Skip to content
novasean.

DNS and email authentication

Diagnose a website that works on IPv4 but fails on IPv6

Find a stale AAAA record, test the site's IPv6 path and correct the assigned web target without disturbing IPv4.

By Team Novasean · Published · Updated

Recognise the symptom

Compare the live AAAA answer with the site's assigned IPv6 target before changing the record; an old AAAA can send some visitors to the wrong host.

A hostname can have both IPv4 A and IPv6 AAAA answers. If its old AAAA still points at a previous host, IPv6 visitors may see a different site or failure while IPv4 visitors succeed. Diagnose the web hostname, such as www.example.com, without changing mail records.

A browser error alone does not prove DNS is at fault. The same symptom can come from a web server that does not listen on IPv6, a firewall, a missing IPv6 TLS configuration or an application failure. Work through the checks before deleting a record.

Capture the intended targets and current records

Ask the hosting provider which IPv4 and IPv6 addresses, if any, are assigned to this website. Do not infer an IPv6 address from an IPv4 address. Record the current A and AAAA values, TTL and the provider that hosts the authoritative DNS zone. Check the exact hostname that fails: example.com and www.example.com can have different records. If www is a CNAME, follow its target rather than trying to add an A or AAAA beside that CNAME.

Before editing, save the existing values and a recent working configuration or provider instruction. If the site serves customers, arrange a change window and a way to reach the hosting service without relying on the affected hostname.

Compare IPv4 and IPv6 destinations

  1. Find the delegated nameservers with dig NS example.com +short. Query one actual authoritative server for both record types, for example dig @ns1.provider.example www.example.com A +noall +answer and the same command with AAAA. Replace the illustrative server with a real delegated nameserver.
  2. Compare with ordinary resolver answers: dig www.example.com A +short and dig www.example.com AAAA +short. A difference may simply be a cached old answer while its TTL runs out.
  3. From a machine with working IPv4 and IPv6 connectivity, run curl -4 -I https://www.example.com/ and curl -6 -I https://www.example.com/. Compare connection errors, certificate errors and HTTP responses. curl -6 failing because your own network has no IPv6 is inconclusive; try another known IPv6-capable network.

These commands inspect public answers and connection behaviour; they do not change records. Keep the hostname in the HTTPS request so the correct virtual host and certificate are tested.

For a site moved to a new IPv4 address, an old AAAA answer is a concrete mismatch: test the named site over IPv6 and expect the same intended application and certificate before keeping it.

Correct the cause you actually found

If the authoritative AAAA value is obsolete and the service has no IPv6 target, remove that AAAA record for the affected hostname at the authoritative DNS provider. Keep the correct A record. If the provider has assigned a working IPv6 address, replace the stale AAAA with that exact value only after confirming that the web service and TLS endpoint are configured for it. If both authoritative records are correct but curl -6 cannot connect, ask the host to check IPv6 routing, firewall rules and listener configuration. A TLS error calls for certificate and virtual-host checks, not a DNS guess.

Do not delete a whole zone or change nameservers to repair one record. A proxying DNS service may answer with its own addresses, so compare its documented public behaviour and origin configuration rather than assuming that its published address should equal the origin address.

Verify and recover

After a change, query the authoritative server again and then repeat both curl tests from a suitable network. Cached resolver answers can persist for the previous TTL; note when they expire rather than making repeated edits. Confirm both the apex and www if customers use both. If the site worsens, restore the recorded prior value and ask the DNS or hosting provider to examine the evidence. If you removed an obsolete AAAA, restoring it would recreate the IPv6 failure, so use the verified assigned target where available.

When requesting help, send the failing hostname, timestamps, authoritative A and AAAA answers, the two connection results and the provider’s assigned targets. Do not send panel passwords or private keys.

Common questions

Does every website need an AAAA record? No. Publish one only when the destination actually supports IPv6 for that hostname.

Why does my phone behave differently from my laptop? Networks may offer different IPv6 connectivity and may hold different cached DNS answers. Test both address families before assigning a cause.

Will deleting AAAA affect email? Deleting only the website hostname’s AAAA normally concerns that hostname. Inspect mail hostnames separately; never remove their address records as part of a web-only repair.

Does removing AAAA fix all IPv6 faults? It removes that address path; first confirm the new service has no intended IPv6 target.

Sources and technical references

Prepared by Team Novasean from the references above. Menus and available features depend on your installed version and service permissions.

Related guides

Was this guide helpful?

If you accepted optional analytics, your Yes/No answer and this guide’s page address are sent to Google Analytics. No written feedback is collected. Read our privacy statement or change your choice in .

Need help with your service?

Open your client area or contact Novasean. Describe the symptom and checks you have performed. Keep passwords, recovery codes and private keys out of your message.