--- title: Free AAAA Record Lookup description: Check the IPv6 address a domain publishes — its AAAA records, from the resolver of your choice. Confirm dual-stack is really on, catch a record that points at an address nobody listens on, and see why IPv6-only clients time out while IPv4 works. canonical: https://watchfor.io/aaaa-record-lookup --- [Back to all free tools](/free-tools) # AAAA Record Lookup Check the IPv6 address a domain publishes — its AAAA records, from the resolver of your choice. Confirm dual-stack is really on, catch a record that points at an address nobody listens on, and see why IPv6-only clients time out while IPv4 works. [How to use this tool](/blog/how-to-check-aaaa-records) Result No result yet Fill in the form above and run it — the result appears here. Monitor this 24/7 — get alerted when a failure is confirmed. [Start free](/auth/sign-up) Only run these tools against systems you own or are authorized to test. Using them to scan or probe systems without permission violates our [Terms](/legal/terms). ## What is AAAA Record Lookup ? An AAAA record maps a name to an IPv6 address — the 128-bit kind, written like 2606:4700::6810:84e5 . It is the IPv6 twin of the A record, and the one most teams add last, test least, and get blamed for first: a browser on a mobile network with IPv6 will try the AAAA address before the A address, and if the AAAA record points at something that doesn't answer, that user waits through a timeout while your IPv4-only monitoring says everything is fine. This tool resolves the AAAA records of any name and shows each address. Use it to confirm dual-stack is really published, to find the AAAA record that points at an address nobody configured on the server, and to check that the IPv6 side of a migration moved along with the IPv4 side. ## How it works The query is identical to an A lookup with QTYPE=AAAA : - 1 Query the chosen resolver — Public resolvers return AAAA records regardless of whether the querying network has IPv6 — the record type is independent of the transport used to ask. - 2 Follow any CNAME — A www that is a CNAME to a CDN gets its AAAA records from the CDN's name. The tool shows the addresses at the end of the chain, not the aliases; a CNAME lookup on the same name shows whose name they came from. - 3 Show the answer — Addresses in compressed notation, with the status and query time. Whether the address actually answers is a separate question — follow up with a ping or port check to the IPv6 address to prove reachability. ## When you'd use it ### Enabling IPv6 for the first time You added the address to the server and the AAAA record to DNS. Look it up: is the record visible, is it the address you meant, does it match the one bound on the host? Then test a connection to it from a probe with IPv6. ### Some users time out, others don't A classic dual-stack failure: the AAAA record points at an address the firewall blocks or the server never got. IPv4 clients are fine; IPv6-capable clients hang for seconds before Happy Eyeballs falls back. Check the AAAA record first. ### After a server move The A record was updated by the person doing the migration; the AAAA record still points at the old host. Half the mobile traffic is now on a server you thought you'd decommissioned. ### Auditing a CDN or hosting change Some providers publish AAAA records automatically, some not at all. Knowing which is true for your setup decides whether you have IPv6 at all. ## Reading the result ### Compressed notation 2606:4700::6810:84e5 is the same address as 2606:4700:0000:0000:0000:0000:6810:84e5 — runs of zero groups collapse to :: once. The IPv6 subnet calculator expands and compresses either way. ### No AAAA record (shown as NXDOMAIN) The name has no IPv6 address published. Clients simply use IPv4. It's the normal state for most of the internet, and a finding only if you expected IPv6. This tool shows the case as NXDOMAIN with no records, the same as a name that doesn't exist at all (raw DNS says NOERROR with an empty answer); an A lookup on the same name tells you the name itself is fine. ### Address types Public IPv6 starts with 2 or 3 (global unicast). fe80:: is link-local and fc00::/7 is unique-local — neither belongs in a public AAAA record. ### A and AAAA pointing at different places The two records are independent, each with its own TTL; a change to one doesn't touch the other. A mismatch after a migration usually means only one of them was edited. ## Check it yourself dig AAAA example.com @1.1.1.1 +noall +answer ping6
or curl -6 https://example.com then proves the address answers, which the record alone doesn't. ## Common pitfalls ### Publishing an AAAA record before the server listens on it The moment the record exists, IPv6 clients will use it. Bind the address, open the firewall, test from outside — then publish. ### Monitoring only IPv4 If every check you run resolves the A record, an IPv6 outage is invisible to you and very visible to users. Run at least one monitor with ip6 protocol against the AAAA address. ### A firewall that forgot IPv6 Many security groups and iptables rules are written once for IPv4. The AAAA record is fine, the server listens, and the packets are dropped by a default-deny nobody remembers writing. ## Run AAAA Record Lookup on every change, not just once. Get alerted when an outage is confirmed — across HTTP, DNS, SSL, RDAP, ping, blacklist and more. Free forever for 15 monitors. No card. [Start free](/auth/sign-up) ## Frequently asked questions Do I need an AAAA record? Not for the site to work — IPv4 still reaches everyone. You need one to be reachable over IPv6, which is now the majority of mobile traffic in many countries, and which avoids carrier-grade NAT on the client side. If you publish one, monitor it. Why does my site have an AAAA record I never created? Your CDN or hosting provider added it, or the www CNAME resolves to a provider name that has one. It's usually correct — the provider handles IPv6 at its edge — but the lookup tells you whose address it is. Can an AAAA record and an A record have different targets? Yes, they're independent records. Some setups deliberately send IPv6 to a different edge. Accidentally, it's the migration-that-moved-one-record problem. Why does the browser prefer IPv6? RFC 6724 address selection and Happy Eyeballs (RFC 8305): a dual-stack client tries IPv6 first and races IPv4 a few hundred milliseconds later. A broken AAAA record costs that delay on every connection. What does :: mean in the address? One run of consecutive all-zero groups, omitted. It can appear only once per address so the expansion is unambiguous. ## Related dns tools - [DNS LookupResolve A, AAAA, MX, TXT, NS, SOA, CNAME, PTR, CAA, SRV records for any domain.](/dns-checker) - [DNS PropagationCheck how a DNS record looks from every prober region simultaneously — spot stale anycast nodes and propagation gaps on a world map — plus an A+ to F DNS health grade for the zone: nameservers, delegation, DNSSEC and CAA.](/dns-propagation-checker) - [Whois LookupModern RDAP-based domain registration lookup: registrar, expiry, nameservers, status flags.](/whois-lookup) - [DNS Health CheckerGrade a domain's DNS A+ to F: how many nameservers it has and on which networks, lame delegation, whether the registry and the zone agree, SOA serials, DNSSEC and CAA, with the fix for every problem. Then see what every probe location answers, on a map.](/dns-health-checker) --- Canonical page: https://watchfor.io/aaaa-record-lookup · Site guide: https://watchfor.io/llms.txt