Add IPv6 to your website: AAAA records, testing and pitfalls

A large and growing share of visitors reach the internet over IPv6. Many mobile networks are IPv6-only inside and reach IPv4-only sites through translation (NAT64), which adds a hop and a shared address you have no control over. Giving your site an IPv6 address removes that detour, and for most sites it is a matter of adding one DNS record. The catch is that a broken IPv6 setup is worse than none, because some visitors will try IPv6 first. This guide adds IPv6 to www.example.com and example.com and tests it properly.

How a browser chooses IPv4 or IPv6

A name with an IPv4 address has an A record; a name with an IPv6 address has an AAAA record. When both exist, devices with IPv6 connectivity generally prefer it, but modern browsers and operating systems use "Happy Eyeballs" (RFC 8305): they try IPv6, and if it does not connect within a fraction of a second, they race IPv4 alongside it. That hides many problems from desktop browsers, but not from everything: API clients, monitoring, crawlers, mail servers and older software may try IPv6 only, and wait for a timeout if it fails.

So the rule is: publish an AAAA record only for an address that serves the same site, with the same certificate, as the IPv4 address.

Step 1: Check what you have

1. Look up both names with DNS lookup. It says "No IPv6 (AAAA) record" when only A exists, or "Reachable over IPv6" when there is an AAAA record.
2. Run the Domain health report. It reports whether the domain is reachable over IPv4 and IPv6, with the number of addresses for each.
3. Check your own connection with the Browser & connection test, which tests IPv4 and IPv6 separately in your browser. You need working IPv6 at your end to test the site from a browser later; if you have none, use a server or a mobile connection that has it, or the commands below from a machine with IPv6.

Step 2: Find out whether your host or CDN supports IPv6

Which route applies depends on what your A record points at.

Behind a CDN or proxy

If your site is behind a CDN that proxies traffic, visitors connect to the CDN, not to your server, so IPv6 is the CDN's job. Most large CDNs give proxied names both A and AAAA addresses automatically, and Cloudflare, for example, has IPv6 compatibility switched on by default. The CDN can reach your origin over IPv4, so the origin needs no IPv6 at all. Check with DNS lookup that the CDN already returns an AAAA record for your name; if not, look for an IPv6 setting in the CDN dashboard.

Shared or managed hosting

Many hosts assign an IPv6 address to each site or server; it is shown next to the IPv4 address in the control panel or in their documentation. Use exactly the address they give you. If they do not list one, ask support whether IPv6 is available, rather than guessing.

Your own server or VPS

1. Most cloud and VPS providers allocate an IPv6 address or a whole /64 to each server; some need it switching on in the control panel. Check it is configured:

   ip -6 addr show scope global
   

2. Make the web server listen on IPv6 as well. In nginx:

   listen 443 ssl;
   listen [::]:443 ssl;
   listen 80;
   listen [::]:80;
   

   Apache's Listen 443 already covers both protocols on most systems. Check with ss -tlnp | grep -E ':(80|443)': you want [::]:443 or *:443 as well as 0.0.0.0:443.

3. Allow ports 80 and 443 in the IPv6 firewall too. iptables and ip6tables are separate rule sets, as are IPv4 and IPv6 rules in many cloud security groups. A firewall that only lists IPv4 rules is the most common reason an IPv6 site times out.

4. Test locally before touching DNS:

   curl -6 -sI https://www.example.com --resolve www.example.com:443:[2001:db8::10]
   

Step 3: Add the AAAA records

Add an AAAA record next to every A record that serves the website, with the address from step 2:

example.com.      3600  IN  A     192.0.2.10
example.com.      3600  IN  AAAA  2001:db8::10
www.example.com.  3600  IN  A     192.0.2.10
www.example.com.  3600  IN  AAAA  2001:db8::10

If www is a CNAME to the bare domain or to a provider's name, it inherits the target's addresses and needs no AAAA of its own.

Things to keep in mind:

• Use a short TTL at first, such as 300 seconds, so you can remove the record quickly if something is wrong. Raise it once everything works. See DNS changes not showing? for how TTLs affect this.
• The certificate does not change. Certificates cover names, not addresses, so the same certificate works over both protocols as long as the IPv6 address reaches the same server.
• Do not add AAAA records to mail host names (such as the names your MX records point to) as part of this job, unless your mail server is ready for IPv6. Sending mail over IPv6 brings its own requirements, including reverse DNS for the IPv6 address.

Step 4: Test over IPv6

Once the record is visible (check with DNS lookup), test each protocol on its own from a machine with IPv6:

curl -6 -sSI https://www.example.com
curl -4 -sSI https://www.example.com

Both should return the same status and headers. Then check the certificate over IPv6:

openssl s_client -connect www.example.com:443 -servername www.example.com -6 </dev/null 2>/dev/null \
  | openssl x509 -noout -subject -dates

The SSL/TLS certificate check and the HTTP headers & security check connect from our server, which may use IPv4, so do not rely on them alone to prove that IPv6 works. Run the Domain health report again: it should now report the domain as reachable over IPv4 and IPv6.

Finally, open the site in a browser on an IPv6 connection. The What's my IP? page shows which protocol your browser is using.

Common problems that affect only IPv6 visitors

Also check anything that lists IP addresses for access control, such as an admin area restricted to the office's IPv4 address: the same person may now arrive over IPv6.

FAQ