DNS AAAA Record (IPv6 Address Record)

What is a DNS AAAA Record?

The AAAA (Quad-A) record operates identically to the standard A record, but instead of mapping to a 32-bit IPv4 address, it maps a hostname to a 128-bit IPv6 address. As the global supply of IPv4 addresses has depleted, AAAA records have become critical for enabling modern internet infrastructure.

Security Implications of IPv6 AAAA Exposures

While IPv6 provides a massive address space, it introduces distinct threat patterns:

• Bypassing IPv4-only Firewalls: Many legacy corporate firewalls and intrusion prevention systems only inspect IPv4 traffic. If a subdomain has an active AAAA record, clients may bypass security controls by routing over IPv6.
• SLAAC Address Exposure: Stateless Address Autoconfiguration (SLAAC) can leak MAC addresses or physical host details in the IPv6 suffix, allowing threat actors to trace hardware attributes.
• WAF Bypass: Web Application Firewalls (WAFs) must be explicitly configured to inspect IPv6 traffic; otherwise, threat actors can bypass rules by targeting the AAAA endpoint.

Mitigation & Auditing Guidelines

• Dual-Stack Firewall Inspections: Ensure all security boundaries, firewalls, and proxy layers inspect IPv6 traffic with identical parity to IPv4.
• Obfuscate Hardware IDs: Use IPv6 privacy extensions to randomize interface identifiers rather than deriving them from hardware MAC addresses.
• Synchronize A and AAAA Records: Always audit both configurations. An out-of-sync AAAA record can lead to partial site outages or traffic diversion if one of the targets is compromised.