IPv6 reachability

This is a note rather than a grade. It reports whether any of the domain's nameservers publish an AAAA record, and it is scored as information because an IPv4-only nameserver set is not broken — it is what a great deal of the internet still runs.

What it costs is directness. A resolver on an IPv6-only network cannot talk to an IPv4-only nameserver without a translation layer — NAT64 and DNS64, or a provider's equivalent — and those are extra hops, extra state, and one more thing between a visitor and an answer. IPv6-only access networks and IPv6-only container fabrics both exist in numbers now, and the root and every major TLD have been reachable over IPv6 for years.

There is a matching limitation on this end worth knowing about. When a nameserver publishes only an AAAA and this deployment has no IPv6 route, the probe is recorded as unknown rather than as a dead server. Grading our own missing route as your outage would be the worst kind of wrong answer, because nothing in the report would tell you it was ours.

On a managed provider this is usually already done and nothing is required — the address table in the evidence will show it.

If you run the servers, add AAAA records at the nameserver hostnames, and add IPv6 glue at the registrar where the nameservers sit inside the zone. Registries have accepted IPv6 glue for a long time.

Publish the AAAA last. A nameserver advertising an IPv6 address that it does not answer on is worse than one that never advertised: resolvers try it, wait, and fall back, so every query pays a timeout. Confirm the daemon is bound to the v6 address and that the firewall permits both UDP and TCP port 53 on it before the record goes in.