Checks the site answers over IPv4 and IPv6, testing each IPv6 address
Host — takes the host name of the audited URL (only that host; example.com and www.example.com are audited separately). IP-address URLs are used as they are.
DNS — looks up the host's A (IPv4) and AAAA (IPv6) records, following CNAMEs.
Address check — flags AAAA records that point to addresses the internet cannot reach (loopback, link-local, unique local, IPv4-mapped, documentation, multicast).
IPv6 connection test — connects to up to four public AAAA addresses over IPv6 on the audited port (443 for https://, 80 for http://). For HTTPS it completes a TLS handshake for the host name and validates the certificate, exactly like a browser on an IPv6 network.
Self-check — when an AAAA address does not answer, the auditor also connects to Google and Cloudflare public DNS over IPv6. If those fail too, the problem is on the 37 Audits side and the result is an ERROR, never a FAIL for your site.
IPv4 reachability is judged from the A records only: every other 37 Audits auditor already reaches your site over IPv4. The auditor does not download the page.
Every row maps to one checkRule* method and one CheckCode, in the order the auditor evaluates them.
| CheckCode | Status | When it fires | Recommendation | Why it matters |
|---|---|---|---|---|
37A-Ipv6Auditor-500 | ERROR | DNS could not answer for the host, or the host has neither an A nor an AAAA record. | Check that {host} is published in DNS and its name servers answer, then run the audit again. Last error was "{error}". | — |
37A-Ipv6Auditor-501 | ERROR | The auditor's own network could not open an IPv6 connection: an AAAA address did not answer and neither did the reference addresses of Google and Cloudflare public DNS, so nothing is known about the site's IPv6. | This is a problem on the 37 Audits side, not on {host}. Run the audit again later; the error was "{error}". | — |
37A-Ipv6Auditor-400 | FAIL | An AAAA record points to an address that is not reachable from the internet (one check per address). | Replace the AAAA record {address} of {host} with the server's public IPv6 address, or remove it. | Browsers on IPv6 networks try this address first and must wait for it to fail before falling back, so the site loads slowly or not at all for those visitors. |
37A-Ipv6Auditor-401 | FAIL | The host has AAAA records but no A record (IPv6 only). | Add an A record for {host} so visitors on IPv4-only networks can reach the site. | Most internet users still connect over IPv4, so a site without an IPv4 address is unreachable for a large share of visitors. |
37A-Ipv6Auditor-402 | FAIL | An AAAA address did not accept a TCP connection on the audited port (timeout, refused or unreachable; one check per address). | Allow port {port} over IPv6 to {address} in the firewall, security group or load balancer, or remove the AAAA record of {host} until it answers. | Browsers on IPv6 networks try this address first; when it does not answer, pages load seconds late or not at all for those visitors. |
37A-Ipv6Auditor-403 | FAIL | An AAAA address accepted the connection but the TLS handshake or the certificate check for the host failed (one check per address). | Serve the same valid certificate for {host} on the IPv6 listener {address} as on IPv4. | Visitors who reach the site over IPv6 get a security warning or a failed connection instead of the page. |
37A-Ipv6Auditor-300 | WARNING | The host has A records but no AAAA record (IPv4 only). | Add an AAAA record for {host} (most CDNs and hosting providers enable IPv6 with one setting) so IPv6 networks reach the site directly. | A growing share of mobile and home networks are IPv6-first; without IPv6 their traffic goes through carrier translation, which adds latency and can fail. |
37A-Ipv6Auditor-200 | SUCCESS | All rules passed: the host has IPv4 and IPv6 addresses and every probed IPv6 address answered. | — | — |
This auditor never downloads the page, so it does not report the …-590 "site blocked" error that other auditors can return.
| Status | Description | Test logic |
|---|---|---|
| SUCCESS | The site is dual stack and its IPv6 works | At least one A and one AAAA record; every AAAA address is public; each probed AAAA address accepted the connection and, for HTTPS, completed a valid TLS handshake for the host. |
| WARNING | The site is IPv4 only | A records found, no AAAA record. |
| FAIL | IPv6 is published but broken, or IPv4 is missing | A non-public AAAA address, no A record, an AAAA address that refused or ignored the connection, or a failed TLS handshake over IPv6. FAIL wins over WARNING. |
| ERROR | The audit could not run | DNS did not answer or the host has no address at all (500), or the auditor itself had no IPv6 connectivity (501). An ERROR result is not charged. |
Browsers use "Happy Eyeballs": they try IPv6 first and fall back to IPv4 only after a delay, so a dead AAAA address adds latency to every new connection.
Clients on IPv6-only networks (some mobile carriers, NAT64 setups) may not fall back at all and cannot load the site.
A common cause is a firewall, security group or load balancer listener opened for IPv4 only after an AAAA record was added (often automatically by a CDN or host).
A large and rising share of traffic, especially mobile, arrives over IPv6. Without an AAAA record those visitors go through carrier IPv4 translation, which adds latency and is a shared point of failure.
Some government and enterprise procurement rules require IPv6 support.
The IPv6 listener must serve the same certificate and site as IPv4. A default virtual host on the IPv6 address shows visitors a certificate warning or the wrong site.
Only the audited host is checked. Audit both example.com and www.example.com if visitors use both.
Up to four AAAA addresses are probed per audit.
This documentation is built and hosted on Mintlify, a developer documentation platform.
Add this auditor to your monitoring setup and start identifying issues on your websites today.