---
title: Is my site on IPv6? How to check AAAA records with the AAAA Record Lookup
description: Some users on mobile or IPv6-only networks time out while everyone else is fine, or you're simply not sure your site has IPv6 at all. To check AAAA records, look up the domain's IPv6 addresses: none means IPv4 only, and one that points at a server nobody configured means slow or failing connections. Here's how to do it with the free AAAA Record Lookup, a real domain with no IPv6, and the dig commands that tell 'no AAAA' from 'no such domain'.
canonical: https://watchfor.io/blog/how-to-check-aaaa-records
---

# Is my site on IPv6? How to check AAAA records with the AAAA Record Lookup

2026-10-04 · WatchFor Team · Guides · guides, dns, networking

Some users on mobile or IPv6-only networks time out while everyone else is fine, or you're simply not sure your site has IPv6 at all. To check AAAA records, look up the domain's IPv6 addresses: none means IPv4 only, and one that points at a server nobody configured means slow or failing connections. Here's how to do it with the free AAAA Record Lookup, a real domain with no IPv6, and the dig commands that tell 'no AAAA' from 'no such domain'.

To check AAAA records, look up the IPv6 addresses a domain publishes. If the
lookup returns one or more addresses, the domain advertises IPv6 and every
address must belong to a server that answers on it. If it returns none, the
domain is IPv4 only: dual-stack visitors fall back to IPv4 without noticing,
and IPv6-only clients reach it only through their network's translation
(NAT64), if at all.

The free [AAAA Record Lookup](/aaaa-record-lookup) shows a domain's AAAA
records from a real WatchFor location in under a second. No signup.

## What this tool answers

*Does this domain publish an IPv6 address, and which one?* Reach for it
when you turn on IPv6 for the first time, after migrating a server (the IPv6
side is the one that gets forgotten), when some users see slow first
connections or timeouts while your IPv4-only monitoring says all is well, or
when an IPv6-only build server or container can't reach a dependency.

## A real example

### Checking AAAA records for a domain with no IPv6

A report developers know well: a CI runner or container on an IPv6-only
network fails to fetch code from GitHub, while the same job works on a
laptop. The first question is whether the destination publishes IPv6 at all.

In the [AAAA Record Lookup](/aaaa-record-lookup) we typed `github.com`,
kept the resolver on **Auto** and pressed **Run lookup**:

![The AAAA Record Lookup for github.com from Europe / Lithuania: resolve time 57 ms, an amber NXDOMAIN badge, 0 records and "No records returned."](/blog/how-to-check-aaaa-records-result.webp)

The lookup took 57 ms and returned **0 records**, with an amber
**NXDOMAIN** badge. The badge is misleading here: `github.com` obviously
exists. What the resolver really said is "this name exists but has no AAAA
record" (`NOERROR` with an empty answer, often called NODATA). The tool
currently reports both cases as NXDOMAIN for AAAA lookups; the command line
section shows how to tell them apart in one line.

So the reading is: `github.com` publishes an IPv4 address (`140.82.121.3`
from the same resolver) and **no IPv6 address**. For comparison,
`wikipedia.org` returns `2a02:ec80:300:ed1a::1`.

**The answer:** the runner fails because GitHub is IPv4 only. Fixes, in
order of effort: run the job on a dual-stack network, enable NAT64 with
DNS64 on the IPv6-only network (DNS64 synthesises an AAAA record that routes
through the translator), or fetch through a proxy that has IPv4. For your
own site, an empty AAAA result means IPv6 visitors are on IPv4 or a
translator, which works but isn't native IPv6.

## How to read the results

| What you see | What it means |
| --- | --- |
| **Resolve time** | How long the lookup took: green under 50 ms, amber under 200 ms, red above. |
| **NOERROR** (green) with addresses | The domain publishes IPv6. Each row's `address` is one AAAA record, in compressed form (`::` replaces runs of zeros). |
| **NXDOMAIN** (amber), 0 records | No IPv6 address came back. Either the name doesn't exist, or (far more often) it exists without an AAAA record. Check the A record or run `dig` to know which. |
| **N records** | How many IPv6 addresses. Several are normal for CDNs and load balancers. |
| **Location** | Signed out, the query runs from the WatchFor location nearest you. The query itself goes over IPv4; any resolver returns AAAA records regardless of the transport. |

If the name is a CNAME, the addresses are those of the alias target. The
tool shows addresses without TTLs; `dig` shows them.

## More ways to use it

- **Turning on IPv6.** After adding the address to the server and the AAAA
  record to DNS, confirm the record is visible and is the exact address
  bound on the host. A typo here sends IPv6 users to nowhere.
- **After a server migration.** The A record gets updated; the AAAA record is
  often left pointing at the old machine. Check both.
- **Slow first page loads for some users.** A stale or unreachable AAAA
  record makes dual-stack clients try IPv6 first and fall back after a delay
  (Happy Eyeballs, RFC 8305). Users see a sluggish first connection.
- **Checking a CDN's dual-stack.** Many CDNs publish AAAA records only when
  IPv6 is enabled in the dashboard; the lookup shows whether it is.
- **Comparing with the A record.** The [A record guide](/blog/how-to-check-an-a-record)
  covers the IPv4 side; most domains should publish both.

## Tips and gotchas

- **An AAAA record is a promise.** Publish it only when the server listens on
  that address for every service the A record covers (HTTP, HTTPS, mail).
  Test the address with the [port checker](/port-checker) and
  [ping test](/ping-test), which run from WatchFor's locations.
- **Firewalls are configured per protocol.** A rule set that allows 443 on
  IPv4 doesn't automatically allow it on IPv6.
- **Certificates don't care about the address family**, but the virtual host
  configuration does: make sure the web server serves the site on the IPv6
  listener too.
- **Lookups work from any network.** Asking for AAAA records doesn't need
  IPv6 connectivity, so an empty result is a fact about the domain, not
  about the location that asked.
- **NAT64 hides missing AAAA records.** On many mobile networks, DNS64 makes
  an IPv4-only site look reachable over IPv6; your site still has no native
  IPv6 there.

## Check it from the command line too

The status line separates "no AAAA" from "no such domain":

```bash
dig AAAA github.com @1.1.1.1 | grep -E "status|ANSWER:"
```

```text
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 60711
;; flags: qr rd ra; QUERY: 1, ANSWER: 0, AUTHORITY: 1, ADDITIONAL: 1
```

`NOERROR` with `ANSWER: 0` is NODATA: the name exists, the record type
doesn't. A misspelt name would show `status: NXDOMAIN`. The domain does have
IPv4, and other domains do publish IPv6:

```bash
dig +noall +answer A github.com @1.1.1.1
dig +noall +answer AAAA wikipedia.org @1.1.1.1
```

```text
github.com.		6	IN	A	140.82.121.3
wikipedia.org.		58	IN	AAAA	2a02:ec80:300:ed1a::1
```

Whether a published address actually serves the site is a connection test,
not a DNS one: from a machine with IPv6, `curl -6` forces the request over
IPv6 (see `man curl`).

## Keep watching it

An AAAA record that changes, disappears or starts pointing at the wrong host
is easy to miss when you test from IPv4. A [DNS monitor](/dns-monitoring)
on the **AAAA** record type resolves it from several locations on a
schedule, and the **Expected DNS Records** rule (one address per line, such
as `2001:db8::1`) opens an incident when the published set stops matching.
The monitor's **Network Protocol** setting can also force IPv6 to reach a
custom resolver.

## FAQ

**How do I check if a website supports IPv6?**
Look up its AAAA record. If it returns an address, the site advertises IPv6;
then test that the address answers on port 443. No AAAA record means the site
is IPv4 only. [IPv4 vs IPv6](/blog/ipv4-vs-ipv6) explains the difference.

**What is the difference between an A and an AAAA record?**
Both map a name to an address: A records hold IPv4 addresses (32-bit, like
`140.82.121.3`), AAAA records hold IPv6 addresses (128-bit, like
`2a02:ec80:300:ed1a::1`). A dual-stack domain publishes both.

**Do I need an AAAA record?**
Not to be reachable: IPv6-only networks usually translate to IPv4. Publish
one when your server and network support IPv6 end to end; never publish one
that points at an address nothing listens on.

---

Canonical page: https://watchfor.io/blog/how-to-check-aaaa-records · All articles: https://watchfor.io/blog/all.md · Site guide: https://watchfor.io/llms.txt