IPv4 vs IPv6 and AAAA Records

Why IPv6 exists

A 32-bit address space holds a little over 4.29 billion addresses, and a large share of that is reserved for private networks, multicast and other special uses. IANA handed out its last general-purpose IPv4 blocks to the Regional Internet Registries in 2011, and the registries have since run down their own pools. Networks now stretch IPv4 with NAT, sharing one public address among many devices, as explained in NAT and Private IP Address Ranges.

IPv6 solves the shortage by making the address 128 bits long. The usual allocation for a single subnet is a /64, which on its own contains 2 to the 64th addresses, so address conservation stops being a design concern. That makes end-to-end addressing practical again: every device can have its own globally unique address.

How the two protocols compare

IPv6 text follows the rules in RFC 5952: lowercase hex, leading zeros in each group dropped, and the longest run of all-zero groups replaced once with ::. So 2001:0db8:0000:0000:0000:0000:0000:0010 is written 2001:db8::10. Prefixes use the same CIDR notation as IPv4, described in IP Addresses, Subnets and CIDR.

AAAA records in practice

A client that wants to connect to www.example.net over IPv6 asks for its AAAA record. The query and the answer are ordinary DNS messages; the record type only describes the data, not the transport. A resolver can fetch AAAA records over IPv4 and A records over IPv6.

$ dig www.example.net AAAA +noall +answer
www.example.net.    3600    IN    AAAA    2001:db8:10::80

$ dig www.example.net A +noall +answer
www.example.net.    3600    IN    A       192.0.2.80

Reverse lookup for the IPv6 address: one label per hex digit:

$ dig -x 2001:db8:10::80 +noall +answer
0.8.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.1.0.0.8.b.d.0.1.0.0.2.ip6.arpa. 3600 IN PTR www.example.net.

Some points that catch operators out:

• A CNAME covers both. If www is a CNAME, the target name supplies both the A and AAAA records. You cannot have a CNAME for one family and an address record for the other at the same name.
• Name servers need IPv6 too. If your authoritative servers have IPv6 addresses, publish AAAA records for them and make sure the parent zone carries AAAA glue where glue is needed. Otherwise IPv6-only resolvers cannot reach them.
• Missing is not the same as broken. A name with no AAAA record returns an empty NOERROR answer for AAAA queries. That is correct and harmless. An error such as SERVFAIL for AAAA alone is a real fault.
• Reverse DNS is separate. PTR records for IPv6 live in ip6.arpa, often under a different delegation from your IPv4 reverse zones. See Reverse DNS and PTR Records.

Happy Eyeballs: choosing between A and AAAA

A dual-stack client has a choice to make every time it connects. Early implementations tried IPv6 first and only fell back to IPv4 after a full connection timeout, so a broken IPv6 path could add many seconds to every page load. Happy Eyeballs fixes that by racing the two families with a short head start for IPv6.

Version 2 of the algorithm, RFC 8305, works roughly like this:

• The client sends the AAAA query first and the A query immediately after, without waiting.
• If the A answer arrives first, the client waits a short Resolution Delay (50 milliseconds is the recommended value) for the AAAA answer before proceeding with IPv4 alone.
• Addresses are sorted with IPv6 preferred and the families interleaved, so one bad family cannot block the other.
• Connection attempts start one at a time, separated by a Connection Attempt Delay (250 milliseconds by default), and the first connection to complete is used.

The result is that a broken AAAA record usually costs a fraction of a second rather than a failed connection. It is still a cost, and not every client implements the algorithm, so treat a non-working AAAA record as an outage that happens to be masked.

Transition mechanisms and DNS

Some networks, especially mobile ones, give clients only IPv6 and reach the IPv4 Internet through a translator. In that setup, DNS64 (RFC 6147) works with NAT64: when a name has only an A record, the resolver synthesizes an AAAA record by embedding the IPv4 address inside an IPv6 prefix, commonly the well-known 64:ff9b::/96. The client connects over IPv6 and the NAT64 gateway translates to IPv4.

For DNS operators, this has two consequences. Synthesized answers break DNSSEC validation on clients that validate for themselves, since the record was not signed by the zone. And an IPv4 literal hard-coded in an application bypasses DNS64 entirely, which is one of many good reasons to use names rather than addresses. IPv6 also has a larger minimum MTU and no router fragmentation, which affects big DNS responses; see MTU, Fragmentation and Big DNS Answers.

How DNS Panopticon helps

Website Recon resolves both A and AAAA records for a hostname and looks up each resulting address in RDAP to show the network and autonomous system it belongs to. Comparing the two lists is a quick way to spot an IPv6 address that points at a different provider than the IPv4 one, which often means one family was forgotten during a migration.

With a zone export loaded, Zone Analyzer can filter on record type, and its Web Only quick pill limits the grid to A, AAAA and CNAME rows, so you can review every AAAA record in one place and check that each still has a matching IPv4 counterpart where you expect one.