he is unable to update the "Client IPv4 Address" using the website API. When he browses or uses "cURL" to access the Update URL, he receives an abuse warning message.
I'd like to ask what happened. Is it still possible to restore the AS4134 dynamic update for "Client IPv4 Address"?
#9
Questions & Answers / /48 ?
Last post by pronetla - June 09, 2026, 11:07:51 AMYesterday I signed up with Hurricane Electric to practice using IPv6 on my network, but they only assigned me a /64. Do I have to wait a while, or do I need to do something else to get a /48? Or do they no longer do that?
#10
General Questions & Suggestions / Re: DNSSEC support?
Last post by jostreff - June 09, 2026, 10:54:13 AMI am experiencing the exact same issue with my slave zones transferred from a PowerDNS master.
The zone transfers (AXFR) complete successfully, and the SOA serial numbers match perfectly across all nsX.he.net nodes. However, any external DNSSEC validation tool (like DNSViz) throws an ECONNREFUSED error specifically when querying the Hurricane Electric Anycast IPs (e.g., 216.66.1.2) for DNSKEY records.
My zones are signed using Algorithm 13 (ECDSA Curve P-256 with SHA-256), which is the current modern standard. It seems that the HE Anycast edge servers either drop/refuse requests for these crypto keys or fail to parse the DNSSEC records properly if the algorithm isn't explicitly supported by the underlying legacy software version running on the nodes.
It's 2026, and it's quite disappointing that we still cannot properly host a modern DNSSEC-signed slave zone on HE's Free DNS platform without down-grading to obsolete algorithms like RSASHA1. Any chance the backend software will be updated to support current PowerDNS/BIND DNSSEC deployments?
Best regards,
Jordan
The zone transfers (AXFR) complete successfully, and the SOA serial numbers match perfectly across all nsX.he.net nodes. However, any external DNSSEC validation tool (like DNSViz) throws an ECONNREFUSED error specifically when querying the Hurricane Electric Anycast IPs (e.g., 216.66.1.2) for DNSKEY records.
My zones are signed using Algorithm 13 (ECDSA Curve P-256 with SHA-256), which is the current modern standard. It seems that the HE Anycast edge servers either drop/refuse requests for these crypto keys or fail to parse the DNSSEC records properly if the algorithm isn't explicitly supported by the underlying legacy software version running on the nodes.
It's 2026, and it's quite disappointing that we still cannot properly host a modern DNSSEC-signed slave zone on HE's Free DNS platform without down-grading to obsolete algorithms like RSASHA1. Any chance the backend software will be updated to support current PowerDNS/BIND DNSSEC deployments?
Best regards,
Jordan