About adding security.debian.org ipv6 to iptables, which range should we add?

[Stefan Eriksson <stefan@glesys.se>]

Hi now and again we get a timeout when looking up security.debian.org 
while running apt-get update. We have traced it to the ipv6's we get. It 
seems like they change (and as ipv6 have prio over ipv4 we are affected) 
Which ipv6 range should we open for in iptables to have full access to 
security.debian.org over ipv6? (also ipv4 would be great but this doesnt 
seem to change .) we'd like to have the ip ranges so we can open for 
these, so we dont have to re lookup the domain/running the same rule again.

a dig today gives three pointers and a few days ago we had a different 
result

Thanks.
Stefan