What each check looks at
The checker asks public DNS resolvers for five record sets: AAAA for the domain, AAAA for www, A for the domain, the NS records and the MX records. It then looks up AAAA records for up to eight nameservers and up to six mail servers. For the two website rows an AAAA answer counts only if it is a public address, so a record pointing at ::1 or a unique local address is treated as missing.
The nameserver and mail rows are DNS checks. They confirm that those hostnames have AAAA records. They do not send a DNS query or open an SMTP session over IPv6. Only the last row touches the site itself: a TCP connection to port 443 on the first usable AAAA address.
How the score is calculated
Each check has a fixed weight, listed below, and the total is capped at 100. The AAAA record on the bare domain carries the most, because without it a visitor who types the name has no IPv6 destination at all.
Two cases are scored leniently. A domain with no MX records receives the full mail points, since there is no mail service to judge. When the checking server has no IPv6 route of its own, the connection row reads Not tested and earns half.
- AAAA on the domain: 30 points, and a fail without it.
- AAAA on www: 15 points, a warning if it is missing.
- Nameservers: 20 when all have IPv6, 10 when some do, a fail when none do.
- Mail servers: 15 when all have IPv6 or there is no MX, 8 when some do.
- Connection to port 443: 20 on success, 10 if untested, 0 on failure.
Fixing what the checker flags
A fail on the first row with the detail Only IPv4 (A) records means no IPv6 address is published for the site. Get the IPv6 address of the service from your host or CDN, add it as an AAAA record beside the existing A record, and do the same for www. Many CDNs and load balancers publish IPv6 as soon as a setting is switched on.
A fail on Website answers over IPv6 deserves attention first. The record exists but the connection was refused or timed out, which usually means the web server is not listening on its IPv6 address or the firewall has no IPv6 rule for port 443.
The nameserver row depends on your DNS provider: if its servers have no AAAA records, only the provider can change that. A Native IPv6 warning appears when the site's address begins with 2002: or 2001:0:, the 6to4 and Teredo ranges. Those are tunnel addresses and should be replaced with one from your host's own allocation.
What this test cannot tell you
One TCP handshake to one address on port 443 is a narrow test. It does not complete TLS or request a page, it does not try port 80, and it ignores any further AAAA records. A site can pass here and still present the wrong certificate or a default page over IPv6, so load it once from an IPv6 connection as well.
Enter the registered domain, not a hostname beneath it. A name like blog.example.com normally has no NS records and no www host of its own, so those rows score nothing and the total stops at 65 even when the host works perfectly over IPv6. Responses may be cached for five minutes, and DNS answers follow record TTLs, so allow for both before re-testing a change.
The checker tests a domain, not your own connection. To see whether your device has an IPv6 address, open What is my IP. For the raw records behind each row, DNS lookup lists the AAAA, NS and MX answers for the domain.