NAT64
A translator that lets IPv6-only devices reach IPv4-only sites. It shares a pool of IPv4 addresses among many users, so those sites see the carrier's address.
Updated 19 September 2026 · 15 primary sources
NAT64 is a translator that lets a device with only IPv6 reach a site with only IPv4. The device connects to a synthetic IPv6 address that stands for the site, and the translator rewrites the traffic into IPv4 on the way out. The site sees one of the translator's public IPv4 addresses, which it shares among many users.
Its partner is DNS64, which makes up those synthetic addresses. When a site has only an A record, DNS64 answers with an IPv6 address. It builds that address from the well-known prefix 64:ff9b::/96 and the site's IPv4 address. Both were standardised in April 2011.
How NAT64 and DNS64 work together
We asked Google's public DNS64 service about the 202 sites our proxy guides cover on 19 September 2026. The 80 sites with their own IPv6 got their real addresses back. All 122 IPv4-only sites got a synthesized address inside 64:ff9b::/96, so an IPv6-only phone would reach them only through its carrier's NAT64.
7-Eleven's site, for example, came back as 64:ff9b::2d3c:2268. The last 32 bits, 2d3c:2268, are its IPv4 address 45.60.34.104 written in hexadecimal, which is how the translator knows where to send the traffic.
| Answer | Sites | How an IPv6-only phone reaches them |
|---|---|---|
| The site's own IPv6 address | 80 | Directly over IPv6 |
| A synthesized 64:ff9b:: address | 122 | Through the carrier's NAT64 |
| No answer | 0 | Not at all |
Where NAT64 came from
The first translator, NAT-PT, was standardised in February 2000. In July 2007 the IETF judged its problems "sufficiently serious" and moved it to Historic status. NAT64 and DNS64 replaced it in April 2011, with the prefix 64:ff9b::/96 fixed six months earlier.
Translation alone broke some apps, because they carry IPv4 addresses inside their own data. T-Mobile US met this when it ran short of IPv4 addresses. It helped write 464XLAT, published in April 2013. That standard adds a small translator on the phone, so apps such as Skype and WhatsApp keep working. By June 2014 it ran on 8 million T-Mobile phones.
A standard of November 2013 lets a device find the network's prefix by looking up the name ipv4only.arpa. From 1 June 2016, Apple required every app submitted to its App Store to work on IPv6-only networks. A second prefix, 64:ff9b:1::/48, was set aside for local use in August 2017.
| Technique | How IPv4 is reached | What an IPv4-only site sees |
|---|---|---|
| NAT-PT, February 2000, Historic since 2007 | A translator at the network edge | An address from its IPv4 pool |
| NAT64 and DNS64, April 2011 | Synthetic IPv6, translated in the network | The translator's shared IPv4 |
| DS-Lite, August 2011 | IPv4 carried inside IPv6 to the provider | The provider's shared IPv4 |
| 464XLAT, April 2013 | A translator on the phone plus NAT64 | The carrier's shared IPv4 |
NAT64 and proxies
A mobile proxy on an IPv6-only carrier has two faces. Sites with an AAAA record see the phone's own IPv6 address, which belongs to one /64 and so to one phone. IPv4-only sites see the carrier's NAT64 address, shared among many subscribers much as carrier-grade NAT shares one. Among our 202 targets, that is 80 sites of the first kind and 122 of the second.
Servers can sit behind NAT64 too. On AWS, IPv6-only workloads "can only send and receive IPv6 network packets", so a resolver synthesizes 64:ff9b:: addresses and a NAT gateway translates. A proxy on such a server reaches IPv4-only sites from the gateway's address, not its own.
IPv6-only networks are still rare among RIPE Atlas volunteers. On 18 September 2026, 189 of 13,948 connected public probes had IPv6 only, and their hosts had tagged 35 probes nat64 and 17 464xlat.
How HProxy handles it
Our proxy IP checker answers over IPv4 and IPv6. Opened through a mobile proxy, it shows whether that connection reached a dual-stack site over the phone's own IPv6 or over a shared IPv4 address.
Frequently asked questions
What is NAT64?
A translator that lets devices with only IPv6 reach sites with only IPv4. The device sends IPv6 to a synthetic address, the translator rewrites it into IPv4, and the site sees the translator's shared IPv4 address.
What is the difference between NAT64 and DNS64?
DNS64 invents the addresses and NAT64 carries the traffic. DNS64 answers a lookup for an IPv4-only site with a synthetic IPv6 address; NAT64 receives traffic to that address and translates it into IPv4.
What is 464XLAT?
NAT64 plus a small translator on the device. Apps that insist on IPv4 hand their traffic to the device's translator, which turns it into IPv6; the carrier's NAT64 turns it back into IPv4. The name describes the path: IPv4 to IPv6 to IPv4.
What is 64:ff9b::/96?
The well-known prefix for translated addresses, defined in October 2010. The last 32 bits of an address inside it are an IPv4 address, so 64:ff9b::2d3c:2268 stands for 45.60.34.104.
Is NAT64 the same as carrier-grade NAT?
No, but both share public IPv4 addresses among many users. Carrier-grade NAT translates IPv4 to IPv4 for all IPv4 traffic. NAT64 translates IPv6 to IPv4, and only for traffic to IPv4-only sites.
Do mobile proxies use NAT64?
When the phone sits on an IPv6-only carrier network, its traffic to IPv4-only sites goes through the carrier's NAT64. Its traffic to dual-stack sites goes out over the phone's own IPv6 address.
How do I know if my network uses NAT64?
Look up the AAAA record of ipv4only.arpa, a name that exists only as IPv4. If you get an IPv6 answer, your network's DNS64 made it up, and the prefix it used is the one your NAT64 listens on.
Sources
- RFC 2766: Network Address Translation - Protocol Translation (NAT-PT), IETF, 2000-02.
- RFC 4966: Reasons to Move the Network Address Translator - Protocol Translator (NAT-PT) to Historic Status, IETF, 2007-07.
- RFC 6052: IPv6 Addressing of IPv4/IPv6 Translators, IETF, 2010-10.
- RFC 6146: Stateful NAT64: Network Address and Protocol Translation from IPv6 Clients to IPv4 Servers, IETF, 2011-04.
- RFC 6147: DNS64: DNS Extensions for Network Address Translation from IPv6 Clients to IPv4 Servers, IETF, 2011-04.
- RFC 6333: Dual-Stack Lite Broadband Deployments Following IPv4 Exhaustion, IETF, 2011-08.
- RFC 6877: 464XLAT: Combination of Stateful and Stateless Translation, IETF, 2013-04.
- RFC 7050: Discovery of the IPv6 Prefix Used for IPv6 Address Synthesis, IETF, 2013-11.
- RFC 8215: Local-Use IPv4/IPv6 Translation Prefix, IETF, 2017-08.
- Case Study: T-Mobile US Goes IPv6-only Using 464XLAT, Internet Society, 2014-06-13.
- Supporting IPv6-only Networks, Apple Developer, 2016-05-04.
- Google Public DNS64, Google for Developers, 2024-09-03.
- DNS64 and NAT64 (Amazon VPC User Guide), Amazon Web Services, 2026-09-19.
- RIPE Atlas probe archive, RIPE NCC, 2026-09-18.
- DNS64 answers for the 202 sites covered by our proxy guides, HProxy measurement, 2026-09-19.
Back to the full glossary.