DNS AAAA records (pronounced "quad-A records") are a fundamental component of IPv6 infrastructure, serving as the IPv6 equivalent of traditional A records. As the internet continues its transition from IPv4 to IPv6, understanding AAAA records has become essential for network administrators, developers, and anyone involved in web infrastructure management.
A DNS AAAA record maps a domain name to an IPv6 address. Defined in RFC 3596 (which obsoleted the original RFC 1886 from 1995), the AAAA record type stores a single 128-bit IPv6 address in the DNS system. The record type has an IANA-assigned value of 28 (decimal).
The primary purpose of AAAA records is to enable DNS resolution for IPv6-enabled hosts. When a client queries a domain name, the DNS resolver can request AAAA records to obtain the IPv6 address associated with that hostname, allowing the client to establish connections over IPv6 networks.
The fundamental difference between A and AAAA records lies in the address family they represent:
example.com → 192.0.2.1example.com → 2001:0db8:85a3:0000:0000:8a2e:0370:7334Both record types can coexist for the same domain name in what's known as a "dual-stack" configuration, allowing services to be accessible via both IPv4 and IPv6 simultaneously.
In standard BIND zone file format, AAAA records follow this structure:
$ORIGIN example.com.
@ 3600 IN AAAA 2001:0db8:85a3:0000:0000:8a2e:0370:7334
www 3600 IN AAAA 2607:f8b0:400a:800b::200e
ftp 86400 IN AAAA 2001:470:1f18:2bf::201
* 3600 IN AAAA 2602:ff13:0:8888::224
Each AAAA record consists of several components:
www, ftp, @ for root domain)3600 = 1 hour)IN (Internet)AAAA# Full format
www.example.org. 600 IN AAAA 2001:0dc8:86a4:0000:0000:7a2f:2360:2341
# Compressed IPv6 notation (leading zeros omitted, consecutive zero groups collapsed)
www.example.org. 600 IN AAAA 2001:dc8:86a4::7a2f:2360:2341
# Wildcard subdomain
*.example.org. 1800 IN AAAA 2600:1800:0::1
IPv6 addresses in AAAA records can be written in compressed form:
0db8 → db8::: 2001:0db8:0000:0000:0000:8a2e:0370:7334 → 2001:db8::8a2e:370:7334Modern browsers and operating systems implement sophisticated algorithms for resolving and connecting to dual-stack hosts. The primary mechanism is defined in RFC 8305, known as "Happy Eyeballs Version 2."
When a browser attempts to connect to a domain:
Parallel DNS Queries: The client sends both AAAA and A queries nearly simultaneously, with the AAAA query issued first, immediately followed by the A query.
Asynchronous Resolution: The client doesn't wait for both query types to complete before attempting connections. DNS resolution is treated as an asynchronous process to minimize delay.
Resolution Delay: If a positive AAAA response arrives first, the browser immediately attempts an IPv6 connection. If the A response arrives first due to network conditions, the client waits approximately 50 milliseconds for the AAAA response to ensure IPv6 preference.
Once DNS records are resolved:
IPv6 Preference: Modern operating systems prefer IPv6 when both A and AAAA records are returned, typically attempting the IPv6 connection first.
Concurrent Connection Attempts: Rather than waiting for timeouts, browsers attempt connections to both IPv4 and IPv6 addresses in parallel, using whichever succeeds first (Happy Eyeballs).
Fallback Behavior: If IPv6 connection attempts fail or timeout, the browser quickly falls back to IPv4, ensuring connectivity even when IPv6 infrastructure is broken or misconfigured.
A critical challenge in dual-stack deployments is "broken AAAA records"—DNS records containing seemingly valid IPv6 addresses that never respond to connection attempts. This can occur due to:
Happy Eyeballs mitigates this by racing connection attempts and falling back to working protocols quickly, minimizing user-visible delays.
In dual-stack environments, the query priority is:
Once addresses are resolved:
| Scenario | Behavior |
|---|---|
| AAAA exists, IPv6 works | Use IPv6 exclusively (preferred path) |
| AAAA exists, IPv6 broken | Fall back to IPv4 after timeout/failure |
| No AAAA record | Use IPv4 only |
| No A record | Use IPv6 only |
| Neither record exists | Connection fails |
All major DNS providers fully support AAAA records as of 2025:
{
"type": "AAAA",
"name": "www",
"content": "2001:db8::1",
"ttl": 3600,
"proxied": true
}
aws route53 change-resource-record-sets --hosted-zone-id Z123456 \
--change-batch '{
"Changes": [{
"Action": "CREATE",
"ResourceRecordSet": {
"Name": "www.example.com",
"Type": "AAAA",
"TTL": 300,
"ResourceRecords": [{"Value": "2001:db8::1"}]
}
}]
}'
Virtually all modern DNS hosting providers support AAAA records, including:
Ensure functional parity between IPv4 and IPv6:
Configure authoritative nameservers for dual-stack:
# Nameserver glue records must include both A and AAAA
ns1.example.com. IN A 192.0.2.1
ns1.example.com. IN AAAA 2001:db8:1::1
ns2.example.com. IN A 192.0.2.2
ns2.example.com. IN AAAA 2001:db8:2::1
Authoritative DNS servers must:
When delegating subdomains, ensure parent zones contain both A and AAAA glue records:
Before deploying AAAA records, validate:
# Good: Both protocols configured
example.com. IN A 192.0.2.1
example.com. IN AAAA 2001:db8::1
www.example.com. IN A 192.0.2.1
www.example.com. IN AAAA 2001:db8::1
# Bad: Inconsistent dual-stack (www missing AAAA)
example.com. IN A 192.0.2.1
example.com. IN AAAA 2001:db8::1
www.example.com. IN A 192.0.2.1
# Missing: www.example.com AAAA record
Validate AAAA record deployment using standard tools:
# Query AAAA records specifically
dig AAAA example.com
# Query all records
dig ANY example.com
# Test from specific nameserver
dig @8.8.8.8 AAAA example.com
# Trace delegation path
dig +trace AAAA example.com
# Verify IPv6 connectivity
ping6 example.com
traceroute6 example.com
Use online testing services to validate dual-stack configuration:
; Zone file for example.com
$ORIGIN example.com.
$TTL 3600
; Root domain
@ IN A 192.0.2.1
@ IN AAAA 2001:db8::1
; www subdomain
www IN A 192.0.2.1
www IN AAAA 2001:db8::1
; Mail server
mail IN A 192.0.2.10
mail IN AAAA 2001:db8::10
; MX record points to mail server
@ IN MX 10 mail.example.com.
; Primary domain with CDN AAAA
@ IN A 192.0.2.1
@ IN AAAA 2606:4700:10::1234
; www as CNAME to CDN (inherits both A and AAAA from CDN)
www IN CNAME cdn.example.com.
; CDN endpoint with dual-stack
cdn IN A 192.0.2.100
cdn IN AAAA 2606:4700:20::5678
; Multiple A and AAAA records for round-robin load balancing
@ IN A 192.0.2.1
@ IN A 192.0.2.2
@ IN A 192.0.2.3
@ IN AAAA 2001:db8::1
@ IN AAAA 2001:db8::2
@ IN AAAA 2001:db8::3
# Basic AAAA query
$ dig AAAA example.com +short
2001:db8::1
# Detailed query with all information
$ dig AAAA example.com
;; ANSWER SECTION:
example.com. 3600 IN AAAA 2001:db8::1
# Query specific nameserver
$ dig @ns1.example.com AAAA www.example.com
# Check both A and AAAA
$ dig example.com A example.com AAAA +short
192.0.2.1
2001:db8::1
For comprehensive dual-stack testing, visit test-ipv6.run to:
The test performs:
Symptoms: DNS resolves IPv6 address, but connections timeout
Causes:
Solution:
# Verify server is listening on IPv6
netstat -an | grep ':80.*LISTEN'
# Should show both [::]:80 (IPv6) and 0.0.0.0:80 (IPv4)
# Test local IPv6 connectivity
ping6 localhost
curl -6 http://[2001:db8::1]/
Symptoms: AAAA records resolve intermittently
Causes:
Solution:
# Verify all nameservers return AAAA
dig @ns1.example.com AAAA example.com
dig @ns2.example.com AAAA example.com
# Check glue records at parent
dig +trace AAAA example.com
Symptoms: IPv6 connections work but are slower than IPv4
Causes:
Solution:
ping6 -M do -s 1400 example.com)traceroute6AAAA records are essential infrastructure for the modern internet's transition to IPv6. Understanding their format, behavior, and best practices ensures robust dual-stack deployments that serve all users regardless of their network configuration.
Key takeaways:
As IPv6 adoption continues to grow globally, AAAA records will become increasingly important. Organizations should prioritize IPv6 enablement, starting with proper AAAA record configuration and validation.
Test your IPv6 configuration today at test-ipv6.run to ensure your infrastructure is ready for the IPv6 future.
Last updated: October 2025