Skip to content
ProbeDNS

AAAA Record Lookup

An AAAA record maps a hostname to a 128-bit IPv6 address — the IPv6 counterpart of an A record. This lookup returns every AAAA record a name publishes and distinguishes an IPv4-only host, which is fine, from a nonexistent name or a failing zone, which are not.

Why AAAA records matter more than the traffic numbers suggest

The record is named AAAA ("quad-A") because an IPv6 address is four times the size of an IPv4 address: 128 bits instead of 32. Functionally it is identical to an A record — a name, an address, a TTL — but the operational consequences of getting it wrong are asymmetric, and that asymmetry catches people out.

A missing AAAA record is harmless. Dual-stack clients simply use IPv4. A broken AAAA record is not harmless at all: clients on IPv6 networks prefer IPv6 by default, so they attempt the dead address first. Happy Eyeballs (RFC 8305) is supposed to race both families and fall back within a few hundred milliseconds, but the fallback is not universal — older clients, some mail servers, and plenty of command-line tools will just hang. The result is the worst kind of outage: fine for most of the world, completely broken for a specific set of networks.

dig +noall +answer google.com AAAA
google.com.		6	IN	AAAA	2404:6800:4000:1015::71
google.com.		6	IN	AAAA	2404:6800:4000:1015::66
google.com.		6	IN	AAAA	2404:6800:4000:1015::8b
Real AAAA answers. The six-second TTL is a deliberate choice for geo-steered traffic.

Reading IPv6 addresses without going cross-eyed

  • Eight groups of four hex digits, separated by colons. Leading zeros in a group may be dropped: 2001:0db8:0000:0042 is written 2001:db8:0:42.
  • :: replaces one run of all-zero groups and may appear once per address. 2001:db8::1 is 2001:0db8:0000:0000:0000:0000:0000:0001.
  • Addresses beginning 2000::/3 (anything starting 2 or 3) are global unicast — routable on the public internet.
  • fe80::/10 is link-local. Valid on a LAN, meaningless in a public DNS zone. Publishing one is always a mistake.
  • fc00::/7 (starting fc or fd) is unique local — the IPv6 equivalent of RFC 1918 private space. Also unroutable publicly.
  • ::ffff:192.0.2.1 is an IPv4-mapped address. It belongs in socket APIs, not in a DNS zone.
Read the full explanation of aaaa record lookup results ↓
If this lookup shows an address starting fe80:, fc, or fd, IPv6 users cannot reach that host at all. Remove the record or replace it with a global unicast address — leaving it in place is worse than having no AAAA record.

How clients choose between A and AAAA

A dual-stack client resolves both record types and then applies RFC 6724 address selection, which prefers global IPv6 over IPv4 in almost every ordinary case. RFC 8305 (Happy Eyeballs v2) layers a race on top: the client starts the IPv6 connection first, waits a short resolution delay for the A record, and begins the IPv4 attempt roughly 250 ms later, taking whichever handshake completes first.

Two consequences follow that are worth planning around. First, once you publish a working AAAA record, the majority of IPv6-capable traffic moves to it immediately — so the IPv6 path must be as well provisioned, as well firewalled, and as well monitored as the IPv4 one, not a lightly tested afterthought. Second, your server logs will start recording IPv6 source addresses, which breaks any allowlist, rate limiter, geolocation lookup, or abuse script that assumes a dotted-quad. Check those before publishing, not after.

Happy Eyeballs also explains why a broken AAAA record produces such inconsistent bug reports. A modern browser hides the failure behind a sub-second delay, so users describe the site as "a bit slow"; a curl script, an SDK, or an older mail server has no such fallback and fails outright. Same record, same network, completely different symptom depending on the client.

Common failures and fixes

  1. "The site works for everyone except one office." Classic broken-AAAA symptom: that office has native IPv6 and everyone else does not. Test the address directly with curl -6 -v https://example.com from an IPv6-capable host before blaming the network.
  2. AAAA published, but the server is not listening on IPv6. DNS and the service are configured independently. Check your web server binds [::]:443 as well as 0.0.0.0:443, and that the firewall has ip6tables/nftables rules mirroring the IPv4 ones — a frequent omission, since IPv4 rules do not apply to IPv6 traffic.
  3. AAAA on the apex but not on www (or vice versa). They are separate names. Dual-stack one and not the other and you get half-broken behaviour that is maddening to reproduce.
  4. A CDN-proxied record shows an address you do not recognise. Expected. Proxied records publish the proxy's anycast addresses; your origin stays hidden.
  5. Mail server has AAAA but no IPv6 reverse DNS. Major providers, Google in particular, reject IPv6 mail from hosts without a matching PTR record. Verify with the reverse DNS lookup, and if you cannot get a valid IPv6 PTR, remove the AAAA from the mail hostname rather than losing delivery.
  6. Stale AAAA after a server move. IPv6 addresses are usually assigned per-subnet, so a move to a new rack or provider changes the whole prefix. Update A and AAAA together — updating only one is a very common half-migration.

Verifying from the command line

# The AAAA records themselves
dig +short google.com AAAA

# A and AAAA side by side
dig +noall +answer google.com A google.com AAAA

# Prove the address actually answers over IPv6
curl -6 -sS -o /dev/null -w '%{http_code}\n' https://google.com
ping6 -c 3 google.com

# Check whether your own network has working IPv6 at all
dig -6 +short @2606:4700:4700::1111 example.com AAAA
If the last command fails but the first succeeds, your machine has no IPv6 path — the record may be perfectly fine.

That last distinction matters when you are debugging. A dig from a machine without IPv6 connectivity still returns AAAA records correctly, because the *query* travels over IPv4 while the *answer* merely contains an IPv6 address. Being able to look up an AAAA record proves nothing about being able to reach it.

Rolling out IPv6? Publish the AAAA record with a low TTL (300s) first, watch your error rates for a day, and keep the record removable at short notice. Once traffic looks clean, raise the TTL.

Frequently asked questions

Do I need an AAAA record?
You do not need one, but you increasingly benefit from one. Large mobile networks are IPv6-first and reach IPv4 through carrier-grade NAT, which adds latency and shares reputation across thousands of subscribers. Publishing a working AAAA record gives those users a direct path. Publishing a broken one is worse than publishing none.
Why does my domain have no AAAA record?
Most likely your host has no IPv6 address, or your provider has not enabled IPv6 for the service. That is an empty result, not an error — the name exists and its A record works fine. Ask your host whether IPv6 is available; on most VPS providers it is a free checkbox.
Can I have both A and AAAA records for the same hostname?
Yes — that is the normal dual-stack configuration and it is what you should aim for. Clients choose per RFC 6724 and RFC 8305, generally preferring IPv6 and racing IPv4 as a fallback. Both records must point at the same service, or users will see different content depending on their network.
Why is my site slow only for some users after adding IPv6?
Their client tries the IPv6 address first and waits for it to fail before retrying IPv4. That is the Happy Eyeballs fallback doing its job, and it costs a visible delay on every connection. Either fix IPv6 reachability on the server, or remove the AAAA record until you can.
Does an AAAA record affect email?
Significantly. If your mail server has an AAAA record, receiving servers may connect over IPv6, and several large providers require IPv6 senders to have valid reverse DNS and passing authentication. Check your MX records and reverse DNS before dual-stacking a mail host.
What is the difference between AAAA and A6?
A6 was an experimental 1990s alternative designed for renumbering, defined in RFC 2874 and moved to historic status by RFC 6563. AAAA is the only IPv6 address record in use. If a tool or tutorial mentions A6, it is out of date.
How do I test IPv6 if my ISP does not provide it?
Use a resolver reachable over IPv4 to read the records, then verify reachability from somewhere with native IPv6 — a cloud VM, a mobile hotspot on an IPv6-first carrier, or the DNS propagation checker which queries from many networks. Do not conclude a record is broken from a machine with no IPv6 path.

Related guides

CNAME vs A Record: Which Should You Use?

When to point with an alias and when to use a direct IP.