Design: DNS64 support in the multi-tenant DNS service #571

Research and design work for DNS64 support, part of Internet NAT64 gateway for Galactic VPC and the completed DNS64 enhancement.

Purpose

Produce a design for how the multi-tenant DNS service synthesizes AAAA records from A records using the tenant's NAT64 prefix, so IPv6-only instances can resolve IPv4-only hostnames and reach them through the NAT64 gateway. Deliverable is a design, not an implementation.

Focus areas

• Where synthesis lives in the DNS service query path, scoped per-tenant private zone
• Reading the NAT64 prefix from IGW as the source of truth (no independent configuration)
• Per-zone on/off for tenants and distinguishing synthesized from native AAAA responses
• Safe degradation when the NAT64 prefix is unavailable