How it works
IPv6 (RFC 8200) replaces the scarce IPv4 address space: an address has 128 bits instead of 32 and is written in hex, such as 2001:db8::1. In DNS it lives in an AAAA record, just as an IPv4 address lives in an A record.
When a hostname has both, modern clients usually prefer IPv6 and fall back to IPv4 after a short delay (“Happy Eyeballs”, RFC 8305). Many mobile carriers already run IPv6-only internally and reach IPv4-only destinations through translation services such as NAT64.
For a website, an AAAA record is a promise. As soon as it is in DNS, visitors send requests to that address too, and the same web server with the same certificate has to answer there as it does over IPv4.
Why it matters
Having no IPv6 at all is still harmless today. The real problem is an AAAA record with nothing listening behind it, typically after a server move where only the A record got updated, or when a firewall blocks IPv6. Clients with IPv6 then time out or wait until they fall back to IPv4, while every IPv4-only test stays green.
A redirect to a target without an AAAA record is just as sneaky: the homepage answers over IPv6, but the actual page behind it is unreachable for IPv6-only clients.
How to prevent it
- Always manage A and AAAA records together, and put both on the checklist for every server or hosting migration.
- After adding the record, confirm that the web server actually listens on the IPv6 address (in nginx, listen [::]:443 ssl) and that the firewall lets IPv6 through.
- Remove an AAAA record as soon as the address is no longer served instead of leaving it in place until someone sorts it out.
- Make sure redirect targets such as www or a shop host have AAAA records too whenever the homepage offers IPv6.
- Test from outside over IPv6 specifically, for example with curl -6 -I https://example.com/.
How DomainWarn detects it
The IPv6 check looks up the AAAA records of every monitored website each hour and requests the page over each individual IPv6 address. An address that does not answer or returns a 5xx error is a warning; if that lasts longer than the configured failure duration, DomainWarn opens the incident “Website broken over IPv6”. A redirect over IPv6 to a target without AAAA records produces an informational note, and so does a site with no AAAA records at all.
Before raising a finding, DomainWarn verifies its own IPv6 path against reference targets; without an IPv6 route at the probe location the run ends without a result rather than blaming the website. The monitor only exists when the operator has enabled IPv6. The free Domain Check lists the AAAA records even without an IPv6 route and deducts no points for missing IPv6.
DomainWarn checks this for all your domains on a schedule and alerts you when something is missing or changes.