News
IPv6 AAAA vs Origin IP Exposure on CDNs
June 30, 2024
IPv6 AAAA vs origin IP exposure on CDNs is the same bypass class as a leftover A record, in 128-bit clothing. Visitors should resolve your public hostname to the CDN or anycast edge. If AAAA (or A) still points at the origin VPS, clients and scanners can skip the WAF. Alt-Svc that names an origin IP is a cousin. Dangling CNAMEs are another. IPv6 is not a vulnerability; a public AAAA to the origin is a map. RoastMyOpsec inspects landing headers for banners and CDN fingerprints. It does not query DNS A/AAAA, does not probe origin IPs, and does not score missing IPv6 as an F.
The practical difference
A and AAAA are how browsers find an address. The origin should accept traffic only from the CDN. The public DNS should not publish that origin address on the brand name — or on a guessable origin.example.com. See CDN fingerprints vs origin exposure and Alt-Svc vs origin IP.
Enabling IPv6 on the edge is fine and often good. Enabling IPv6 only on the origin while the hostname still has AAAA is how you split-brain the protection.
How to choose DNS
Public hostname: A and AAAA to the CDN, matching www vs apex policy. Origin: firewall to CDN egress, no public AAAA on a name people will guess. Dual-stack edge: keep both families on the CDN, not one family on the origin. Do not copy origin AAAA into the zone 'so IPv6 works' without the CDN in front.
| Record / header | Healthy shape | Miss | Takeaway |
|---|---|---|---|
| AAAA on brand name | CDN / anycast | Origin VPS address | Same class as a leaked A |
| A on brand name | CDN | Origin IPv4 | See CDN vs origin guide |
| Alt-Svc | h3 on the public name | Origin IP in the advertisement | See Alt-Svc vs origin IP |
| Dangling CNAME | Remove or claim | Abandoned SaaS | See dangling CNAME |
When IPv6 still wins
IPv6 on the CDN hostname wins for reachability. Origin AAAA on the brand name never wins. Missing AAAA on a brochure is a product choice, not a roast F. Pair with www vs apex so you do not publish the loser hostname as a secret IPv6 origin.
What the roast can prove
Banner and CDN-shaped headers on the HTML response can surface. DNS is out of scope. Confirm A/AAAA in your DNS console. Pair with dangling CNAMEs if a leftover name still resolves.
Common mistakes
The first mistake is adding AAAA for the origin because IPv4 is already proxied and IPv6 'was forgotten at the CDN.'
The second mistake is origin.example.com with a public AAAA and no firewall.
The third mistake is treating missing IPv6 as an OPSEC vulnerability.
Free audit the URL you own
RoastMyOpsec is a defensive public-surface roast: headers, cookies, sensitive paths, and more — no exploit payloads. Start with the free audit, then open the vault if the blurred findings look expensive.
Free audit nowFAQ
- Is IPv6 a vulnerability?
- No. A public AAAA that points at the origin instead of the CDN is the miss.
- Must marketing sites publish AAAA?
- Only if the edge actually serves IPv6. Missing AAAA is not a roast F.
- Does RoastMyOpsec query AAAA?
- No. It does not look up DNS or probe origin IPs.