Implementation suggestions (kernel/library) Background OSes has to be secure by default, take a security stance Do not support RFC2553 special consideration for IPv4 mapped addr Turn on IPV6_V6ONLY socket option in 2553bis by default default in doc - off drop any IPv6 packet with IPv4 mapped address drop any AAAA DNS response with IPv4 mapped address