Cybersecurity glossary
What is an AAAA Record?
Learn what a DNS AAAA record is, how it maps hostnames to IPv6 addresses, how dual-stack resolution works with A records, and which operational pitfalls to avoid.
Definition
An AAAA record is a DNS resource record that maps a domain name or hostname to one or more IPv6 addresses so dual-stack and IPv6-only clients can reach the correct host.
Why AAAA records matter
IPv6 adoption means many networks prefer or require 128-bit addressing. An AAAA record is how DNS publishes those destinations for named services. Without correct AAAA data, IPv6-capable clients may fall back awkwardly, fail, or never exercise the path operators intended to offer.
Publishing AAAA is not a checkbox. The address must reach a host that accepts traffic for that name, presents the right certificate, and matches firewall and load-balancer expectations.
What an AAAA record contains
Like an A record, an AAAA answer binds an owner name to address data—here a full IPv6 address—plus a TTL that governs caching.
Owner name
The hostname clients query, from www.example.com to API or mail endpoints.
IPv6 address
A 128-bit address such as 2001:db8::10 identifying the service front end.
TTL
How long recursive resolvers may reuse the AAAA answer before refreshing.
Dual-stack pairing
Often published next to A records so the same name works on IPv4 and IPv6.
Dual-stack resolution in practice
Client needs an address
An application resolves a hostname before opening a socket.
Ask for A and AAAA
Modern resolvers commonly request both record types for the same name.
Receive IPv6 answers
Authoritative servers return zero or more AAAA records from the zone.
Race usable paths
Happy Eyeballs-style logic tries IPv6 and IPv4 so a broken path does not stall forever.
Connect and authenticate
TLS and application protocols still bind to the hostname, not only the chosen IP version.
Cache independently
A and AAAA answers can expire on different schedules if TTLs differ.
AAAA vs A operational differences
| Topic | AAAA | A |
|---|---|---|
| Address family | IPv6 (128-bit) | IPv4 (32-bit) |
| Client impact if wrong | IPv6-preferring clients may fail first | IPv4-only and many fallback paths break |
| Common mistake | Publishing AAAA before the service is IPv6-ready | Leaving stale IPv4 targets after decommission |
| Security relevance | Hijack or dangling AAAA can redirect IPv6 traffic | Same class of risk for IPv4 traffic |
Checklist before enabling AAAA
- Confirm load balancers, firewalls, and WAF paths accept IPv6 for the service.
- Verify TLS certificates and virtual hosts respond correctly on the IPv6 listener.
- Test from native IPv6 networks, not only from dual-stack developer laptops.
- Align monitoring so IPv6 reachability failures page the same owners as IPv4.
- Keep AAAA inventory in sync with A inventory during migrations and CDN changes.
- Remove AAAA promptly when retiring IPv6 front ends to avoid blackholing clients.
- Treat unexpected AAAA changes as a security signal equal to unexpected A changes.
- Use consistent TTLs across A and AAAA when you want cutovers to move together.
Security notes
Forged or hijacked AAAA answers redirect IPv6 traffic just as forged A answers redirect IPv4. DNSSEC validation, registrar locks, and change monitoring apply equally. Dangling AAAA records that point at released cloud IPv6 resources can also contribute to takeover scenarios when another party obtains the address or associated service.
The practical takeaway
An AAAA record maps a hostname to IPv6. It enables dual-stack and IPv6-first clients to find your service without relying only on IPv4.
Enable AAAA when the path is real and monitored. Keep it accurate, pair it thoughtfully with A records, and retire it when the IPv6 front end disappears—otherwise DNS will confidently send users into a dead end.
Related security terms
A Record
The IPv4 counterpart that maps names to 32-bit addresses.
Domain Name System (DNS)
The naming system that publishes AAAA answers alongside other record types.
CNAME Record
An alias that eventually resolves to A or AAAA data.
TTL (Time to Live)
Controls how long resolvers cache AAAA answers.
HTTPS
Most web services that publish AAAA still terminate TLS for HTTPS clients.
Frequently asked questions
What is an AAAA record in simple terms?
An AAAA record tells clients which IPv6 address belongs to a hostname. It is the IPv6 version of the A record used for IPv4.
Why is it called AAAA?
The name reflects that an IPv6 address is four times the size of an IPv4 address (128 bits vs 32 bits), so four A’s are used as a mnemonic.
Should every website publish AAAA records?
Publish AAAA only when the service is actually reachable and correctly configured on IPv6. A broken AAAA answer can cause timeouts for IPv6-preferring clients.
Do clients query A and AAAA together?
Many modern stacks query both and apply Happy Eyeballs or similar logic to choose a working path quickly.
Can a name have both A and AAAA records?
Yes. Dual-stack names commonly publish both so IPv4-only and IPv6-capable clients can connect.
Does DNSSEC treat AAAA differently from A?
No. Both are ordinary resource records that can be signed and validated the same way in a DNSSEC-enabled zone.
What breaks when AAAA is wrong?
IPv6 clients may connect to the wrong host, fail TLS validation, or hang while preferring a dead IPv6 path over working IPv4.
References
Explore authoritative guidance and frameworks related to aaaa record.
Explore every security definition
Return to the glossary to search by term, alias, starting letter, or security category.