DNS Tools
IPV6 DIAGNOSTICS

IPv6 Readiness Test

Test whether your site, mail servers and name servers publish IPv6 addresses and whether IPv6 reachability could be checked.

Run IPv6 readiness

No sign-up required. Public hosts and addresses only; results show what was observed, nothing is simulated.

What IPv6 readiness means here

IPv6 readiness has two parts that are easy to confuse: what DNS publishes and what actually works. This tool checks both, as far as it can. First it looks at AAAA records for the apex and www host, for each mail server named in MX, and for each authoritative name server. Then it looks at IPv6 glue for name servers inside the domain. Finally, if the scanner has IPv6 connectivity, it attempts a TCP connection to port 443 over IPv6 on the website's addresses.

How to read the results

The table lists each role (web, mail, DNS), the host name, and whether it has IPv4 and IPv6 addresses. The findings then interpret the pattern.

  • Website has AAAA: DNS publishes IPv6, but this alone does not prove the server answers over IPv6.
  • Website has no IPv6: optional. IPv6-only networks reach IPv4-only sites through translation, which can add latency, so it is an improvement, not a fault.
  • Mail servers: IPv4 delivery remains universal, so missing IPv6 on MX hosts is informational. If a server does send over IPv6, the sending IPs also need SPF coverage and a PTR record.
  • Name servers: if none has an AAAA, resolvers on IPv6-only networks cannot reach the zone directly. At least one IPv6 name server is recommended.
  • Glue: name servers inside the domain need address records at the parent. If AAAA exists in the zone but the referral shows no IPv6 glue, IPv6-only resolvers cannot find them.
  • Non-public AAAA: an AAAA that points at a private or reserved address is a real misconfiguration.

Reachability, and when it is not tested

A connection test can only be run if the machine performing the check has working IPv6. When this scanner has no IPv6 route, reachability is reported as not tested and the result is neither confirmed working nor broken. That is deliberately different from a failure. In that case you should test from an IPv6-capable network yourself with curl -6 https://example.com/ or an equivalent.

When the scanner does have a route and a published address refuses the connection, the tool reports it as an issue, because visitors who prefer IPv6 may hit it first.

Common problems

The most damaging IPv6 problem is a published AAAA record whose server does not listen on IPv6, or whose firewall blocks it. Browsers usually fall back to IPv4 after a delay, but some clients fail or stall. Others include IPv4 and IPv6 records pointing to different servers with different configuration, a CDN configured for IPv6 on only some hostnames, and mail servers that send over IPv6 without a PTR and SPF entry.

How to enable IPv6 safely

Prerequisites: IPv6 addresses from your provider or CDN, a web server and firewall configured to accept IPv6, and a way to test from an IPv6 network. Risk: publishing AAAA for a broken path makes some visitors fail. Rollback: remove the AAAA record; DNS caching means the removal takes up to the TTL to take effect, so use a short TTL beforehand.

  1. Obtain the IPv6 addresses and configure the server to listen on them with equivalent security rules to IPv4.
  2. Test directly, for example with curl -6 --resolve example.com:443:2001:db8::10 https://example.com/.
  3. Lower the TTL, then publish the AAAA record.
  4. For name servers inside your domain, ask the registrar to add IPv6 glue.
  5. Re-run this tool and test from an IPv6 network.

Limits

Published records are not working service, and the tool says so. Queries use the system resolver at one moment. Glue is read from a single parent-zone referral and covers only name servers inside the domain. Reachability is one TCP connection from one scanner, and only if the scanner has IPv6 connectivity.

Frequently asked questions

Is IPv6 required for my website?

No. It is optional today, and IPv4 works for nearly everyone. IPv6 helps visitors on IPv6-preferring or IPv6-only networks.

Why was reachability not tested?

The scanner needs IPv6 connectivity to test it. Without a route the tool reports not tested rather than failed.

What is IPv6 glue?

Address records for name servers that sit inside the domain they serve, stored at the parent zone so resolvers can find them.

Does an AAAA record mean my site works over IPv6?

No. It means DNS publishes an address. Connectivity depends on the server and firewall.

Do mail servers need IPv6?

No. Delivery over IPv4 is universal. If you enable it, SPF and PTR must cover the IPv6 sending addresses.

Why would an AAAA point to a private address?

Usually a copy-paste error or an internal record published externally. It cannot work for internet visitors.

Scope of this tool

  • Reachability is tested only if the scanner itself has IPv6 connectivity.

Written by DNS Tools editorial · Last updated 2026-10-09