Run a lookup
How it works
Paste the hostnames
Bare domains or full hostnames both work — mail and web often differ, so check the exact name you care about.
Query AAAA over DoH
The lookup runs from your browser against public resolvers, with no server in the middle.
Read the addresses
Every IPv6 address is listed with its TTL. An empty result means the host publishes no AAAA record at all.
Check the pair
Compare against the A record. Mismatched IPv4 and IPv6 endpoints are a classic cause of intermittent, hard-to-reproduce faults.
Why IPv6 matters for mail
For years IPv6 was something you could reasonably ignore on a sending setup. That has changed at the edges. Google accepts inbound mail over IPv6 and applies stricter authentication expectations to it than to IPv4 — mail arriving over IPv6 without passing SPF or DKIM is far more likely to be rejected outright rather than filtered. If a sending host has an AAAA record, some mail will take that path whether you planned for it or not.
The failure mode is specific and easy to miss. A server gets an IPv6 address from its provider by default, the operating system prefers IPv6 for outbound connections, and mail starts leaving from an address that was never added to your SPF record and has no reverse DNS. Authentication that passes perfectly on IPv4 fails on IPv6, and the pattern looks random from the outside because only some connections take that route.
What an empty result means
No AAAA record is not an error. Plenty of production infrastructure is IPv4-only by choice, and for a sending host that is often the simpler, safer configuration — one address family to authorise, one reverse DNS entry to maintain. What you want to avoid is the middle state, where IPv6 is half-configured: an address exists, traffic uses it, but SPF and PTR were only ever set up for IPv4.
Reading the result
Addresses starting 2606:4700 belong to Cloudflare, so a proxied domain will show Cloudflare's IPv6 space rather than your origin's. That is expected and tells you nothing about the server behind it — the domain host checker handles that question properly. For mail, the address you care about is the one your sending server actually connects from, which is not necessarily the one published for the website.
Frequently asked questions
Does my domain need an AAAA record?
Only if you want it reachable over IPv6. There is no penalty for being IPv4-only, and for a cold email sending host it is arguably the cleaner setup — fewer addresses to authorise and fewer places for reverse DNS to go missing. The problem is never the absence of IPv6, it is IPv6 that is present but unauthenticated.
Why does my AAAA record show a Cloudflare address?
Because the domain is proxied. Cloudflare publishes its own A and AAAA records and connects to your origin behind them. This is working as intended and hides the origin deliberately.
Should my SPF record include IPv6 addresses?
Yes, if your server sends over IPv6. Use the ip6: mechanism alongside ip4:. Forgetting this is the single most common cause of SPF passing on some messages and failing on others from the same host.
Do I need reverse DNS for IPv6?
For a sending host, yes. Major receivers check that the connecting IP resolves to a hostname and that the hostname resolves back. Missing PTR on IPv6 while IPv4 is configured correctly produces exactly the intermittent rejections that are hardest to diagnose.
Why do A and AAAA point to different servers?
Usually because the two were configured at different times and one was never updated. It is worth fixing — it means visitors and receivers get different infrastructure depending on their network, which makes any fault report unreproducible.
Last reviewed
What to run next
The checks that most often follow this one.
More in this category
Guides that go deeper
When the tools tell you something is wrong
The diagnostics here are free and always will be. When the fix is bigger than a DNS record, this is the work I do.
Deliverability rescue
Mail landing in spam, replies gone quiet, or a domain suddenly blocked. I find the actual cause rather than guessing, and fix it.
- Authentication and alignment failures
- Blocklist delistings and reputation repair
- Gateway and filter-level blocks
- A written report on what broke and why
Email & sending infrastructure
Sending domains, inboxes, authentication and warmup, built to survive volume instead of burning down in a month.
- Domain and inbox fleets at any scale
- SPF, DKIM, DMARC and tracking domains
- Google Workspace and Microsoft 365 inboxes
- Handover documentation you actually own
Domain, DNS & migration
Changing registrar, mail provider or host without a day of downtime or a week of mail silently failing.
- Registrar and nameserver moves
- Workspace and Microsoft 365 migrations
- MX, SSL and subdomain cutover
- Staged rollout with rollback at every step
Monitoring & retainer
Infrastructure drifts. Records get edited, certificates expire, domains get listed. Ongoing eyes on the fleet.
- Scheduled checks across every domain
- Alerts before your clients notice
- Monthly reporting
- Priority response when something breaks
Start with a call
Bring a domain and the symptom. I will tell you what is actually wrong and whether you need me at all — plenty of people leave that call able to fix it themselves.
Thirty minutes, no pitch
We will run the checks together on your actual domains, and you will leave knowing what is broken, what it takes to fix, and what it should cost. If that is a job you can do in-house, I will say so.