Dual stack

A dual-stack device asks DNS for both records. Since February 2003 the address selection rules have preferred IPv6 whenever the device has an IPv6 address of its own. That preference hurt when the device's IPv6 path was broken. The device waited "many seconds" before falling back to IPv4, and IPv6 was "frequently disabled in its entirety" to avoid the wait.

Happy Eyeballs, standardised in April 2012, fixed this. The device tries IPv6 first; if that has not connected after a short delay, it tries IPv4 as well and keeps whichever connects first. The revision of December 2017, by two Apple engineers, recommends a 250 millisecond delay and a 50 millisecond wait for the IPv6 answer from DNS.

A study published in October 2025 measured what clients really do. Every widely used browser preferred IPv6. Chromium-based browsers waited 300 milliseconds, Firefox 250 and curl 200, while Safari varied from 50 milliseconds to 5 seconds. The wget tool, version 1.21.3, did not fall back to IPv4 at all.

IPv6 got its DNS record before it got its transition plan. The AAAA record, which "stores a single IPv6 address", was defined in December 1995. The dual IP layer followed in April 1996, described as "the most straightforward way" for IPv6 devices to stay compatible with IPv4-only ones.

World IPv6 Day, on 8 June 2011, was a one-day event. On 6 June 2012, at World IPv6 Launch, internet providers, home router makers and web companies turned IPv6 on "permanently". Happy Eyeballs was published that April, two months earlier, so that a broken IPv6 path would stop costing visitors "many seconds".

The work continues. In February 2025 the IETF set up a working group for a third version, which adds QUIC and encrypted connection setup to the race. It was still a draft in September 2026.

On 19 September 2026 we looked up the DNS records of the sites our proxy guides are about. Of the 202 with an address, 80 had both records, 122 had an A record only and none had only an AAAA record.

The IPv4-only side includes big proxy targets such as GitHub, Twitch and Roblox as well as the retailers below. For 26 sites the bare domain and the www name differed, so check the exact name you will request.

With a proxy in the path, your own device does not pick IPv4 or IPv6 for the target site. The proxy server looks up the name and connects, so its stack decides. The documentation of older Squid versions says "Squid prefers to contact websites over IPv6". Since version 5, Squid starts with whichever DNS answer arrives first and tries the other family 250 milliseconds later by default.

So a dual-stack proxy can reach Amazon over IPv6 and Walmart over IPv4, and the two sites see different exit addresses. Over IPv6 a site may count the proxy's whole /64 as one visitor. Apple's iCloud Private Relay works the same way: its exit server resolves the name and picks the family, not Safari.

SOCKS5 lets you choose who resolves. With curl, socks5:// resolves the name on your machine and hands the proxy an address, while socks5h:// lets the proxy resolve it. We tested this on a dual-stack machine. Plain socks5:// put an IPv6 address into the request and a public proxy without IPv6 refused it; socks5h:// returned 200.