Dual stack with CGN v4 is probably better as it won't wreck DNSSEC validation. NAT64 requires DNS64 which synthesizes fake v6 targets for v4 only endpoints. It

Dual stack with CGN v4 is probably better as it won't wreck DNSSEC validation. NAT64 requires DNS64 which synthesizes fake v6 targets for v4 only endpoints. It was a solution in search of a problem.