Skip to content
Control Plane Labs

AAAA record

Maps a hostname to a single IPv6 address.

Last updated July 27, 2026

Zone-file example

; type 28, defined in RFC 3596
www.example.com.    300    IN    AAAA    2001:db8::10
example.com.        300    IN    AAAA    2001:db8::10

Typical uses

  • Publishing an IPv6 address so dual-stack and IPv6-only clients can connect
  • Meeting IPv6 requirements for mobile networks and government procurement
  • Serving IPv6-only internal networks and Kubernetes clusters
  • Paired with an A record on the same name for dual-stack service

When it breaks, check

  • A published AAAA that does not actually accept connections is worse than no AAAA at all
  • Check that firewalls and security groups allow IPv6 separately — they usually do not by default
  • Shortened notation is cosmetic; ::1 and 0:0:0:0:0:0:0:1 are the same address
  • Some resolvers synthesise AAAA via NAT64/DNS64, so an unexpected 64:ff9b::/96 answer is not a bug

What the AAAA record does

AAAA is deliberately boring: same semantics as A, four times the address length, hence the four A’s in the name. The operational weight comes from what happens when the record is wrong. A missing AAAA costs you nothing on a dual-stack network. A present but broken AAAA — published address, no listener, or a firewall that drops IPv6 — is a real outage for IPv6-preferring clients, and it is invisible from an IPv4-only test machine. Publishing AAAA is a commitment to operating that path.

Zone-file and wire format

The zone-file syntax is name TTL IN AAAA address with the address in standard IPv6 textual form, including :: compression. The RDATA on the wire is a flat 16 octets, so all textual forms of the same address are identical once encoded. Note that a zone can carry both A and AAAA for one name with different TTLs, which is a legitimate way to move one family faster than the other.

; name              TTL   class type  rdata
www.example.com.     300   IN    AAAA  2001:db8::10
www.example.com.     300   IN    A     203.0.113.10

; the same host, both families. Clients using Happy Eyeballs race them
; and keep whichever connects first.

Common uses

Beyond ordinary dual-stack web service, AAAA records matter in two places you might not expect. Mobile carriers increasingly run IPv6-only access networks and reach IPv4 destinations through NAT64, so an AAAA record lets those clients skip the translator entirely. And IPv6-only Kubernetes or container networks need AAAA for service discovery to work at all, because there is no IPv4 address to publish. Cloud load balancers usually offer dual-stack listeners that give you both records for the same endpoint.

Troubleshooting

The first check is whether the address answers. Resolve the AAAA, then connect to it explicitly with IPv6 forced. curl’s -6 flag makes the failure loud instead of letting Happy Eyeballs paper over it.

If a name resolves to an address in 64:ff9b::/96 that you never configured, you are behind a DNS64 resolver synthesising AAAA records for IPv4-only destinations (RFC 6147). That is normal on IPv6-only mobile networks and not something to fix in your zone. Also remember that IPv6 firewall rules are separate from IPv4 ones in almost every stack, so a working A record proves nothing about the AAAA path.

# resolve, then force IPv6 so a broken path fails loudly
dig www.example.com AAAA +short
curl -6 -sSv https://www.example.com/ 2>&1 | head -20

# compare both families from the authoritative server
dig +norecurse @ns1.example.com www.example.com A +short
dig +norecurse @ns1.example.com www.example.com AAAA +short

The defining RFC

AAAA is type 28 and is defined in RFC 3596, which is an Internet Standard and replaced the earlier experimental A6 proposal. The IPv6 addressing architecture it depends on is RFC 4291, and the textual representation you write in a zone file is canonicalised by RFC 5952. Client-side address selection behaviour, which determines whether your AAAA is actually used, is RFC 8305 — Happy Eyeballs v2. Check a live name with the DNS lookup tool.

Reference and tooling

Every record type and its assigned numeric value is listed in theIANA DNS Parameters registry. To query a live zone from the browser, use theDNS lookup tool. If the record you are chasing is TLS-related, the TLS inspector andCertificate Transparency lookup are usually the next two stops.

Other record types