IPv6 Auditor

Resilience Auditor — checks that the site answers over both IPv4 and IPv6, and that its IPv6 address really works.

Resilience

Visitors on IPv4-only and IPv6-first networks both reach the site.

Performance

No slow fallback when a published IPv6 address does not answer.

The IPv6 Auditor tells you whether your site is IPv4 only, IPv6 only, or dual stack, and catches the most common IPv6 defect: an IPv6 address published in DNS that does not actually answer. Browsers try IPv6 first, so a broken IPv6 address makes the site slow or unreachable for visitors on IPv6 networks, even when IPv4 works perfectly.

How it works

Host — takes the host name of the audited URL (only that host; example.com and www.example.com are audited separately). IP-address URLs are used as they are.
DNS — looks up the host’s A (IPv4) and AAAA (IPv6) records, following CNAMEs.
Address check — flags AAAA records that point to addresses the internet cannot reach (loopback, link-local, unique local, IPv4-mapped, documentation, multicast).
IPv6 connection test — connects to up to four public AAAA addresses over IPv6 on the audited port (443 for https://, 80 for http://). For HTTPS it completes a TLS handshake for the host name and validates the certificate, exactly like a browser on an IPv6 network.
Self-check — when an AAAA address does not answer, the auditor also connects to Google and Cloudflare public DNS over IPv6. If those fail too, the problem is on the 37 Audits side and the result is an ERROR, never a FAIL for your site.

IPv4 reachability is judged from the A records only: every other 37 Audits auditor already reaches your site over IPv4. The auditor does not download the page.

What it audits

Every row maps to one checkRule* method and one CheckCode, in the order the auditor evaluates them.

CheckCode	Status	When it fires	Recommendation	Why it matters
`37A-Ipv6Auditor-500`	`ERROR`	DNS could not answer for the host, or the host has neither an A nor an AAAA record.	Check that `{host}` is published in DNS and its name servers answer, then run the audit again. Last error was “`{error}`”.	—
`37A-Ipv6Auditor-501`	`ERROR`	The auditor’s own network could not open an IPv6 connection: an AAAA address did not answer and neither did the reference addresses of Google and Cloudflare public DNS, so nothing is known about the site’s IPv6.	This is a problem on the 37 Audits side, not on `{host}`. Run the audit again later; the error was “`{error}`”.	—
`37A-Ipv6Auditor-400`	`FAIL`	An AAAA record points to an address that is not reachable from the internet (one check per address).	Replace the AAAA record `{address}` of `{host}` with the server’s public IPv6 address, or remove it.	Browsers on IPv6 networks try this address first and must wait for it to fail before falling back, so the site loads slowly or not at all for those visitors.
`37A-Ipv6Auditor-401`	`FAIL`	The host has AAAA records but no A record (IPv6 only).	Add an A record for `{host}` so visitors on IPv4-only networks can reach the site.	Most internet users still connect over IPv4, so a site without an IPv4 address is unreachable for a large share of visitors.
`37A-Ipv6Auditor-402`	`FAIL`	An AAAA address did not accept a TCP connection on the audited port (timeout, refused or unreachable; one check per address).	Allow port `{port}` over IPv6 to `{address}` in the firewall, security group or load balancer, or remove the AAAA record of `{host}` until it answers.	Browsers on IPv6 networks try this address first; when it does not answer, pages load seconds late or not at all for those visitors.
`37A-Ipv6Auditor-403`	`FAIL`	An AAAA address accepted the connection but the TLS handshake or the certificate check for the host failed (one check per address).	Serve the same valid certificate for `{host}` on the IPv6 listener `{address}` as on IPv4.	Visitors who reach the site over IPv6 get a security warning or a failed connection instead of the page.
`37A-Ipv6Auditor-300`	`WARNING`	The host has A records but no AAAA record (IPv4 only).	Add an AAAA record for `{host}` (most CDNs and hosting providers enable IPv6 with one setting) so IPv6 networks reach the site directly.	A growing share of mobile and home networks are IPv6-first; without IPv6 their traffic goes through carrier translation, which adds latency and can fail.
`37A-Ipv6Auditor-200`	`SUCCESS`	All rules passed: the host has IPv4 and IPv6 addresses and every probed IPv6 address answered.	—	—

This auditor never downloads the page, so it does not report the …-590 “site blocked” error that other auditors can return.

Output documentation

Status	Description	Test logic
SUCCESS	The site is dual stack and its IPv6 works	At least one A and one AAAA record; every AAAA address is public; each probed AAAA address accepted the connection and, for HTTPS, completed a valid TLS handshake for the host.
WARNING	The site is IPv4 only	A records found, no AAAA record.
FAIL	IPv6 is published but broken, or IPv4 is missing	A non-public AAAA address, no A record, an AAAA address that refused or ignored the connection, or a failed TLS handshake over IPv6. FAIL wins over WARNING.
ERROR	The audit could not run	DNS did not answer or the host has no address at all (`500`), or the auditor itself had no IPv6 connectivity (`501`). An ERROR result is not charged.

Risks and considerations

Broken IPv6 is worse than no IPv6

Browsers use “Happy Eyeballs”: they try IPv6 first and fall back to IPv4 only after a delay, so a dead AAAA address adds latency to every new connection.
Clients on IPv6-only networks (some mobile carriers, NAT64 setups) may not fall back at all and cannot load the site.
A common cause is a firewall, security group or load balancer listener opened for IPv4 only after an AAAA record was added (often automatically by a CDN or host).

IPv6 adoption keeps growing

A large and rising share of traffic, especially mobile, arrives over IPv6. Without an AAAA record those visitors go through carrier IPv4 translation, which adds latency and is a shared point of failure.
Some government and enterprise procurement rules require IPv6 support.

Certificates and virtual hosts

The IPv6 listener must serve the same certificate and site as IPv4. A default virtual host on the IPv6 address shows visitors a certificate warning or the wrong site.

Scope

Only the audited host is checked. Audit both example.com and www.example.com if visitors use both.
Up to four AAAA addresses are probed per audit.

Auditors

MCP Server

REST API

Resilience

Performance

How it works

What it audits

Output documentation

Risks and considerations

Broken IPv6 is worse than no IPv6

IPv6 adoption keeps growing

Certificates and virtual hosts

Scope

Resilience

Performance

​How it works

​What it audits

​Output documentation

​Risks and considerations

​Broken IPv6 is worse than no IPv6

​IPv6 adoption keeps growing

​Certificates and virtual hosts

​Scope

How it works

What it audits

Output documentation

Risks and considerations

Broken IPv6 is worse than no IPv6

IPv6 adoption keeps growing

Certificates and virtual hosts

Scope