Ipv6 · XB Field Notes

AAAA records publish IPv6 addresses without proving reachability

Thu, 30 Dec 2027 00:00:00 +0000

An AAAA resource record contains one 128-bit IPv6 address. An A record contains an IPv4 address. A name may have either type, both types, or several addresses within each type. These are separate RRsets, so A and AAAA can have different TTLs. Publishing AAAA makes an address discoverable through DNS; it does not create an interface, route, listener, or working application.

When it breaks

A successful AAAA lookup can lead to a failed connection. The published address may be obsolete, the service may listen only on IPv4, or the path may lack usable IPv6 routing. Firewall rules and TLS configuration can also differ between families. An IPv4-only availability check can miss the problem while dual-stack users experience delays or failures through the advertised IPv6 path.

Happy Eyeballs reduces some dual-stack connection delays by coordinating address discovery and connection attempts. It is a client algorithm, not a DNS guarantee that every client implements. Fallback behavior, deadlines, and application protocols still matter. Publishing a broken AAAA is therefore not automatically harmless merely because a particular browser quickly succeeds through an A record during one test.

Missing AAAA also needs precise language. An authoritative A-only name can produce a successful DNS response with no AAAA data, commonly called NODATA. That differs from NXDOMAIN, which reports a nonexistent name. An A-only service is not categorically unreachable from every IPv6-only network: DNS64 can synthesize AAAA answers for use with NAT64 translation when that infrastructure and its requirements are present.

Check it quickly

Save the script as check-aaaa.py and run python3 check-aaaa.py with Docker available. The pinned environment uses BIND 9.18.49 and dnspython 2.3.0. Its isolated network contains working IPv6 loopback but no external route. The program starts a real HTTP listener on ::1 and performs both DNS queries and a separate IPv6 connection:

from pathlib import Path
from tempfile import TemporaryDirectory
import json,subprocess,uuid
recipe='FROM python@sha256:528257d48c1da0dcecc2e725d1ae34498d60c965f1241e39cd6a85a8859bdf84\nRUN apt-get update && apt-get install -y --no-install-recommends bind9=1:9.18.49-1~deb12u2 bind9-dnsutils=1:9.18.49-1~deb12u2 dnsmasq-base=2.90-4~deb12u2 python3-dnspython=2.3.0-1 && rm -rf /var/lib/apt/lists/*\nCMD ["/usr/bin/python3"]\n'
program=r"""
from contextlib import ExitStack,contextmanager
from pathlib import Path
from tempfile import TemporaryDirectory
import json,re,signal,subprocess,time
import dns.exception,dns.message,dns.query,dns.rcode,dns.rdatatype

def run(*args,check=True):
 result=subprocess.run(args,capture_output=True,text=True,timeout=15)
 if check:assert result.returncode==0,(args,result.returncode,result.stdout,result.stderr)
 return result
def query(name,kind='A',port=1053):
 return dns.query.udp(dns.message.make_query(name,kind),'127.0.0.1',port=port,timeout=1)
def values(response,kind='A'):
 wanted=dns.rdatatype.from_text(kind)
 return [item.to_text() for rrset in response.answer if rrset.rdtype==wanted for item in rrset]
def show(response):
 def section(records):return [{'name':str(rr.name),'type':dns.rdatatype.to_text(rr.rdtype),'ttl':rr.ttl,'data':[item.to_text() for item in rr]} for rr in records]
 return {'rcode':dns.rcode.to_text(response.rcode()),'answer':section(response.answer),'authority':section(response.authority)}
def wait(predicate,timeout=15):
 deadline=time.monotonic()+timeout
 while time.monotonic()<deadline:
 try:
 if predicate():return
 except (OSError,dns.exception.Timeout):pass
 time.sleep(.05)
 raise AssertionError('DNS fixture condition did not become true')
def stop(process):
 if process.poll() is None:
 process.terminate()
 try:process.wait(timeout=5)
 except subprocess.TimeoutExpired:process.kill();process.wait(timeout=5)

@contextmanager
def lab(records,soa_ttl=8,minimum=4,extra=''):
 with TemporaryDirectory(prefix='xbcatm-dns-') as directory,ExitStack() as stack:
 root=Path(directory);zone=root/'zone';conf=root/'named.conf';log=root/'named.log';serial=1
 def save(body):
 zone.write_text(f'$ORIGIN lab.test.\n$TTL 30\n@ {soa_ttl} IN SOA ns.lab.test. hostmaster.lab.test. ({serial} 60 60 3600 {minimum})\n@ IN NS ns.lab.test.\nns IN A 127.0.0.1\n'+body+'\n')
 run('named-checkzone','lab.test',str(zone))
 save(records)
 conf.write_text(f'''options {{ directory "{root}"; listen-on port 1053 {{127.0.0.1;}}; listen-on-v6 {{none;}};
recursion no; dnssec-validation no; notify no; querylog yes; max-cache-size 8m; pid-file "{root}/named.pid"; session-keyfile none;
{extra} }};
controls {{}};
zone "lab.test" {{ type primary; file "{zone}"; }};
''')
 run('named-checkconf',str(conf))
 output=stack.enter_context(log.open('w'))
 authority=subprocess.Popen(['named','-g','-c',str(conf),'-n','1','-U','1'],stdout=output,stderr=subprocess.STDOUT)
 stack.callback(stop,authority)
 def ready():
 assert authority.poll() is None,log.read_text()
 response=query('lab.test.','SOA');return response.rcode()==0 and response.answer[0][0].serial==serial
 wait(ready)
 def update(body):
 nonlocal serial
 serial+=1;save(body);authority.send_signal(signal.SIGHUP);wait(ready)
 def cache(port=1054,upstream=1053,size=150,options=()):
 logfile=root/('cache-'+str(port)+'.log');stream=stack.enter_context(logfile.open('w'))
 command=['dnsmasq','--no-daemon','--conf-file=/dev/null','--no-resolv','--no-hosts','--bind-interfaces',
 '--listen-address=127.0.0.1','--port='+str(port),'--server=127.0.0.1#'+str(upstream),
 '--cache-size='+str(size),'--log-queries','--log-facility=-',*options]
 process=subprocess.Popen(command,stdout=stream,stderr=subprocess.STDOUT);stack.callback(stop,process)
 def cache_ready():
 assert process.poll() is None,logfile.read_text()
 return query('lab.test.','SOA',port).rcode()==0
 wait(cache_ready);return process,logfile
 def queries(name,kind='A'):
 return sum(bool(re.search(r'query: '+re.escape(name.rstrip('.'))+r' IN '+kind+r'\b',line)) for line in log.read_text().splitlines())
 yield root,update,cache,queries
from http.server import BaseHTTPRequestHandler,ThreadingHTTPServer
import http.client,socket,threading
records='dual 17 IN A 127.0.0.1\ndual 29 IN AAAA ::1\nv4-only 17 IN A 127.0.0.1\nbroken 29 IN AAAA 2001:db8::1234'
class Handler(BaseHTTPRequestHandler):
 def log_message(self,*args):pass
 def do_GET(self):
 body=b'IPv6 response';self.send_response(200);self.send_header('Content-Length',str(len(body)));self.end_headers();self.wfile.write(body)
class V6Server(ThreadingHTTPServer):address_family=socket.AF_INET6
with lab(records) as (_,update,cache,queries),V6Server(('::1',0),Handler) as server:
 thread=threading.Thread(target=server.serve_forever,daemon=True);thread.start()
 try:
 a=query('dual.lab.test.','A');aaaa=query('dual.lab.test.','AAAA')
 assert values(a)==['127.0.0.1'] and values(aaaa,'AAAA')==['::1']
 assert a.answer[0].ttl==17 and aaaa.answer[0].ttl==29
 address=values(aaaa,'AAAA')[0];assert len(socket.inet_pton(socket.AF_INET6,address))==16
 client=http.client.HTTPConnection(address,server.server_port,timeout=2)
 client.request('GET','/');reply=client.getresponse();body=reply.read();client.close()
 assert reply.status==200 and body==b'IPv6 response'
 only_a=query('v4-only.lab.test.');assert values(only_a)==['127.0.0.1']
 missing=query('v4-only.lab.test.','AAAA');assert missing.rcode()==0 and missing.answer==[]
 assert len(missing.authority)==1 and missing.authority[0].rdtype==dns.rdatatype.SOA
 broken=query('broken.lab.test.','AAAA');assert values(broken,'AAAA')==['2001:db8::1234']
 unreachable=socket.socket(socket.AF_INET6);unreachable.settimeout(.3)
 try:unreachable.connect(('2001:db8::1234',server.server_port));raise AssertionError('documentation address unexpectedly reachable')
 except OSError as error:failure=type(error).__name__
 finally:unreachable.close()
 print(json.dumps({'A':show(a),'AAAA_over_IPv4_DNS':show(aaaa),'IPv6_HTTP_status':reply.status,
 'AAAA_wire_address_bytes':16,'A_only_AAAA_query':show(missing),'published_but_unreachable':{'answer':show(broken),'connect_error':failure}},sort_keys=True))
 finally:server.shutdown();thread.join(timeout=2)
"""
name='xbcatm-dns-'+uuid.uuid4().hex[:10]
def docker(*args,**kwargs):return subprocess.run(['docker',*args],capture_output=True,text=True,timeout=300,**kwargs)
try:
 with TemporaryDirectory(prefix=name+'-') as directory:
 root=Path(directory);(root/'Dockerfile').write_text(recipe)
 built=docker('build','-t',name,str(root));assert built.returncode==0,built.stderr
 result=docker('run','--rm','-i','--name',name,'--network','none','--memory','384m','--pids-limit','128',name,
 '/usr/bin/python3','-',input=program)
 assert result.returncode==0,result.stderr
 print(json.dumps(json.loads(result.stdout),sort_keys=True))
finally:
 docker('rm','-f',name);docker('image','rm',name)

The name dual.lab.test returns A 127.0.0.1 with TTL 17 and AAAA ::1 with TTL 29. Both DNS queries travel to an IPv4 DNS socket at 127.0.0.1. Receiving AAAA over that socket demonstrates that the address family described by the record is independent of the transport carrying the DNS question and answer.

The program converts the AAAA text into its packed form and checks that it occupies 16 bytes. It then uses the returned IPv6 address to request the local HTTP service. The recorded response is status 200 with the expected body. This verifies a usable IPv6 loopback connection for the selected address, rather than treating the existence of an AAAA record as the application test.

Querying AAAA for v4-only.lab.test returns NOERROR, no answer RRset, and an SOA in the authority section. The name still has its A record. Meanwhile, broken.lab.test successfully returns the documentation address 2001:db8::1234; connecting to it fails in this isolated environment. The result deliberately separates positive DNS data from transport success without sending test traffic to a real external host.

Check each advertised family through the service

Before publishing an IPv6 address, establish the listener, route, access rules, and application behavior. Test the hostname with its normal identity and test the individual advertised endpoints. A raw-address HTTP success does not validate hostname-based TLS or virtual-host routing. The example verifies local HTTP only; it neither demonstrates public IPv6 connectivity nor evaluates a client’s Happy Eyeballs implementation.

Keep both RRsets in monitoring and deployment records. Removing AAAA stops new authoritative answers but does not invalidate addresses already cached by clients. Existing connections have their own lifetimes. During a move, retain the old IPv6 service for the intended overlap and compare authoritative data with the recursive resolver used by affected clients before attributing every old connection to a stale DNS answer.

Finally, AAAA is forward address data, despite occasional descriptions calling it an IPv6 pointer. Reverse lookup uses PTR records under ip6.arpa, with reversed hexadecimal nibbles derived from the address. Publishing forward AAAA does not automatically publish that reverse record. Treat forward lookup, reverse naming, address selection, and successful application traffic as related checks with distinct configurations and observable outcomes.

Sources

RFC 3596 DNS extensions for IPv6, AAAA address data, transport independence, and ip6.arpa reverse names, checked 2026-09-12.
RFC 6147 DNS64, synthesized AAAA records for access to IPv4 servers, checked 2026-09-12.
RFC 8305 Happy Eyeballs version 2, client address selection and connection attempts, checked 2026-09-12.

IPv6 routers report oversized packets; sources decide how to fit the path

Wed, 06 Oct 2027 00:00:00 +0000

An IPv6 router does not fragment a packet while forwarding it toward its destination. If the packet is too large for the next link, the router normally discards it and sends ICMPv6 Packet Too Big feedback. The source can then adjust its packet size or, where appropriate, send fragments using the IPv6 Fragment header. Reassembly of those fragments takes place at the destination.

When it breaks

Assuming a router will split an oversized IPv6 packet hides a size-dependent failure. A small echo request can work while a larger one fails, even when both use the same addresses and route. The endpoint’s local interface may support the original size while an intermediate link does not. Check the entire path constraint rather than concluding that a configured 1500-byte interface guarantees that size end to end.

Missing Packet Too Big feedback makes it harder for classic discovery to learn that constraint. Fragment filtering or losing one fragment can also prevent successful reassembly. The ability to generate a Fragment header does not establish that every network policy will permit the resulting packets. Avoid treating source fragmentation as a universal substitute for correct path sizing and the required control traffic.

The reverse direction has its own path estimate. Learning the request path’s MTU does not automatically teach the responder how to size a large reply. A two-way echo test therefore needs both directions understood. TCP segmentation is also distinct from IP fragmentation: a TCP sender can form smaller segments after learning a path constraint without fragmenting each IP packet.

Check it quickly

Save this as check-ipv6-fragmentation.py and run python3 check-ipv6-fragmentation.py with Docker. The disposable environment uses Python 3.11.16, iproute2 6.1.0, iputils ping, and tcpdump 4.99.3, tested on Linux 6.12.76. NET_ADMIN and SYS_ADMIN support four nested namespaces. Two routers and two endpoints use newly created veth links without modifying host interfaces or routes:

from pathlib import Path
from tempfile import TemporaryDirectory
import subprocess,json,uuid
recipe='FROM python@sha256:528257d48c1da0dcecc2e725d1ae34498d60c965f1241e39cd6a85a8859bdf84\nRUN apt-get update && apt-get install -y --no-install-recommends iproute2=6.1.0-3 iputils-ping=3:20221126-1+deb12u1 nftables=1.0.6-2+deb12u2 tcpdump=4.99.3-1 traceroute=1:2.1.2-1 procps=2:4.0.2-3 && rm -rf /var/lib/apt/lists/*\nCMD ["python3"]\n'
program=r"""
from contextlib import ExitStack,contextmanager
from pathlib import Path
from tempfile import TemporaryDirectory
import json,os,select,signal,subprocess,time
def run(*args,check=True,input=None,timeout=8):
 result=subprocess.run(args,input=input,capture_output=True,text=True,timeout=timeout)
 if check:assert result.returncode==0,(args,result.returncode,result.stdout,result.stderr)
 return result
def ns(name,*args,**kwargs):return run('ip','netns','exec',name,*args,**kwargs)
def ip(name,*args,**kwargs):return ns(name,'ip',*args,**kwargs)
def stop(process):
 if process.poll() is None:
 process.terminate()
 try:process.wait(timeout=2)
 except subprocess.TimeoutExpired:process.kill();process.wait(timeout=2)
def spawn(stack,command):
 process=subprocess.Popen(command,stdin=subprocess.PIPE,stdout=subprocess.PIPE,stderr=subprocess.PIPE,text=True)
 stack.callback(stop,process);return process
def line(process,timeout=3):
 assert select.select([process.stdout],[],[],timeout)[0],'child response deadline exceeded'
 value=process.stdout.readline();assert value,process.stderr.read();return value
@contextmanager
def lab():
 with TemporaryDirectory(prefix='mtu-path-') as directory,ExitStack() as stack:
 root=Path(directory);proc=root/'proc';proc.mkdir();run('mount','-t','proc','proc',str(proc));stack.callback(run,'umount',str(proc))
 for name in ['client','r1','r2','target']:
 run('ip','netns','add',name);stack.callback(run,'ip','netns','delete',name,check=False);ip(name,'link','set','lo','up')
 def setting(name,key,value):
 assert name in ['client','r1','r2','target']
 path=proc/'sys'/key.replace('.','/')
 ns(name,'python3','-c',f'from pathlib import Path; p=Path({str(path)!r});p.write_text({str(value)!r});assert p.read_text().strip()=={str(value)!r}')
 yield root,stack,setting
def topology(setting,ipv6=False):
 links=[('client','c0','r1','a0',1,2,1,1500),('r1','a1','r2','b0',2,1,2,1280),('r2','b1','target','t0',3,1,2,1500)]
 for left,left_if,right,right_if,network,left_host,right_host,mtu in links:
 run('ip','link','add',left_if,'type','veth','peer','name',right_if)
 for name,interface,host in [(left,left_if,left_host),(right,right_if,right_host)]:
 run('ip','link','set',interface,'netns',name);ip(name,'link','set',interface,'mtu',str(mtu))
 address=f'2001:db8:{network}::{host}/64' if ipv6 else f'10.210.{network}.{host}/30'
 ip(name,'addr','add',address,'dev',interface,*(['nodad'] if ipv6 else []));ip(name,'link','set',interface,'up')
 family='-6' if ipv6 else '-4'
 for name in ['r1','r2']:setting(name,'net.ipv6.conf.all.forwarding' if ipv6 else 'net.ipv4.ip_forward',1)
 routes=[('client','default','2001:db8:1::1' if ipv6 else '10.210.1.1'),('target','default','2001:db8:3::1' if ipv6 else '10.210.3.1'),
 ('r1','2001:db8:3::/64' if ipv6 else '10.210.3.0/30','2001:db8:2::2' if ipv6 else '10.210.2.2'),
 ('r2','2001:db8:1::/64' if ipv6 else '10.210.1.0/30','2001:db8:2::1' if ipv6 else '10.210.2.1')]
 for name,destination,gateway in routes:ip(name,family,'route','add',destination,'via',gateway)
 if ipv6:
 deadline=time.monotonic()+4
 while any('tentative' in ip(name,'-6','address','show').stdout for name in ['client','r1','r2','target']):
 assert time.monotonic()<deadline,'IPv6 link-local DAD did not finish';time.sleep(.02)
def nft(name,script):return ns(name,'nft','-f','-',input=script)
def counters(name):
 result={}
 for item in json.loads(ns(name,'nft','-j','list','ruleset').stdout)['nftables']:
 rule=item.get('rule',{})
 if 'comment' in rule:
 for expression in rule['expr']:
 if 'counter' in expression:result[rule['comment']]=expression['counter']['packets']
 return result
def capture(stack,root,name,interface,expression,label):
 path=root/(label+'.pcap')
 process=subprocess.Popen(['ip','netns','exec',name,'tcpdump','--immediate-mode','-Z','root','-U','-n','-i',interface,'-w',str(path),expression],stdout=subprocess.DEVNULL,stderr=subprocess.PIPE,text=True)
 stack.callback(stop,process);deadline=time.monotonic()+3
 while time.monotonic()<deadline:
 assert process.poll() is None,'capture exited'
 if select.select([process.stderr],[],[],.1)[0] and 'listening on' in process.stderr.readline():return process,path
 raise AssertionError('capture did not become ready')
def captured(process,path):
 process.send_signal(signal.SIGINT);_,diagnostic=process.communicate(timeout=3);assert process.returncode==0,diagnostic
 return run('tcpdump','-nn','-vv','-r',str(path)).stdout

with lab() as (root,stack,setting):
 topology(setting,ipv6=True);target='2001:db8:3::2'
 small=ns('client','ping','-6','-n','-c','1','-W','1','-s','32',target);assert small.returncode==0
 tap,path=capture(stack,root,'client','c0','ip6','too-big')
 large=ns('client','ping','-6','-n','-M','do','-s','1400','-c','1','-W','1',target,check=False)
 feedback=captured(tap,path);assert large.returncode!=0 and 'too big' in feedback.lower(),(large.stdout,large.stderr,feedback)
 route=ip('client','-6','route','get',target).stdout;assert 'mtu 1280' in route,route
 reverse=ns('target','ping','-6','-n','-M','do','-s','1400','-c','1','-W','1','2001:db8:1::2',check=False)
 reverse_route=ip('target','-6','route','get','2001:db8:1::2').stdout
 assert reverse.returncode!=0 and 'mtu 1280' in reverse_route,(reverse.stdout,reverse.stderr,reverse_route)
 tap,path=capture(stack,root,'client','c0','ip6 and src 2001:db8:1::2','source-fragments')
 fragmented=ns('client','ping','-6','-n','-M','dont','-s','2000','-c','1','-W','2',target,check=False)
 trace=captured(tap,path);assert fragmented.returncode==0,(fragmented.stdout,fragmented.stderr,trace)
 assert 'frag (' in trace and trace.count('frag (')>=2,trace
 refused=ns('client','ping','-6','-n','-M','do','-s','2000','-c','1','-W','1',target,check=False)
 assert refused.returncode!=0 and 'too long' in (refused.stdout+refused.stderr).lower(),(refused.stdout,refused.stderr)
 print(json.dumps({'small_echo':small.stdout,'oversize_before_learning':{'stdout':large.stdout,'stderr':large.stderr,'returncode':large.returncode},
 'packet_too_big_capture':feedback,'learned_route':route,'reverse_path_learning':reverse.stdout+reverse.stderr,'reverse_route':reverse_route,'source_fragmented_echo':fragmented.stdout,
 'source_side_fragment_capture':trace,'dont_fragment_after_learning':{'returncode':refused.returncode,'stdout':refused.stdout,'stderr':refused.stderr}}))
"""
name='xbcatm-mtupath-'+uuid.uuid4().hex[:10]
def docker(*args,**kwargs):return subprocess.run(['docker',*args],capture_output=True,text=True,timeout=300,**kwargs)
try:
 with TemporaryDirectory(prefix=name+'-') as directory:
 root=Path(directory);(root/'Dockerfile').write_text(recipe)
 build=docker('build','-t',name,str(root));assert build.returncode==0,build.stderr
 result=docker('run','--rm','-i','--name',name,'--network','none','--cap-add','NET_ADMIN','--cap-add','SYS_ADMIN','--memory','256m','--pids-limit','128',name,'python3','-',input=program)
 assert result.returncode==0,result.stderr
 print(json.dumps(json.loads(result.stdout),sort_keys=True))
finally:
 docker('rm','-f',name);docker('image','rm',name)

The endpoint links have MTU 1500 and the intermediate router link has MTU 1280. Static global addresses use nodad, while setup explicitly waits for automatically generated link-local addresses to leave the tentative state. That readiness check avoids mistaking initial address setup delays for a forwarding or MTU failure. The experiment does not claim to test the Duplicate Address Detection algorithm itself.

A small echo exchange succeeds first. An echo payload of 1400 bytes, sent with the do policy, then creates a 1448-byte IPv6 packet after its base and ICMPv6 headers are included. It fits the source interface but not the middle link. The capture shows the original request and a router Packet Too Big message reporting MTU 1280; the client route lookup records that learned value.

The target performs the corresponding oversized probe toward the client and learns MTU 1280 for the reverse path. This explicit step prepares its large echo reply rather than assuming that one endpoint’s cache covers both directions. Both failed discovery probes remain in the output, with their router feedback and route state, so the setup conditions behind later success are visible.

The client next sends a 2000-byte echo payload with the dont policy, allowing source fragmentation under the learned limit. A capture on the client interface, restricted to the client’s source address, shows two fragments with the same identification before either router processes them. Their displayed data offsets are zero and 1232 bytes, and their fragment data lengths sum to 2008, including the ICMPv6 header.

That echo succeeds after destination reassembly and a correctly sized return exchange. Repeating the same payload with do instead reports a local message-too-long error and MTU 1280. The results distinguish a router reporting an unknown bottleneck, source-generated fragments after discovery, and a local refusal once the smaller path limit is known. They are different failure and delivery stages.

Diagnose size and direction before recommending fragmentation

Include all relevant headers when calculating packet size. A fragment adds its own header, and the IPv6 Fragment Offset field uses eight-byte units even though diagnostic tools may display byte offsets. Use consistent units when reconstructing ranges. The script’s two source fragments provide concrete evidence; the absence of a fragment from an unrelated capture would require more context to interpret.

An IPv6 router can still act as the source of its own packets, which is separate from fragmenting transit traffic. Keep that role distinction when reading captures from routers or tunnel endpoints. Also distinguish the path’s minimum link MTU from a particular application’s chosen payload size: they are related by protocol overhead and the sender’s packetization policy.

Prefer application and transport behavior that fits the known path where possible, and verify any required fragment handling with actual traffic. This exercise proves source placement, feedback, route learning, and a successful fragmented echo. It does not validate arbitrary extension-header chains, fragment-filtering policies, or every transport’s behavior under missing control messages.

Sources

RFC 8200 IPv6, source fragmentation, Fragment headers and destination reassembly, checked 2026-09-12.
RFC 8201 IPv6 Path MTU Discovery, Packet Too Big feedback and directional path estimates, checked 2026-09-12.
Linux ping(8), payload sizing and do/dont path-MTU policies, checked 2026-09-12.

IPv6 text normalization preserves addresses, but endpoint context still matters

Mon, 30 Nov 2026 00:00:00 +0000

An IPv6 address contains 128 bits, usually written as eight hexadecimal groups. Text may omit leading zeros and replace one consecutive run of zero groups with ::. These rules preserve the address while shortening its spelling. RFC 4291 defines valid forms; RFC 5952 recommends a consistent representation for display and exchange. Valid syntax and the preferred spelling are related but different questions.

When it breaks

Raw string equality can treat one address as several identities. Uppercase letters, leading zeros, and expanded zero groups can all change the text without changing the 128 bits. That can split inventory entries or defeat an application’s intended address comparison. Parse first with a library appropriate to the input, then compare address values instead of assuming lowercasing alone performs full normalization.

Compression also has constraints. :: can appear only once, because two omitted runs would leave their lengths ambiguous. For the recommended representation, compress the longest zero run, choosing the first when lengths tie, and do not compress a single zero field. General IPv6 syntax permits some spellings that these display rules deliberately avoid. A normalizer should not confuse an accepted nonpreferred form with malformed input.

An address is not always a complete endpoint. A URL needs brackets around an IPv6 literal to separate its colons from the port delimiter. A link-local destination may also need a zone identifier to select the intended interface context. Stripping a zone or flattening an IPv4-mapped address without an explicit comparison policy can discard information the caller needs to make the right connection.

Check it quickly

Save this as check-ipv6-text.py and run python3 check-ipv6-text.py with Docker. The pinned Python 3.11.16 image runs standard-library parsing without network traffic. It compares valid variants, rejects malformed inputs, and inspects endpoint components. The test does not assign the example addresses, send IPv6 packets, or establish that any route to them exists:

import json,subprocess,uuid
image="python@sha256:528257d48c1da0dcecc2e725d1ae34498d60c965f1241e39cd6a85a8859bdf84"
program=r"""
from ipaddress import IPv6Address
from urllib.parse import urlsplit
import json

variants=['2001:0DB8:0000:0000:0000:ff00:0042:8329','2001:db8:0:0:0:ff00:42:8329','2001:db8::ff00:42:8329']
parsed=[IPv6Address(v) for v in variants];assert len(set(parsed))==1 and len(set(variants))==3
tie=IPv6Address('2001:0:0:1:0:0:1:1').compressed;assert tie=='2001::1:0:0:1:1'
single=IPv6Address('2001:db8::1:2:3:4:5').compressed;assert single=='2001:db8:0:1:2:3:4:5'
bad=[]
for text in ['2001::db8::1','2001:db8:1:2:3:4:5:6:7','2001:db8::gg','2001:db8::1/64']:
 try:IPv6Address(text);raise AssertionError('invalid address accepted')
 except ValueError:bad.append(text)
url=urlsplit('https://[2001:db8::1]:8443/health');assert IPv6Address(url.hostname)==IPv6Address('2001:db8::1') and url.port==8443
try:urlsplit('https://2001:db8::1:8443/health').port;raise AssertionError('unbracketed endpoint accepted')
except ValueError:bad_url=True
mapped=IPv6Address('::ffff:192.0.2.1');assert str(mapped.ipv4_mapped)=='192.0.2.1'
zone_a=IPv6Address('fe80::1%eth0');zone_b=IPv6Address('fe80::1%eth1')
assert zone_a!=zone_b and zone_a.packed==zone_b.packed
print(json.dumps({'variants':variants,'same_128_bits':len(set(parsed))==1,'normalized':str(parsed[0]),
 'leftmost_tie':tie,'single_zero_retained':single,'rejected':bad,'url_host':url.hostname,'url_port':url.port,
 'unbracketed_url_port_rejected':bad_url,'mapped_python_text':mapped.compressed,'mapped_ipv4':str(mapped.ipv4_mapped),
 'zone_scope_ids':[zone_a.scope_id,zone_b.scope_id],'same_bits_different_scopes':True}))
"""
name='xbcatm-socket-'+uuid.uuid4().hex[:10]
try:
 result=subprocess.run(['docker','run','--rm','-i','--name',name,'--network','none',
 '--memory','128m','--pids-limit','64',image,'python3','-'],input=program,
 capture_output=True,text=True,timeout=60)
 assert result.returncode==0,result.stderr
 print(json.dumps(json.loads(result.stdout),ensure_ascii=False,sort_keys=True))
finally:
 subprocess.run(['docker','rm','-f',name],capture_output=True,text=True,timeout=10)

Three strings represent the same address, including 2001:0DB8:0000:0000:0000:ff00:0042:8329 and 2001:db8::ff00:42:8329. Their string set contains three entries, while their parsed-address set contains one. The normalized output is 2001:db8::ff00:42:8329. This directly exposes why textual spelling is an unreliable key when the application’s identity is meant to be the underlying address.

For 2001:0:0:1:0:0:1:1, the first of two equal zero runs is shortened, producing 2001::1:0:0:1:1. The valid spelling 2001:db8::1:2:3:4:5 contains only one omitted zero group, so its normalized output restores that group as 2001:db8:0:1:2:3:4:5. The exercise explicitly verifies the single-zero rule rather than recommending compression wherever it makes a string shorter.

Inputs with two :: markers, too many groups, or nonhexadecimal digits fail address parsing. A string ending in /64 also fails this address-only constructor because it describes a different kind of input. Select an interface or network parser when a prefix is part of the contract; do not silently discard the suffix merely to make an address parser accept it.

The bracketed URL https://[2001:db8::1]:8443/health separates hostname and port correctly. Accessing the port of the intentionally unbracketed counterpart raises ValueError. The fixture also recognizes the IPv4 component of ::ffff:192.0.2.1; this pinned runtime prints that mapped address in mixed notation. Those results describe the tested parser, not a claim that every runtime formats every special address identically.

Two scoped values, fe80::1%eth0 and fe80::1%eth1, have identical packed address bytes but compare differently with their scopes retained. The zone is additional context rather than part of the 128-bit address. No such interfaces are contacted here. The test checks that the representation can preserve the distinction, not that either scoped destination is configured or reachable.

Choose the comparison contract before storing text

Decide whether a field stores an address, network prefix, interface assignment, URL, or socket endpoint. Use that type’s parser and preserve its required components. Keeping raw input separately can help explain a configuration mistake, while a normalized representation supports consistent display and indexing. Neither normalization nor parsing authenticates who controls the address or whether the requested service is safe.

Document treatment of mapped IPv4 and scope identifiers when correlating logs or applying address rules. Test equivalent valid forms, malformed inputs, and context-bearing cases against that policy. The goal is a stable interpretation of the intended endpoint, not merely the shortest possible string. Address formatting becomes dependable when the binary value and its surrounding connection context remain distinct and explicit.

Sources

RFC 4291 IPv6 addressing, valid IPv6 syntax, compressed forms and embedded IPv4, checked 2026-09-12.
RFC 5952 IPv6 text representation, recommended zero compression, tie handling and lowercase, checked 2026-09-12.
RFC 3986 URI syntax, bracketed IP literals and separation from a port, checked 2026-09-12.
Python 3.11 ipaddress, parsed address equality, mapped addresses and scope IDs, checked 2026-09-12.

IPv6 resolves neighbors with ICMPv6 before the TCP connection can work

Mon, 16 Nov 2026 00:00:00 +0000

An IPv6 host on an Ethernet link needs a link-layer destination before it can send a frame to a neighbor. Neighbor Discovery performs that address-resolution work using ICMPv6 Neighbor Solicitation and Neighbor Advertisement messages. It also covers functions beyond IPv4 ARP, including router discovery and neighbor reachability detection. Calling it merely “ARP with longer addresses” hides dependencies that matter when configuring an IPv6 network.

When it breaks

A valid IPv6 address and route do not prove that the next hop’s Ethernet address can be resolved. If the required solicitation or advertisement is filtered, a TCP service can be listening correctly while clients fail before exchanging application data. Opening only the application’s TCP port does not repair this lower-layer dependency. Inspect the neighbor table and relevant ICMPv6 traffic alongside the service listener.

Cached state can conceal the error. A host with a usable neighbor entry may continue communicating after a damaging rule is installed, while a fresh client or an expired entry exposes the failure. Conversely, a STALE entry is not automatically broken: Neighbor Discovery can use existing link-layer information and subsequently check reachability. Interpret the state machine rather than requiring every healthy entry to remain REACHABLE forever.

Another common confusion is resolving the remote application’s address on the local Ethernet segment. For an off-link destination, the host normally resolves its selected next-hop router. Confirm routing before deciding which neighbor should appear in the table. A capture on the wrong interface, or a cached entry requiring no new solicitation, can also explain an empty trace without proving that discovery is absent.

Check it quickly

Save this as check-neighbor-discovery.py and run python3 check-neighbor-discovery.py with Docker. The disposable Linux environment uses Python 3.11.16, iproute2 6.1.0, nftables 1.0.6, and tcpdump 4.99.3. NET_ADMIN and SYS_ADMIN support its nested namespaces and temporary proc mount. Two endpoints share a newly created veth link; no host neighbor table or firewall rule is changed:

from pathlib import Path
from tempfile import TemporaryDirectory
import json,subprocess,uuid
recipe='FROM python@sha256:528257d48c1da0dcecc2e725d1ae34498d60c965f1241e39cd6a85a8859bdf84\nRUN apt-get update && apt-get install -y --no-install-recommends iproute2=6.1.0-3 iputils-ping=3:20221126-1+deb12u1 nftables=1.0.6-2+deb12u2 tcpdump=4.99.3-1 traceroute=1:2.1.2-1 procps=2:4.0.2-3 && rm -rf /var/lib/apt/lists/*\nCMD ["python3"]\n'
program=r"""
from contextlib import ExitStack,contextmanager
from pathlib import Path
from tempfile import TemporaryDirectory
import json,os,select,signal,subprocess,time

def run(*args,check=True,input=None,timeout=8):
 result=subprocess.run(args,input=input,capture_output=True,text=True,timeout=timeout)
 if check:assert result.returncode==0,(args,result.returncode,result.stdout,result.stderr)
 return result
def ns(name,*args,**kwargs):return run('ip','netns','exec',name,*args,**kwargs)
def ip(name,*args,**kwargs):return ns(name,'ip',*args,**kwargs)
def stop(process):
 if process.poll() is None:
 process.terminate()
 try:process.wait(timeout=2)
 except subprocess.TimeoutExpired:process.kill();process.wait(timeout=2)
def line(process,timeout=3):
 assert select.select([process.stdout],[],[],timeout)[0],'child response deadline exceeded'
 value=process.stdout.readline();assert value,'child exited without a response'
 return value
def spawn(stack,command):
 process=subprocess.Popen(command,stdin=subprocess.PIPE,stdout=subprocess.PIPE,stderr=subprocess.PIPE,text=True)
 stack.callback(stop,process);return process
@contextmanager
def lab(names):
 with TemporaryDirectory(prefix='net-path-') as directory,ExitStack() as stack:
 root=Path(directory);proc=root/'proc';proc.mkdir();run('mount','-t','proc','proc',str(proc))
 stack.callback(run,'umount',str(proc))
 for name in names:
 run('ip','netns','add',name);stack.callback(run,'ip','netns','delete',name,check=False)
 ip(name,'link','set','lo','up')
 def setting(name,key,value):
 assert name in names
 path=proc/'sys'/key.replace('.','/')
 return ns(name,'python3','-c',f'from pathlib import Path; p=Path({str(path)!r}); p.write_text({str(value)!r}); print(p.read_text().strip())').stdout.strip()
 yield root,stack,setting
def wire(left,left_if,right,right_if,left_addresses,right_addresses):
 run('ip','link','add',left_if,'type','veth','peer','name',right_if)
 for name,interface,addresses in [(left,left_if,left_addresses),(right,right_if,right_addresses)]:
 run('ip','link','set',interface,'netns',name)
 for address in addresses:ip(name,'address','add',address,'dev',interface,*(['nodad'] if ':' in address else []))
 ip(name,'link','set',interface,'up')
def nft(name,script):return ns(name,'nft','-f','-',input=script)
def counters(name):
 data=json.loads(ns(name,'nft','-j','list','ruleset').stdout);found={}
 for entry in data['nftables']:
 rule=entry.get('rule',{})
 if 'comment' in rule:
 for expression in rule['expr']:
 if 'counter' in expression:found[rule['comment']]=expression['counter']['packets']
 return found

def server(stack,name,address,port=18080,label='server'):
 code=r'''
from http.server import BaseHTTPRequestHandler,ThreadingHTTPServer
import json,socket,sys
address,port,label=sys.argv[1],int(sys.argv[2]),sys.argv[3]
class Handler(BaseHTTPRequestHandler):
 def do_GET(self):
 body=json.dumps({'server':label,'peer':self.client_address,'path':self.path}).encode()
 self.send_response(200);self.send_header('Content-Length',str(len(body)));self.end_headers();self.wfile.write(body)
 def log_message(self,*args):pass
class Server(ThreadingHTTPServer):
 address_family=socket.AF_INET6 if ':' in address else socket.AF_INET
 def server_bind(self):
 if self.address_family==socket.AF_INET6:self.socket.setsockopt(socket.IPPROTO_IPV6,socket.IPV6_V6ONLY,1)
 super().server_bind()
service=Server((address,port),Handler);print('ready',flush=True);service.serve_forever()
'''
 process=spawn(stack,['ip','netns','exec',name,'python3','-u','-c',code,address,str(port),label])
 assert line(process).strip()=='ready';return process
def request(name,address,port=18080):
 code=r'''
import http.client,json,sys
client=http.client.HTTPConnection(sys.argv[1],int(sys.argv[2]),timeout=.7)
try:
 client.request('GET','/lab-visible-message');response=client.getresponse();body=json.loads(response.read())
 assert response.status==200;print(json.dumps({'ok':True,'status':response.status,'body':body}))
except OSError as error:print(json.dumps({'ok':False,'type':type(error).__name__,'errno':error.errno}))
finally:client.close()
'''
 return json.loads(ns(name,'python3','-c',code,address,str(port)).stdout)

def capture(stack,root,name,interface,expression,label):
 path=root/(label+'.pcap')
 process=subprocess.Popen(['ip','netns','exec',name,'tcpdump','--immediate-mode','-Z','root','-U','-n','-i',interface,'-w',str(path),expression],
 stdout=subprocess.DEVNULL,stderr=subprocess.PIPE,text=True)
 stack.callback(stop,process)
 deadline=time.monotonic()+3
 while time.monotonic()<deadline:
 assert process.poll() is None,'tcpdump exited before listening'
 if select.select([process.stderr],[],[],.1)[0] and 'listening on' in process.stderr.readline():return process,path
 raise AssertionError('tcpdump did not become ready')
def captured(process,path,ascii=False):
 process.send_signal(signal.SIGINT);_,diagnostic=process.communicate(timeout=3)
 assert process.returncode==0,diagnostic
 result=run('tcpdump','-nn','-vv',*(['-A'] if ascii else []),'-r',str(path))
 return result.stdout

with lab(['client','target']) as (root,stack,setting):
 wire('client','c0','target','t0',['192.0.2.1/30','2001:db8:1::1/64'],['192.0.2.2/30','2001:db8:1::2/64'])
 server(stack,'target','2001:db8:1::2')
 ip('client','-4','neigh','flush','dev','c0');ip('target','-4','neigh','flush','dev','t0')
 arp_process,arp_file=capture(stack,root,'client','c0','arp','arp')
 ns('client','ping','-4','-n','-c','1','-W','1','192.0.2.2')
 arp=captured(arp_process,arp_file);assert 'ARP,' in arp and 'Request who-has' in arp and 'Reply' in arp,arp
 ip('client','-6','neigh','flush','dev','c0');ip('target','-6','neigh','flush','dev','t0')
 nd_process,nd_file=capture(stack,root,'client','c0','icmp6 or arp','nd')
 ns('client','ping','-6','-n','-c','1','-W','1','2001:db8:1::2')
 nd=captured(nd_process,nd_file)
 assert 'neighbor solicitation' in nd and 'neighbor advertisement' in nd and 'ARP,' not in nd,nd
 mac=json.loads(ip('target','-j','link','show','t0').stdout)[0]['address']
 neighbors=json.loads(ip('client','-6','-j','neigh','show','2001:db8:1::2').stdout)
 assert len(neighbors)==1 and neighbors[0]['lladdr']==mac
 healthy=request('client','2001:db8:1::2');assert healthy['ok']
 setting('client','net.ipv6.neigh.c0.retrans_time_ms',200);setting('client','net.ipv6.neigh.c0.mcast_solicit',3)
 nft('client','''table inet block_nd {
 chain input { type filter hook input priority 0; policy accept;
 icmpv6 type nd-neighbor-advert counter drop comment "blocked_advertisements"
 }
}
''')
 ip('client','-6','neigh','flush','dev','c0')
 failed=ns('client','ping','-6','-n','-c','1','-W','1','2001:db8:1::2',check=False);assert failed.returncode!=0
 broken=request('client','2001:db8:1::2');assert not broken['ok']
 blocked=counters('client');assert blocked['blocked_advertisements']>0
 failed_neighbors=json.loads(ip('client','-6','-j','neigh','show','2001:db8:1::2').stdout)
 assert failed_neighbors and all('lladdr' not in entry for entry in failed_neighbors)
 nft('client','delete table inet block_nd');ip('client','-6','neigh','flush','dev','c0')
 recovered=request('client','2001:db8:1::2');assert recovered['ok']
 print(json.dumps({'ipv4_arp_capture':arp,'ipv6_capture':nd,'resolved_neighbor':neighbors,'target_mac':mac,
 'healthy_http':healthy,'blocked_ping_exit':failed.returncode,'blocked_http':broken,'blocked_counters':blocked,
 'unresolved_neighbor':failed_neighbors,'recovered_http':recovered}))
"""
name='xbcatm-netpath-'+uuid.uuid4().hex[:10]
def docker(*args,**kwargs):return subprocess.run(['docker',*args],capture_output=True,text=True,timeout=300,**kwargs)
try:
 with TemporaryDirectory(prefix=name+'-') as directory:
 root=Path(directory);(root/'Dockerfile').write_text(recipe)
 build=docker('build','-t',name,str(root));assert build.returncode==0,build.stderr
 result=docker('run','--rm','-i','--name',name,'--network','none','--cap-add','NET_ADMIN','--cap-add','SYS_ADMIN',
 '--memory','256m','--pids-limit','128',name,'python3','-',input=program)
 assert result.returncode==0,result.stderr
 print(json.dumps(json.loads(result.stdout),sort_keys=True))
finally:
 docker('rm','-f',name);docker('image','rm',name)

The script assigns IPv4 and IPv6 documentation addresses to both endpoints. It first captures a real IPv4 ARP request and reply as a positive control for the capture setup. It then clears the client’s IPv6 neighbor cache and sends an IPv6 echo request. The trace contains Neighbor Solicitation, Neighbor Advertisement, and echo traffic, with no ARP frames in this IPv6 exchange.

The solicitation for 2001:db8:1::2 is sent to solicited-node multicast address ff02::1:ff00:2. The reply provides the target’s link-layer address, which the script compares with the target interface’s actual MAC address and the client’s neighbor entry. An HTTP request then returns the expected server identity. This joins the control exchange, learned information, and application outcome instead of relying on configuration text alone.

Next, the client drops incoming neighbor advertisements. Its cache is cleared so an older mapping cannot hide the change. Discovery retransmission settings are shortened only inside the client namespace to keep the test bounded. Ping fails; an HTTP attempt reports Linux EHOSTUNREACH, errno 113; and the neighbor entry becomes FAILED without a resolved link-layer address. The filter counter confirms that advertisements reached the drop rule.

Removing that rule and clearing the failed entry restores HTTP success. The target service and address stay unchanged throughout the comparison. This isolates address-resolution failure from a stopped application or a missing TCP allow rule. The exact timing and packet count depend on the configured discovery retries, so the example checks the failure state and recovery rather than prescribing one universal timeout.

Keep discovery, addressing, and authentication separate

The fixture uses static IPv6 addresses with duplicate-address detection disabled for setup. It demonstrates neighbor resolution, not SLAAC, Router Advertisement processing, or Duplicate Address Detection. Those functions require their own observations and policy review. Passing this small test cannot certify every ICMPv6 dependency in a production network; RFC 4890 discusses filtering requirements in broader operational contexts.

An advertisement also should not be treated as authenticated proof of ownership merely because it supplies a MAC address. The protocol’s local-link checks limit where messages can originate but do not make every node on that link trustworthy. When debugging, record interface, selected next hop, neighbor state, filters, and the corresponding application result. That evidence distinguishes an unresolved neighbor from an unrelated service failure.

Sources

RFC 4861 Neighbor Discovery, solicitation, advertisement, address resolution and reachability states, checked 2026-09-12.
Linux ip-neighbour(8), inspecting and flushing IPv6 neighbor entries, checked 2026-09-12.
RFC 4890 ICMPv6 filtering, preserving ICMPv6 functions required by IPv6 networks, checked 2026-09-12.

Dual-stack address ordering and successful connection choice are separate

Wed, 04 Nov 2026 00:00:00 +0000

Discovering A and AAAA records provides possible destinations. It does not select a successful connection by itself. Address ordering, source-address selection, routing, and the application’s connection algorithm all contribute. RFC 6724 describes default source and destination selection rules, while applications can impose their own choices. A program requesting only IPv4 has already narrowed the result before any dual-stack connection strategy can act.

When it breaks

Address preference is not an application-health probe. An IPv6 destination can look suitable according to local policy and routing even when its remote service is stopped or a later network hop drops traffic. The preferred candidate may therefore fail. Assuming that the operating system has already tested every returned endpoint can hide the need for connection deadlines and alternate-address handling.

RFC 6724’s rules are ordered comparisons, not a general score for cheapest or fastest network path. They consider properties such as usability, scope, policy labels, precedence, and matching prefixes. They do not measure application response time. Destination address selection must also be distinguished from a routing table’s longest-prefix match for sending packets after a destination has been chosen.

Happy Eyeballs is another layer. It coordinates discovery and staggered connection attempts to reduce delays when one family is problematic. A client that tries addresses sequentially is not automatically implementing that algorithm. Immediate connection refusal and a silently dropped connection attempt can produce very different waiting times, even if both clients eventually reach the same working IPv4 service.

Check it quickly

Save this as check-address-selection.py and run python3 check-address-selection.py with Docker. The pinned environment uses glibc 2.36 and Python 3.11, with BIND 9.18.49 and dnsmasq 2.90 supplying DNS. Two real HTTP listeners use IPv4 and IPv6 loopback on the same port. The fixture has no public network path, so its observed order is explicitly a local result:

from pathlib import Path
from tempfile import TemporaryDirectory
import json,subprocess,uuid
recipe='FROM python@sha256:528257d48c1da0dcecc2e725d1ae34498d60c965f1241e39cd6a85a8859bdf84\nRUN apt-get update && apt-get install -y --no-install-recommends bind9=1:9.18.49-1~deb12u2 bind9-dnsutils=1:9.18.49-1~deb12u2 dnsmasq-base=2.90-4~deb12u2 python3-dnspython=2.3.0-1 && rm -rf /var/lib/apt/lists/*\nCMD ["/usr/bin/python3"]\n'
program=r"""
from contextlib import ExitStack,contextmanager
from pathlib import Path
from tempfile import TemporaryDirectory
import json,re,signal,subprocess,time
import dns.exception,dns.message,dns.query,dns.rcode,dns.rdatatype

def run(*args,check=True):
 result=subprocess.run(args,capture_output=True,text=True,timeout=15)
 if check:assert result.returncode==0,(args,result.returncode,result.stdout,result.stderr)
 return result
def query(name,kind='A',port=1053):
 return dns.query.udp(dns.message.make_query(name,kind),'127.0.0.1',port=port,timeout=1)
def values(response,kind='A'):
 wanted=dns.rdatatype.from_text(kind)
 return [item.to_text() for rrset in response.answer if rrset.rdtype==wanted for item in rrset]
def show(response):
 def section(records):return [{'name':str(rr.name),'type':dns.rdatatype.to_text(rr.rdtype),'ttl':rr.ttl,'data':[item.to_text() for item in rr]} for rr in records]
 return {'rcode':dns.rcode.to_text(response.rcode()),'answer':section(response.answer),'authority':section(response.authority)}
def wait(predicate,timeout=15):
 deadline=time.monotonic()+timeout
 while time.monotonic()<deadline:
 try:
 if predicate():return
 except (OSError,dns.exception.Timeout):pass
 time.sleep(.05)
 raise AssertionError('DNS fixture condition did not become true')
def stop(process):
 if process.poll() is None:
 process.terminate()
 try:process.wait(timeout=5)
 except subprocess.TimeoutExpired:process.kill();process.wait(timeout=5)

@contextmanager
def lab(records,soa_ttl=8,minimum=4,extra=''):
 with TemporaryDirectory(prefix='xbcatm-dns-') as directory,ExitStack() as stack:
 root=Path(directory);zone=root/'zone';conf=root/'named.conf';log=root/'named.log';serial=1
 def save(body):
 zone.write_text(f'$ORIGIN lab.test.\n$TTL 30\n@ {soa_ttl} IN SOA ns.lab.test. hostmaster.lab.test. ({serial} 60 60 3600 {minimum})\n@ IN NS ns.lab.test.\nns IN A 127.0.0.1\n'+body+'\n')
 run('named-checkzone','lab.test',str(zone))
 save(records)
 conf.write_text(f'''options {{ directory "{root}"; listen-on port 1053 {{127.0.0.1;}}; listen-on-v6 {{none;}};
recursion no; dnssec-validation no; notify no; querylog yes; max-cache-size 8m; pid-file "{root}/named.pid"; session-keyfile none;
{extra} }};
controls {{}};
zone "lab.test" {{ type primary; file "{zone}"; }};
''')
 run('named-checkconf',str(conf))
 output=stack.enter_context(log.open('w'))
 authority=subprocess.Popen(['named','-g','-c',str(conf),'-n','1','-U','1'],stdout=output,stderr=subprocess.STDOUT)
 stack.callback(stop,authority)
 def ready():
 assert authority.poll() is None,log.read_text()
 response=query('lab.test.','SOA');return response.rcode()==0 and response.answer[0][0].serial==serial
 wait(ready)
 def update(body):
 nonlocal serial
 serial+=1;save(body);authority.send_signal(signal.SIGHUP);wait(ready)
 def cache(port=1054,upstream=1053,size=150,options=()):
 logfile=root/('cache-'+str(port)+'.log');stream=stack.enter_context(logfile.open('w'))
 command=['dnsmasq','--no-daemon','--conf-file=/dev/null','--no-resolv','--no-hosts','--bind-interfaces',
 '--listen-address=127.0.0.1','--port='+str(port),'--server=127.0.0.1#'+str(upstream),
 '--cache-size='+str(size),'--log-queries','--log-facility=-',*options]
 process=subprocess.Popen(command,stdout=stream,stderr=subprocess.STDOUT);stack.callback(stop,process)
 def cache_ready():
 assert process.poll() is None,logfile.read_text()
 return query('lab.test.','SOA',port).rcode()==0
 wait(cache_ready);return process,logfile
 def queries(name,kind='A'):
 return sum(bool(re.search(r'query: '+re.escape(name.rstrip('.'))+r' IN '+kind+r'\b',line)) for line in log.read_text().splitlines())
 yield root,update,cache,queries

@contextmanager
def named_process(root,config):
 root.mkdir(exist_ok=True);conf=root/'named.conf';log=root/'named.log';conf.write_text(config)
 run('named-checkconf',str(conf))
 with log.open('w') as output:
 process=subprocess.Popen(['named','-g','-c',str(conf),'-n','1','-U','1'],stdout=output,stderr=subprocess.STDOUT)
 try:
 def ready():
 assert process.poll() is None,log.read_text()
 return re.search(r'\brunning\s*$',log.read_text(),re.M) is not None
 wait(ready);yield process,log
 finally:stop(process)
from http.server import BaseHTTPRequestHandler,ThreadingHTTPServer
import socket,threading
class Handler(BaseHTTPRequestHandler):
 def log_message(self,*args):pass
 def do_GET(self):
 body=self.server.server_address[0].encode();self.send_response(200);self.send_header('Content-Length',str(len(body)));self.end_headers();self.wfile.write(body)
class V6Server(ThreadingHTTPServer):address_family=socket.AF_INET6
with lab('dual 30 IN A 127.0.0.1\ndual 30 IN AAAA ::1') as (_,update,cache,queries):
 cache(port=53)
 Path('/etc/resolv.conf').write_text('nameserver 127.0.0.1\noptions timeout:1 attempts:1\n')
 nss=Path('/etc/nsswitch.conf');nss.write_text(re.sub(r'^hosts:.*$','hosts: dns',nss.read_text(),flags=re.M))
 servers=[];threads=[]
 try:
 for server_class,address in [(ThreadingHTTPServer,'127.0.0.1'),(V6Server,'::1')]:
 server=server_class((address,0 if not servers else servers[0].server_port),Handler)
 thread=threading.Thread(target=server.serve_forever,daemon=True);thread.start();servers.append(server);threads.append(thread)
 port=servers[0].server_port;v6=servers[1]
 def candidates(family=socket.AF_UNSPEC):return socket.getaddrinfo('dual.lab.test',port,family,socket.SOCK_STREAM)
 addresses=candidates();assert {r[0] for r in addresses}=={socket.AF_INET,socket.AF_INET6}
 assert addresses[0][0]==socket.AF_INET6
 assert {r[0] for r in candidates(socket.AF_INET)}=={socket.AF_INET}
 assert {r[0] for r in candidates(socket.AF_INET6)}=={socket.AF_INET6}
 def request():
 with socket.create_connection(('dual.lab.test',port),timeout=1) as stream:
 chosen={'family':stream.family.name,'peer':stream.getpeername()[0],'source':stream.getsockname()[0]}
 stream.sendall(b'GET / HTTP/1.0\r\nHost: dual.lab.test\r\n\r\n');data=b''
 while True:
 part=stream.recv(4096)
 if not part:break
 data+=part
 assert b' 200 ' in data.split(b'\r\n',1)[0] and data.endswith(chosen['peer'].encode());return chosen
 first=request();assert first['family']=='AF_INET6'
 v6.shutdown();v6.server_close();assert values(query('dual.lab.test.','AAAA'),'AAAA')==['::1']
 with socket.socket(socket.AF_INET6) as forced:
 forced.settimeout(1)
 try:forced.connect(('::1',port));raise AssertionError('closed IPv6 listener accepted a connection')
 except OSError as error:failure=type(error).__name__
 assert candidates()[0][0]==socket.AF_INET6
 second=request();assert second['family']=='AF_INET'
 print(json.dumps({'candidate_order':[{'family':socket.AddressFamily(r[0]).name,'address':r[4][0]} for r in addresses],
 'both_listeners_healthy':first,'forced_IPv6_after_stop':failure,'sequential_client_after_IPv6_stop':second,
 'AAAA_still_published':True},sort_keys=True))
 finally:
 for server in servers:server.shutdown();server.server_close()
 for thread in threads:thread.join(timeout=2)
"""
name='xbcatm-dns-'+uuid.uuid4().hex[:10]
def docker(*args,**kwargs):return subprocess.run(['docker',*args],capture_output=True,text=True,timeout=300,**kwargs)
try:
 with TemporaryDirectory(prefix=name+'-') as directory:
 root=Path(directory);(root/'Dockerfile').write_text(recipe)
 built=docker('build','-t',name,str(root));assert built.returncode==0,built.stderr
 result=docker('run','--rm','-i','--name',name,'--network','none','--memory','384m','--pids-limit','128',name,
 '/usr/bin/python3','-',input=program)
 assert result.returncode==0,result.stderr
 print(json.dumps(json.loads(result.stdout),sort_keys=True))
finally:
 docker('rm','-f',name);docker('image','rm',name)

For dual.lab.test, getaddrinfo with AF_UNSPEC returns both ::1 and 127.0.0.1, with IPv6 first in the recorded environment. Separate calls restricted to AF_INET or AF_INET6 return only the requested family. These calls establish the actual candidate list used by this process rather than assuming that separate A and AAAA query outputs define a universal merged ordering.

With both listeners healthy, Python’s socket.create_connection connects to ::1. The program records both the selected peer and the local source address, then sends a real HTTP request and verifies the listener’s identifying response. This links candidate preference to an actual successful connection while keeping source address, destination address, and application response visible as distinct observations.

The IPv6 listener is then stopped and closed. DNS still publishes ::1, and getaddrinfo still puts IPv6 first. A forced IPv6 connection fails with ConnectionRefusedError. The normal Python connection helper nevertheless succeeds through 127.0.0.1 and receives the IPv4 listener’s response. Its sequential attempt behavior can reach a later working candidate without requiring the DNS order to change.

The refusal is immediate on this local path. The test does not inject a black hole, measure an internet fallback delay, or exercise a full Happy Eyeballs implementation. It demonstrates that local address preference can remain unchanged while service availability changes, and that the connection algorithm is responsible for turning that candidate list into an eventual success or failure.

Inspect the actual caller before changing host-wide policy

Check which family and flags the application asks getaddrinfo to use, whether its runtime caches results, and how it attempts the candidates. Some applications use different resolver libraries or implement their own connection racing. Reproducing a lookup with a command-line tool is useful only when the tool’s relevant choices match those of the failing process.

Observe selected source and destination addresses alongside connection timing and errors. A working DNS lookup followed by refusal suggests a different investigation from a timeout along the routed path. Test each advertised family through the actual service identity and protocol. A healthy IPv4 endpoint does not prove that the advertised IPv6 endpoint has matching routing, access rules, certificates, or application configuration.

Use policy changes deliberately when the deployment requires them, and verify their effect on real callers. RFC 6724 permits administrative policy, but that does not make a global preference change a substitute for repairing a broken advertised service. Likewise, removing AAAA changes future discovery while cached records and existing connections can persist. Plan those lifetimes alongside any endpoint change.

Treat the observed order as evidence for this host and process, not a guarantee for all clients. A complete diagnosis identifies the candidate set, local selection policy, attempted connections, and successful peer. Keeping those stages separate explains dual-stack behavior without inventing a promise that the first address is healthy or that every client races the two families.

Sources

RFC 6724 default address selection, source and destination selection rules and policy overrides, checked 2026-09-12.
RFC 8305 Happy Eyeballs version 2, staggered connection attempts across address families, checked 2026-09-12.
Python 3.11 socket documentation, getaddrinfo families and create_connection attempt behavior, checked 2026-09-12.