[J-Kuhn]

> DNS64 breaks DNSSEC

Yes, it does. While in theory you could "undo" the translation and verify against the re-synthesized A record, nobody is going to do that.

464XLAT shifts the "make an IPv6 address from an IPv4" to the CPE or even end device (Apple Devices are known to work well with 464XLAT). For this the device discovers the prefix, and if software wants to make an IPv4 connection, it sends it to the NAT64 using the prefix + IP. DNS64 would be no longer needed.