AAAA Record Lookup

An AAAA record (pronounced quad-A) holds an IPv6 address for a hostname. It was defined in RFC 3596 and gets its name from being four times the size of an A record: 128 bits instead of 32. An IPv6 address is written as eight colon-separated groups of four hexadecimal digits, and RFC 5952 sets the short form where the longest run of zero groups collapses to a double colon.

example.com.      3600  IN  AAAA  2001:db8:4f2a::1
www.example.com.  3600  IN  AAAA  2001:db8:4f2a::1

Everything else works like an A record. A name can hold several AAAA records, each carries its own TTL, and a CNAME cannot sit at the same name. The 2001:db8::/32 prefix in the example is reserved for documentation by RFC 3849.

An AAAA record lookup returns every IPv6 address published for the name and the TTL remaining on each one. Our DNS lookup tool asks Google Public DNS (8.8.8.8), Cloudflare (1.1.1.1), Quad9 (9.9.9.9) and OpenDNS at the same time and shows whether they agree, and annotates each address with the city, country and autonomous system that announces it. An empty result is a valid and common answer. It means the domain publishes no IPv6 address and is reachable over IPv4 only.

Open Command Prompt or PowerShell. nslookup ships with every version of Windows, and Resolve-DnsName is the PowerShell cmdlet. Add a resolver address, as in the last two lines, to ask a public resolver instead of your network's.

nslookup -type=AAAA example.com
Resolve-DnsName -Type AAAA example.com
nslookup -type=AAAA example.com 8.8.8.8
Resolve-DnsName -Type AAAA example.com -Server 1.1.1.1

macOS ships dig, so no install is needed. Open Terminal and run one of these. The +short form prints only the record values, and the @ form sends the query to a specific resolver.

dig AAAA example.com
dig AAAA example.com +short
dig @1.1.1.1 AAAA example.com

dig and host come from the dnsutils package on Debian and Ubuntu and from bind-utils on Fedora and RHEL. The +noall +answer options print only the answer section, and +tcp forces the query over TCP when you suspect a truncated UDP answer.

dig AAAA example.com +noall +answer
host -t AAAA example.com

After you change a AAAA record, the authoritative nameservers answer with the new value immediately, and every recursive resolver that cached the old record keeps serving it until the cached TTL runs out. Our DNS lookup tool above shows whether Google, Cloudflare, Quad9 and OpenDNS agree yet, and the Authoritative option reads the value straight from the zone's own nameservers. The DNS propagation checker asks resolvers in more locations and lays the results out side by side.

A dual stack host has both an IPv4 and an IPv6 address and publishes both an A and an AAAA record. A dual stack client resolves both and has to choose. Early implementations tried IPv6 first and waited for a full timeout before falling back, so a broken IPv6 path felt like a dead site.

Happy Eyeballs fixes that. RFC 6555 (2012) and its replacement RFC 8305 (2017) tell the client to send the A and AAAA queries in parallel, prefer the IPv6 answer, and start an IPv4 connection if the IPv6 attempt has not succeeded after a short delay. RFC 8305 recommends a Connection Attempt Delay of 250 milliseconds and a Resolution Delay of 50 milliseconds, the time to wait for a late AAAA answer once the A answer has arrived. Whichever connection completes first wins, which is why a domain with a bad AAAA record still loads, just a quarter of a second slower.

No. A missing AAAA record is the normal state for most domains. Clients reach the site over IPv4, and IPv6-only mobile networks reach it through the carrier's NAT64 gateway, which synthesises an IPv6 address for it using DNS64 (RFC 6147). Nothing breaks.

A wrong AAAA record is a problem. If it points at an address that does not answer, IPv6 clients lose 250 milliseconds to Happy Eyeballs on every new connection, and software without Happy Eyeballs (older embedded systems, some mail servers) waits for a full timeout or fails. The usual causes are a server that lost its IPv6 route or a firewall that permits port 443 on IPv4 only. Before publishing an AAAA record, make sure the address answers on the ports you serve.

First confirm the AAAA record exists with the lookup above. Then force a connection over IPv6 from a network that has it. curl and ping both take a flag for that.

curl -6 -sI https://example.com
ping -6 example.com       # Linux and Windows
ping6 example.com         # macOS and BSD

If curl reports that it cannot assign the requested address, your own network has no IPv6 route and the test says nothing about the domain. Our My IP page shows your IPv4 and IPv6 addresses separately. If you have an IPv6 address and the connection still fails, the AAAA record points somewhere that does not answer, and the ASN in the lookup tells you which network to raise it with.

Every lookup on DNSX is also a JSON endpoint on api.dnsx.dev that you can call from curl or a script with no API key. The response has one result per resolver with its records and TTLs.

curl https://api.dnsx.dev/dns/aaaa/google.com