What breaks on an IPv6-only VPS in 2026

github.com has no AAAA record. api.github.com, ghcr.io, codeload.github.com, ssh.github.com, and the hostnames that serve release files are empty too. raw.githubusercontent.com answers, at 2606:50c0:8000::154, 2606:50c0:8001::154, 2606:50c0:8002::154, and 2606:50c0:8003::154. Debian, Ubuntu, Docker Hub, PyPI, npm, crates.io, and Let's Encrypt answer as well. An IPv6-only VPS can install packages and request a certificate. A clone, a pull from ghcr.io, and a call to api.github.com stop at the resolver.

Google's IPv6 statistics put the share of users reaching Google over IPv6 at 49.18%. 6to4 and Teredo are at zero, so that figure is native IPv6. The daily series published with the chart peaks at 51.69%, and 27 days in it are at or above 50%. The latest point is 49.18%. Hetzner charges €0.50 a month, excluding VAT, for a primary IPv4, and lists primary IPv6 at no charge. AWS lists a public IPv4 at $0.005 an hour. Across 730 hours that is $3.65.

Each row is dig +short AAAA. An empty cell is a name that printed nothing.

for h in github.com api.github.com ghcr.io raw.githubusercontent.com; do
  echo "== $h"
  dig +short AAAA "$h"
done

github.githubassets.com has AAAA records, so the files that draw the website can load over IPv6. codeload.github.com is the host HTTPS git uses for the repository data, and it printed nothing. ssh.github.com printed nothing, so git over SSH has no address to open. ghcr.io and pkg.github.com printed nothing. deb.debian.org, security.ubuntu.com, archive.ubuntu.com, and ppa.launchpad.net answered, and so did docker.io, registry.hub.docker.com, registry.k8s.io, and acme-v02.api.letsencrypt.org. apt works. A pull from Docker Hub works. A certificate request to Let's Encrypt works, for a name that itself has IPv6 and can be reached on port 80. api.stripe.com, api.sendgrid.com, api.mailgun.net, api.postmarkapp.com, hooks.slack.com, discord.com, and ollama.com printed nothing. A checkout call, a mail API, a webhook, and a model download all stop in DNS.

IPv6 adoption on Google's chart

Each point is the last day of a year in that daily series. The 2025 point is 49.23%. The latest point in the same series is 49.18%, and the highest point is 51.69%. Twenty-seven days in the series are at or above 50%.

France is at 86.5%, Germany at 75.8%, India at 69.4%, and the United States at 54.8%. Italy is at 18.7%, Spain at 12.4%, China at 6.9%. In those last three, most of the users Google measured arrived over IPv4. An IPv6-only address misses them.

NAT64 and DNS64

DNS64 writes an AAAA answer when a name has only an A record. The address it writes sits in a prefix that routes to a NAT64 gateway. The gateway pulls the IPv4 address back out of the IPv6 address and opens an ordinary IPv4 connection. Google Public DNS64 uses the prefix 64:ff9b::/96 and these resolvers:

nameserver 2001:4860:4860::6464
nameserver 2001:4860:4860::64

Google's page says to use those two addresses and no others, and only on a network that can already reach a NAT64 gateway for 64:ff9b::/96. The resolver answers the name. Packets to the synthetic address have to find that gateway on their own. With no route to the prefix, the clone still fails.

nat64.net runs a resolver and a gateway together. The getting-started list is three nameservers, and the page says configuring them is the whole setup:

nameserver 2a00:1098:2b::1
nameserver 2a00:1098:2c::1
nameserver 2a01:4f9:c010:3f02::1

git clone then leaves through that operator's translator. A gateway you run yourself sits on a small dual-stack VM, with 64:ff9b::/96 routed from the IPv6-only host. Jool and Tayga are the programs that do the translation on Linux. The dig results in the table are the published records, queried without a DNS64 resolver.

A synthetic AAAA is absent from the signed zone. A stub that validates DNSSEC throws the answer away, and the lookup fails closed. The registrar still trusts the old key is that closed failure on a zone you operate: when the signatures do not check out, the name stops resolving. Validate the real A record on the resolver that does the synthesis, and leave the client off validation for the synthetic answer.

IPv4 visitors and an IPv6-only address

49.18% is the share of Google's users who reached Google over IPv6. The other 50.82% in that measurement arrived over IPv4. A client with no IPv6 route cannot open an IPv6-only address. A hostname pointed at a dual-stack proxy still opens. A small dual-stack VM in front of the IPv6-only box does the same job for one service. Leaving the IPv4 on the public box is the address in Hetzner's €0.50 line.

Hetzner's cloud FAQ says an IPv6-only server has a public network and no public IPv4. The same page says a load balancer takes IPv4 targets, public or private. An IPv6-only server can be a target once it has a private IPv4 on the load balancer's network. Attaching or removing a primary address requires the server to be off, and a primary IPv6 added after creation needs a manual configuration on the guest.

A game port has the same shape. The player is handed an address and a port. IPv4-only players never finish the handshake.

NodeRings IPAM says every customer VM receives a static IPv4 and a static IPv6, and that IPv6-only guest networks are not supported. The additional IPv4 guide starts from a VM that already has a primary IPv4, and it allows up to 10 extra addresses from the same prefix.

nginx, sshd, and Docker on IPv6

nginx's listen parameter ipv6only is on by default. It decides whether a socket on [::] accepts IPv6 only or both families, and the default is IPv6 only. One listen [::]:443 ssl; takes IPv6 connections. IPv4 clients never arrive on it. On an IPv6-only VPS that single line matches the host. On a dual-stack VPS the IPv4 line has to stay beside it. Delete the second line and IPv4 health checks stop arriving.

server {
    listen [::]:443 ssl;
    listen 443 ssl;
}

sshd reads AddressFamily. The man page lists any as the default, inet for IPv4 only, and inet6 for IPv6 only. A config copied from an IPv4 image, with AddressFamily inet still set, refuses the IPv6 session you would use to repair it.

Docker's IPv6 page turns IPv6 on for the default bridge with two keys. ip6tables is already on, and setting it off skips the IPv6 filter rules that publish container ports.

{
  "ipv6": true,
  "fixed-cidr-v6": "2001:db8:1::/64"
}

2001:db8:1::/64 is the documentation prefix on that page. Replace it with a prefix routed to the host. When the containers only talk to each other, a unique-local prefix from fd00::/8 is the range Docker's page points at.

ICMPv6 Packet Too Big is how a sender learns that a packet did not fit the path. A firewall that drops ICMPv6 leaves TCP stuck on the first large write. ping -6 tells you the address answers. A transfer of more than a few kilobytes tells you the path MTU still gets through.

What an IPv4 address costs on a VPS

Hetzner's primary IP table lists IPv4 at €0.0008 an hour and €0.50 a month, excluding VAT, and at $0.0010 an hour and $0.60 a month. IPv6 is the free row. The server and the address are separate lines on the invoice. You add the family you want.

AWS lists $0.005 an hour for a public IPv4 that is in use, and the same $0.005 for one sitting idle in the account. 730 hours at that rate is $3.65.

That €0.50 keeps git clone, ghcr.io, Stripe, and the visitors who arrived over IPv4. Leave it on the box people connect to. An IPv6-only address fits a machine whose outbound calls are the mirrors in the table, or one that has a NAT64 route to the names that are still empty.

Does git clone work on an IPv6-only VPS?

A resolver that returns the published records keeps returning an empty AAAA for github.com. 8.8.8.8 and 1.1.1.1 are in that group. Google's DNS64 addresses, 2001:4860:4860::6464 and 2001:4860:4860::64, synthesize an answer inside 64:ff9b::/96. The clone completes once a packet to that prefix reaches a NAT64 gateway. nat64.net's three nameservers are aimed at a gateway that service already runs.

Can IPv4 visitors open an IPv6-only site?

They can open a hostname that points at a dual-stack address. They have no route to the IPv6-only address itself. In Google's measurement, 49.18% of users reached Google over IPv6, and the other 50.82% arrived over IPv4.

Does DNS64 break DNSSEC?

The synthetic address is not in the signed zone, so a validating stub rejects it and the name fails closed. Do the synthesis on a resolver you trust, after it has validated the A record. The registrar still trusts the old key is the same closed outcome when a zone you operate no longer matches the parent.

Can you send mail from an IPv6-only VPS?

Gmail's MX hosts have AAAA records, and so does smtp.gmail.com, so a delivery to Gmail and a submission through Gmail can both be attempted over IPv6. api.sendgrid.com, api.mailgun.net, and api.postmarkapp.com have none, so those HTTP APIs stay unreachable until something translates. Mail from an IPv4-only sender to a listener that has only IPv6 never shows up. Whether the provider lets the session out on port 25 is a separate gate, covered in Which VPS providers still open port 25. The records a receiving host checks are in SPF, DKIM and DMARC for the 2026 Gmail and Outlook rules.

Can a game server run IPv6-only?

The process can bind to the IPv6 address. A player on IPv4 never completes the handshake. The address you hand that player has to be one they can route. Order the game from the host you want is the player side of that address, still an ip:port.