Reference guide
What are A and AAAA records?
An A record ties a name to an IPv4 address, an AAAA record to an IPv6 address. It is the simplest link in DNS, and the one whose absence makes a site completely invisible.
7 min readUpdated September 12, 2026
In short
An A record says which IPv4 address a domain name answers on. An AAAA record does the same in IPv6. A name can carry both, several of each, or none. Without an A record, a browser on a network with no IPv6 has nowhere to go.
What A and AAAA are for
You do not reach a machine on the internet by its name, but by its address. DNS exists to make that translation, and A and AAAA records are where it is written down: a name on one side, a numeric address on the other. Everything else in DNS — aliases, mail servers, verification records — comes back to one of these two sooner or later.
The difference between them is the address format. IPv4 encodes an address in 32 bits, a little over four billion combinations, exhausted long ago. IPv6 uses 128 bits, which ends the shortage but gives you addresses that are longer to read and longer to type. The two protocols run side by side, and the same service is normally published in both.
In practice: publishing an IPv6 address is a bonus, publishing an IPv4 address is still mandatory. A visitor on a network with no IPv6 who finds no A record has no other way in.
A and AAAA, line by line
The same job, two formats. Seeing them side by side is what ends the confusion — and shows why one of them is not optional.
A
AAAA
- What it carries
- An IPv4 address, encoded in 32 bits.An IPv6 address, encoded in 128 bits.
- How it is written
- Four numbers from 0 to 255, separated by dots.Eight groups of four hexadecimal digits, separated by colons.
- An example
- 198.51.100.252001:db8:3c4d:15::1a2f:1a2b
- If it is missing
- The name is unreachable for nearly all traffic.The name stays reachable: the visitor falls back to IPv4 without noticing.
- If it is wrong
- The site is unreachable — or worse, shows somebody else's.Some visitors wait then switch over; the rest see the wrong machine.
- What to remember
- Still mandatory in practice, today.Recommended, but only when it points at a service that really answers.
Check your own domain, right now
Enter a domain name: the report reads its addresses, its certificate, its expiry and its mail authentication in one pass.
Three lines that make a site work
Here is the minimum a zone publishes for a site reachable with and without www, over IPv4 and IPv6.
example.com. 3600 IN A 198.51.100.25
example.com. 3600 IN AAAA 2001:db8:3c4d:15::1a2f:1a2b
www.example.com. 3600 IN A 198.51.100.25example.com.The name, here the root of the domainIt is called the apex. The name with nothing in front, the one people type naturally, and the only one where certain record types are forbidden.
3600The time to liveHow many seconds resolvers may hold on to this address. One hour here: a fix takes up to an hour to be seen everywhere.
AThe record typeWhat the line declares. A for an IPv4 address,
AAAAfor an IPv6 address — the name comes from the length, four times that of an IPv4 address.2001:db8:3c4d:15::1a2f:1a2bThe IPv6 address and its compressionThe double colon stands in for a run of zero groups. It can appear only once in an address; twice and there would be no telling how many groups it covers on each side.
www.example.com.A distinct name, not a variantTo DNS, www is a name in its own right. It inherits nothing published on the apex: it needs its own line, here an A record to the same machine.
The common setups and what they really do
A handful of combinations come up again and again, and two of them promise more than they deliver.
| Setup | What it does | What it does not do |
|---|---|---|
| A single A record | Sends all traffic to one machine. | Nothing at all once that machine stops answering. |
| Several A records on one name | The resolver returns every address and the client picks one, often the first. | This is not load balancing: nothing is checked, and a dead address is served like the others. |
| A and AAAA together | Lets the client choose its protocol; browsers try both and keep the faster one. | Does not excuse you from making both work: a dead IPv6 address costs the visitor seconds of waiting. |
| A on the apex, CNAME on www | The commonest setup. One place to change the day the address moves. | The CNAME cannot replace the apex A record: that spot is off limits to it. |
| A wildcard on the zone | Answers for every name not explicitly defined. | Protects nothing: it hides typos and makes any diagnosis far more confusing. |
| AAAA with no IPv6 service | Nothing good. | Does not fall back instantly: the visitor waits for the attempt to fail first. |
The mistakes that make a site unreachable
The site answers on www but not without www
What causes it: Only one of the two names carries a record. DNS makes no connection between them: they are two unrelated names.
What fixes it: Publish both — an address on the apex, an address or alias on www — and redirect one to the other on the web server.
Some visitors find the site very slow
What causes it: An IPv6 address is published for a machine that is not listening on IPv6. The browser tries, waits, then falls back to IPv4.
What fixes it: Remove the
AAAArecord, or make the service listen on IPv6. Publishing an address that does not answer is worse than publishing nothing.The host changed address and the site points nowhere
What causes it: Someone copied the address into the zone by hand. Nothing ties that record to the server it names: when the address changes, nobody is told.
What fixes it: When the host gives you a name rather than an address, use an alias on subdomains: it follows the changes on its own.
Two addresses published as a backup
What causes it: Someone expects an automatic failover DNS cannot do. The client picks at random and may well land on the machine that is down.
What fixes it: Use a service that monitors the machines and pulls the ones that stop answering, or accept that this setup is only a rough split.
The questions that come next
Is publishing an AAAA record really necessary?
Worth doing as soon as the hosting genuinely supports it, and best left alone until then. The bad case is not missing IPv6, it is an IPv6 address published for a service that does not answer.
Can an A record go on the root of the domain?
Yes, with no restriction. It is in fact the only simple way to make a domain answer without www, since an alias is forbidden there.
How many addresses can one name carry?
As many as you like, in A as in AAAA. The resolver returns them all and the client chooses. Bear in mind that the choice takes no account of whether the machines are actually up.
Why the name AAAA?
Because an IPv6 address takes four times the space of an IPv4 address. The type carries the original letter four times over — a convention, not an acronym.
An address that changes tells nobody
A migrated server, a reassigned address, a zone reimported: as far as DNS is concerned the record is still valid, and it points nowhere. DomainVigil queries every domain you own each day and emails you the moment an answer changes.
Start for freeFive domains free, forever. No card required.
The other reference guides
- SPF: the list of servers allowed to send mail as your domain
- DKIM: the signature that travels with the message
- DMARC: the rule that says what to do when SPF and DKIM fail
- DNSSEC: signed DNS answers, and what it costs when they break
- CAA: the list of authorities allowed to issue your certificates
- TTL: how long a DNS answer stays in cache
- CNAME: the DNS alias, and the four things it cannot do
- MX: where a domain's mail goes, and in what order
- WHOIS and RDAP: reading a domain's registration record
- The certificate chain: three links, and the one people forget
- HSTS: forcing HTTPS, and the trap on the way back