IPv6 issue
Hi,
I’ve noticed that for some domains, I receive a response for dig AAAA from CF, while for others, I do not.
What determines this behavior?
18 Replies
Hi Leo 🙂
I'm trying to understand Cloudflare's behavior, as it responds to IPv6 for some domains but not for others.
are they your domains?
cloudflare has an option to disable ipv6, so the behaviour of not returning AAAA responses would be expected if the owner of the website has done that (as leo correctly said)
a good example of a website with IPv6 disabled is discord.com
Hi Erisa,
Nice to meet you
The option to disable IPv6 in the dashboard only affects the range between cf and the origin servers.
We are looking to disable the previous part of the traffic between the user and the site
I wanted to know if this is something I can configure on the Cloudflare (CF) side, or if it has to be implemented on the development side of the site. Since my client operates with IPv6 on a network that isn’t under CF, we are looking for a more drastic solution.
No,the option to disable IPv6 in the dashboard/api is for communication between user and cloudflare. If you disable IPv6 in the dashboard/api then no AAAA records are returned for proxied records .
We did what you suggested two weeks ago and saw that the requests continued to arrive from certain users on IPv6. Then we contacted CF support and they explained to us that this feature only cancels the requests from CF's side to the servers and not on the part between the user and CF.
They're wrong or we're talking about something different. Could you provide more detail like the domain name and/or screenshot of what you're seeing?
Ticket number might also help, I can't check it because I dont work there but I can pass it on for others to check
Hi, Thank you for your assistance!
This is the ticket details:
Why Cloudflare returns a response to dig AAAA for some domains but not for others? (See Images No. 1 and No. 2).
Is there a specific setting that determines this behavior?
The same client exits the same ASN to a different environment, and arrives using only IPV4 because Cloudflare does not respond on IPV6 for that domain (see Image No. 3).
This is the CF support we get
Sorry but that response is incorrect and is proven as such by the very document they link
Whats the ticket number?
I can understand the confusion but its just not accurate
Ticket no. 01348782
Thanks
Hi, thank you for the information and apologies for any confusion caused. As Erisa mentioned, the IPv6 compatibility option does affect the Client -> Cloudflare connection and would result in IPv6 addresses not being returned if this is toggled off. We are looking into the support response you shared a screenshot of and will address that separately.
Thank you Erisa & Dom!! much appreciated!
Hi Dom,
We still haven’t received a response from support regarding this issue, and it’s becoming increasingly urgent as legitimate traffic is being blocked when coming to CF on IPv6.
Is there any way you can assist us with resolving this? Your help would be greatly appreciated.
Hi again!
I’d like to provide an update: the customer, who runs their production environment on version 6, has switched to version 0 for testing.
They disabled IPv6 compatibility in that environment (version zero), contacted the customer again, and confirmed that it now works for them (traffic coming to Cloudflare over IPv4).
Could it be that enabling IPv6 compatibility in version 0 (even though it’s not their production environment) affected the entire environment?
Hi @Nitzan, thanks for your patience and sorry for the delay. I have worked with our support team to reproduce the zone versioning issue you mentioned and this has been escalated. You should see a reply on the case now.
Hi Dom,
Thanks so much for your help—it's greatly appreciated!
I just saw the response on the ticket, and it’s definitely strange that a setting from version 0 impacted production traffic in version 6.
I’ll wait for an update from Cloudflare's internal engineering team.
Thanks again 🙏
Hi there, just closing the loop here. IPv6 compatibility was incorrectly identified as a Versionable setting on the dashboard. This has now been corrected and you will find this option in the Global settings instead. Thanks for your patience while our team resolved this.