Publishing an AAAA record promises a usable IPv6 path. Test the service and its dependencies over IPv6 before making that promise.

Only publish what accepts packets

Publish AAAA only after confirming that the endpoint accepts IPv6 traffic with the expected application behavior and certificate. DNS can publish an address even when the service behind it is unreachable.

The delivery model

How it works

IPv6 DNS AAAA

  1. 01PublishAssociate the hostname with an IPv6 address.
  2. 02ConnectReach the service over IPv6 with valid TLS.
  3. 03OperateMonitor IPv6 and IPv4 as separate paths.
Conceptual model for this configuration. The actual path depends on provider policy and application behavior.

Authority over IPv6

Nameservers should be reachable over IPv6 as well as IPv4. Cloud DNS Anycast nameservers support both.

Do not let v4 and v6 maps disagree

If GeoDNS sends IPv4 to region A and IPv6 to region B, you will debug ghosts. Design the maps together.

CDN clients versus origin

The edge can speak IPv6 to users while origin pull stays IPv4. That is normal. Do not publish AAAA for the origin just because the CDN is dual-stack.

Validate before production

Run an IPv6-only request for the real application, including redirects, authentication, and downloads. Compare firewall and routing policy with IPv4. Remove or correct broken AAAA records rather than assuming client fallback makes the failure harmless.

  • Record the configuration and expected result before changing traffic.
  • Keep evidence of the test and a working rollback for the previous behavior.

Sources & further reading