AAAA record exists, but HTTPS over IPv6 fails

Separate IPv6 DNS publication, connectivity and TLS findings when diagnosing a dual-stack website.

All guides

Publication is not reachability

An AAAA record publishes an IPv6 address. It does not show that a server is listening on that address or that traffic can reach it. IPv4 and IPv6 can use different routes and different server configurations.

Read failures by stage

If the lookup fails, investigate DNS first. A connection timeout suggests a different investigation from an HTTP error or certificate-chain warning. An unavailable test provides incomplete evidence; it does not establish that IPv6 fails for every visitor.

Compare both IP versions

Use HTTP Status comparison to examine addresses, status codes and certificates for each family. Explicit IPv6 testing should remain IPv6-only. A successful IPv4 response must not be substituted for a failed IPv6 attempt.

Understand the boundary

The tools test requests rather than a full browser session. They do not load every image or execute the website’s JavaScript. Your own IPv6 connection is a separate question from the target website’s readiness.

Example

Illustrative dual-stack result
AAAA: 2001:db8::10 (documentation address)
HTTPS over IPv4: 200
HTTPS over IPv6: connection timed out
Conclusion: DNS publication exists; IPv6 HTTPS was not established.

What to check next

  1. Inspect the exact AAAA address in DNS Lookup.
  2. Run IPv6 Readiness, then compare IPv4 and IPv6 in HTTP Status.
  3. Review IPv6 routing, firewall rules and service listeners for the target. Check TLS separately when a connection succeeds.

References

Protocol reference: RFC 8200