An incorrect AAAA record can send IPv6-capable visitors to an unavailable server while IPv4 visitors continue to work. Diagnose the address family separately before replacing working IPv4 records or changing nameservers.
IN THIS ARTICLE
Gather the details you will need
Identify whether the hostname is served directly by your origin or through a CDN. Record its A, AAAA and relevant proxy settings. Confirm the intended server has a working public IPv6 address, routing, firewall rules and HTTPS configuration.
01 Diagnose a website that fails only over IPv6 after an AAAA change
- Query the authoritative nameservers for the hostname's A and AAAA records. Compare the AAAA value with the IPv6 address allocated to this exact service.
- From a network with functioning IPv6, compare an HTTPS request forced to IPv4 with one forced to IPv6. Preserve the hostname so certificate and virtual-host checks remain meaningful.
- On the origin, check the web-server listener, IPv6 firewall and return route. A working IPv4 listener does not establish that the service also listens on IPv6.
- If the new AAAA points to the wrong destination, restore the recorded correct address. If IPv6 is not provisioned for this direct-origin hostname, remove only the erroneous AAAA until the service is ready.
- For a proxied hostname, diagnose the CDN edge and its origin connection separately. A CDN can provide IPv6 to visitors while reaching your origin over IPv4.
02 Read-only diagnostic example
dig example.com A +short
dig example.com AAAA +short
curl -4 -I https://example.com/
curl -6 -I https://example.com/Replace example names and documentation addresses with the exact authorised service details. These commands query existing configuration; they do not change DNS.
Confirm the expected result
Retest both address families from suitable networks after the previous TTL has expired. Check the correct site, certificate, login and an important form, not just a successful connection.
If the problem continues
A workstation without IPv6 connectivity will fail a forced IPv6 request even when the website is healthy. Compare a second known-working IPv6 destination and keep the failing address, response and timestamp for support.
A common question
Should I turn off IPv6 for every visitor to fix one bad AAAA record?
Correct the failing DNS or service configuration first. Removing a wrong direct-origin AAAA can be a controlled temporary step, but broadly disabling IPv6 may affect other working services and will not repair a CDN-to-origin problem.