DNS and IPv6 are related, but they are separate parts of the connection. DNS finds an address for a hostname; IPv6 is one way to carry traffic to that address. A device can contact its DNS resolver over IPv4, receive an IPv6 answer, then attempt the connection over IPv6. That attempt needs a usable IPv6 route from source to destination.
Keep three decisions separate: how the device reaches its resolver, which records DNS returns, and whether the selected destination address is reachable. Collapsing them into “IPv6 DNS” is how a configuration problem acquires a fog machine.
DNS and IPv6: three paths to separate
1. Resolver transport
A DNS resolver is the server a device asks to look up a name. Clients commonly ask a recursive resolver to perform the lookup rather than contacting authoritative servers themselves. The device can reach that resolver over IPv4 or IPv6.
That transport choice does not limit the answer type. A resolver reached over IPv4 can return an IPv6 address in an AAAA record.
Google, for example, documents IPv4 and IPv6 addresses for its public resolver service. Its documented IPv6 resolver addresses are 2001:4860:4860::8888 and 2001:4860:4860::8844. Those are addresses for reaching Google's resolver, not a requirement for looking up IPv6 destinations.
2. The DNS answer
An A record maps a hostname to an IPv4 address. An AAAA record maps a hostname to an IPv6 address. A dual-stack hostname can publish both records.
An IPv4 DNS query path and an IPv6 answer are therefore compatible. The transport used to ask the resolver is one choice; the address family in the returned record is another.
3. Destination connectivity
After DNS returns addresses, the operating system and network stack decide which address to attempt. AWS's IPv6 DNS whitepaper says many modern dual-stack operating systems prefer IPv6 when both A and AAAA records are available, while the exact choice belongs to the operating system and network stack.
For an IPv6 attempt to work, there must be an end-to-end IPv6-routable path between client and destination. AWS identifies a common dual-stack misconfiguration: a host resolves a name to an IPv6 address, but no such path exists. DNS returned the address correctly; the network still cannot carry the connection.
Check AAAA publication and IPv6 reachability separately
- Query the hostname's AAAA record. An IPv6 DNS lookup lists the AAAA records published for a domain.
- Check the authoritative DNS server after a change. MXToolbox says its IPv6 lookup queries the authoritative name server directly, so record changes should appear there without waiting on a cached response.
- Test an IPv6 connection from an IPv6-enabled network. A DNS answer establishes that an address was published. It does not establish an end-to-end route.
- When changing resolvers, record the old settings and test the new configuration. Google says DHCP commonly supplies an ISP's DNS-server addresses; using Google Public DNS requires explicitly changing the relevant device or operating-system settings.
The useful diagnosis order is: did DNS return the expected AAAA record, did the client select it, and could the client reach it?
IPv6 reverse DNS uses PTR records under ip6.arpa
Forward DNS starts with a name and returns an address. Reverse DNS starts with an IP address and uses a PTR record to map it to a domain name. IPv6 reverse mappings live beneath ip6.arpa.
The IPv6 address is represented as dot-separated hexadecimal digits in reverse order, followed by .ip6.arpa. Each hexadecimal digit is a four-bit nibble. For the documentation address 2001:db8:1234:1a00:1:2:3:4, the reverse name begins 4.0.0.0.3.0.0.0... and ends in .ip6.arpa.
Do you need an IPv6 DNS resolver?
No, not to obtain AAAA records. A reachable resolver contacted over IPv4 can return an IPv6 address. Configuring an IPv6 resolver address is relevant when the device should reach that resolver over IPv6; it does not establish IPv6 connectivity to other destinations.
Encrypted DNS is another separate setting. Google describes DNS-over-TLS as an optional privacy- and security-oriented feature for DNS messages between a device and Google's DNS servers. Its availability and configuration depend on the device or operating system.
Frequently asked questions
What is the difference between an A record and an AAAA record?
An A record maps a hostname to an IPv4 address. An AAAA record maps a hostname to an IPv6 address. A dual-stack hostname can publish both.
Can a DNS resolver reached over IPv4 return an IPv6 address?
Yes. A client can contact a resolver over IPv4 and receive an AAAA record containing an IPv6 address. Connecting to that destination over IPv6 still requires an end-to-end IPv6-routable path.
How does IPv6 reverse DNS work with PTR records and ip6.arpa?
A PTR record maps an IP address to a domain name. For IPv6, the address is represented as dot-separated hexadecimal digits in reverse order under the ip6.arpa domain.
Why can a dual-stack hostname fail when it has both A and AAAA records?
A hostname can resolve to an IPv6 address even when no end-to-end IPv6-routable path exists between client and destination. AWS describes this as a common dual-stack misconfiguration.
Sources
- Designing DNS for IPv6 — docs.aws.amazon.com
- Using DNS to estimate the worldwide state of IPv6 adoption — blog.cloudflare.com
- Get Started | Public DNS — developers.google.com
- DNS Lookup IPv6 — mxtoolbox.com
