IPv6 support (AAAA record)
Whether the host publishes an AAAA record. Optional — visitors on IPv6-only networks otherwise arrive through their carrier gateway.
An AAAA record publishes the IPv6 address of a host, the way an A record publishes its IPv4 address. A large and growing share of mobile and home connections are IPv6-first; some are IPv6-only and reach IPv4-only sites through their carrier's translation gateway (NAT64), which works but adds a hop and puts the carrier between you and your visitor.
How SiteScan checks
The scan looks up AAAA records for the exact host being scanned (for example www.example.com), not just the bare domain. If at least one exists, the row reads "Present"; otherwise "Missing". Both are neutral or positive — IPv6 is an addition, not a repair, so its absence is never shown as an error.
How to add it
- Many hosts, CDNs and cloud providers assign an IPv6 address on request or by default; add the AAAA record next to the existing A record.
- Make sure the web server actually listens on IPv6 (
listen [::]:443 ssl;in nginx) and the firewall allows it. Publishing an AAAA record that does not answer is worse than none: some clients will wait for a timeout before falling back. - Your TLS certificate covers the name, not the address, so it needs no changes.
- If the site sits behind a CDN, enabling IPv6 there is usually enough.
See this check on your own site
Run a free scan: the report shows this row for your domain along with the other checks of the site audit.
More in “DNS & email”
What SiteScan checks
TLS certificate
- TLS certificate expiry
- Outdated TLS versions (TLS 1.0/1.1)
- TLS certificate chain
- TLS certificate issuer
- Certificate signature algorithm
Domain registration
- Domain registration expiry
- Registered domain name
- Domain registrar
- Domain registration date
- Domain last updated date
- Domain status codes (EPP)
- Domain transfer lock
- Registrar abuse contact
- RDAP and WHOIS data source
Indexing
- robots.txt file
- CSS and JS blocked in robots.txt
- XML sitemap
- Sitemap index file
- Off-domain URLs in the sitemap
- Sitemap lastmod dates
- Broken URLs in the sitemap
- RSS and Atom feed
Addresses & redirects
Security headers
- HTTP security headers and grade
- Strict-Transport-Security (HSTS) header
- Content-Security-Policy (CSP) header
- X-Content-Type-Options: nosniff
- X-Frame-Options and clickjacking
- Referrer-Policy header
- Permissions-Policy header
- HSTS preload list
- CORS and cross-origin reads
- HTTP TRACE method
Delivery & reputation
- Cache-Control header for HTML
- ETag and Last-Modified revalidation
- HTTP/3 and QUIC support
- Server version disclosure in headers
- DNS blocklist (DNSBL) check
Internal links
Exposure
- Exposed sensitive files (.env, .git, backups)
- Directory listing enabled
- Public JavaScript source maps
- Exposed WordPress endpoints
Well-known files
- security.txt file
- llms.txt for AI assistants
- llms-full.txt file
- ads.txt authorized sellers file
- humans.txt file
- Well-known change-password URL
DNS & email
- MX records (mail servers)
- SPF record
- DMARC record and policy
- DNSSEC signing
- CAA record
- Nameserver redundancy
- IPv6 support (AAAA record)
- MTA-STS policy
- TLS-RPT reporting record
- BIMI record (brand logo in email)
- Wildcard DNS record
- Dangling CNAME and subdomain takeover
Privacy & consent
- Analytics and tracking scripts
- Cookie consent banner
- Privacy policy link
- Terms of service link
- Imprint (Impressum)
- Accessibility statement
Core Web Vitals
- Lighthouse performance score
- Largest Contentful Paint (LCP)
- Cumulative Layout Shift (CLS)
- Interaction to Next Paint (INP)
- CrUX field data vs lab data