IPv6-Only Name Servers Breaking Legacy Glue Records

As the internet transitions from IPv4 to IPv6, longstanding assumptions about DNS infrastructure are being challenged in ways that carry both technical and operational consequences. One of the more obscure but impactful areas of this transition involves the interaction between IPv6-only name servers and legacy glue records—a fundamental component of how the Domain Name System (DNS) enables domain resolution. While the move toward IPv6-only deployments reflects a forward-looking stance aimed at future-proofing the internet, it has created compatibility issues that expose the fragility of older systems and conventions that underpin global DNS resolution.

Glue records are a mechanism in the DNS used to prevent circular dependencies when resolving domain names. When a domain’s authoritative name server lies within the same domain, its IP address—called a glue record—must be included directly in the parent zone to break the loop. For instance, if the domain example.com is delegated to ns1.example.com, the parent .com zone must include the IP address of ns1.example.com, otherwise the resolver would enter a cycle trying to find the address of the name server by querying the very name server it is attempting to locate. Traditionally, these glue records have used IPv4 addresses (A records), because the entire global internet was built on IPv4 for decades. As a result, resolvers, registries, and DNS server software have deeply embedded assumptions about the availability of IPv4 glue.

The shift toward IPv6 complicates this. Operators attempting to modernize their infrastructure, improve security, and align with future networking requirements may deploy name servers that are reachable only via IPv6. This is especially attractive in regions or networks where IPv6 adoption is robust, or where IPv4 addresses are cost-prohibitive or unavailable. However, when such IPv6-only name servers are submitted to registries for delegation, they challenge a critical assumption: that glue records will always include an IPv4 address. Some top-level domain registries, including .com and .net, will reject glue that lacks IPv4 addresses altogether, not due to malice or policy, but because their systems—and those of upstream resolvers—still rely on IPv4 glue to ensure reachability and compatibility with the majority of the internet.

This creates a paradox. While IPv6 is the future, and while there is technically nothing preventing a name server from existing solely on IPv6, the current DNS ecosystem is so entrenched in IPv4 glue assumptions that an IPv6-only deployment can result in a domain becoming effectively unreachable by most resolvers. This situation becomes even more complex when combined with older or misconfigured resolvers that either ignore AAAA glue records or fail to process them correctly. Many recursive DNS resolvers still prioritize A records and only attempt AAAA lookups when configured to do so. As a result, an IPv6-only name server that is not accompanied by an IPv4 glue record may be skipped entirely, leaving the domain inaccessible to large swaths of users.

Moreover, certain DNS implementations and toolchains treat missing IPv4 glue as an error, flagging domains without it as misconfigured even when valid AAAA records are present. Automated provisioning systems, registrar interfaces, and monitoring tools often reinforce this bias, creating operational friction for network engineers trying to deploy dual-stack or IPv6-first architectures. In effect, the DNS infrastructure penalizes IPv6 adoption by treating it as a deviation from the norm, despite the technical validity and IETF support for IPv6-only environments.

This friction has real-world consequences. Domains with IPv6-only name servers and no IPv4 glue have experienced outages, failed delegations, or degraded performance in global resolution. Some ccTLD and new gTLD registries, aiming to promote modern network practices, have tried to support IPv6-only setups, only to encounter resistance from legacy root server behaviors, registrar constraints, or compatibility problems with recursive resolvers operated by ISPs. The ripple effects of such breakage can be severe: websites become inaccessible, email fails to route, and services dependent on DNS, such as authentication or IoT connectivity, can fail silently or intermittently—problems that are notoriously hard to debug.

The root of the issue lies in an architectural mismatch between evolving standards and legacy expectations. IPv6 glue records (AAAA) are allowed by DNS standards and supported in many modern implementations, but they are not yet universally supported or required. Without comprehensive updates to DNS resolvers, registrar systems, registry validation logic, and operational best practices, the deployment of IPv6-only name servers remains a gamble. As long as a significant portion of the internet’s population—including entire data centers, corporate networks, and developing countries—still depends on IPv4-only resolvers, abandoning IPv4 glue entirely risks service fragmentation.

Some progress has been made in response to this challenge. DNS software developers have begun to introduce more robust dual-stack support, and some TLD registries have updated their glue validation rules to allow IPv6-only configurations under certain circumstances. ICANN’s Security and Stability Advisory Committee (SSAC) has addressed the topic in several advisories, recommending caution and dual-stack deployments wherever possible to ensure reachability. Similarly, large resolver operators like Google Public DNS and Cloudflare have improved their IPv6 handling, though this does not resolve the issue of smaller resolvers or older devices that are out of update cycles.

A path forward may involve coordinated action among DNS stakeholders. Registries should consider allowing AAAA glue records even in the absence of A records, with clear warnings about compatibility risks. Registrars must adapt their interfaces and APIs to accept and validate IPv6-only configurations without treating them as invalid. Resolver developers should improve fallback logic and make AAAA glue support a default behavior. Most importantly, the community needs clearer operational guidelines on when and how IPv6-only name servers can be safely deployed, especially for mission-critical services.

Until then, IPv6-only name servers will remain a source of contention—a technically sound but operationally risky choice that highlights the inertia embedded in the global DNS. The promise of IPv6 was to usher in a more scalable, modern internet. But unless the supporting systems evolve in tandem, the very infrastructure meant to break free from IPv4 scarcity may itself become a new point of fragility. For those managing DNS infrastructure, the lesson is clear: compatibility is still king, and the road to IPv6 dominance is paved not only with good intentions, but with glue that works for everyone.

As the internet transitions from IPv4 to IPv6, longstanding assumptions about DNS infrastructure are being challenged in ways that carry both technical and operational consequences. One of the more obscure but impactful areas of this transition involves the interaction between IPv6-only name servers and legacy glue records—a fundamental component of how the Domain Name System…