IPv6 compatibility

import { TabItem, Tabs, Render, DashButton } from "~/components";

Cloudflare enables IPv6 on all domains without requiring additional configuration or hardware (as long as your host provides IPv6 support).

When IPv6 compatibility is turned on, Cloudflare auto generates AAAA DNS records to allow IPv6 clients to connect. On the other hand, when IPv6 compatibility is turned off, Cloudflare does not automatically generate and advertise AAAA DNS for the zone. Client software will determine whether to use IPv4 or IPv6 to connect to a hostname that supports both methods.

For proxied DNS records that have both an IPv6 and IPv4 origin address, Cloudflare will prefer the IPv4 address when connecting to your origin server.

Availability

Enable IPv6 compatibility

By default, IPv6 compatibility is turned on for your domain and will apply to all domains and subdomains covered by proxied DNS records.

:::note If you have signed up for Cloudflare through a Cloudflare hosting partner or by use partial setup, IPv6 compatibility does not apply to your apex domain. :::

Disable IPv6 compatibility

If your origin web server only understands IPv4 formatted IP addresses, non-Enterprise customers should configure Pseudo IPv4.

Alternatively, customers with an Enterprise account can turn off Cloudflare's IPv6 compatibility.

To turn off IPv6 compatibility in the dashboard:

1. In the Cloudflare dashboard, go to the Network page.

2. Turn off IPv6 Compatibility.

To turn off IPv6 compatibility using the API, send a PATCH request with ipv6 as the setting name in the URI path, and the value parameter set to "off".

:::note

Even when IPv6 is turned off, domains may still receive IPv6 traffic (for example, via the Tor network). To completely turn off all IPv6 traffic:

• Turn off Onion Routing.
• Use a WAF custom rule to block 0:0:0:0:0:0:0:0/0 using the condition ip.src in {::/0}.
• Add and cf.worker.upstream_zone == "" to the rule above to avoid blocking Workers subrequests. Workers subrequests use IPv6 addresses, and this condition checks that the request does not come from a Worker script. For more information, refer to the cf.worker.upstream_zone field documentation.

:::

Troubleshoot an IPv6 network issue

Provide the following information to Cloudflare Support if you experience issues with IPv6 connectivity:

• A traceroute that demonstrates the IPv6 connection issues.
• The Cloudflare data center serving your request when the IPv6 issues occur.
• Confirmation of whether disabling IPv6 Compatibility resolves the issue.