How We Test IPv6 Readiness
IPv6 is the next-generation internet addressing system that will eventually replace IPv4 — the current system that is fast running out of addresses. This monitor checks whether Malaysian websites are ready for an IPv6-connected world, testing everything from basic website connectivity to email delivery and DNS security.
How Scoring Works
Each domain receives a score from 0 to 100%. Checks are grouped into four categories, each with a different weight reflecting its importance to real-world IPv6 readiness.
Status Tiers
Informational checks (marked Info) do not contribute to the score — they provide useful context without penalising domains for features outside their control.
Web Services
35% weightThe web checks confirm that your website is actually reachable over IPv6 — not just that you have an IPv6 address, but that visitors can connect, load pages securely, and do so even on networks that no longer support IPv4.
AAAA Record
ScoredDNS stores two types of address records — A records for IPv4, AAAA for IPv6. This check confirms your domain publishes at least one IPv6 address in the global DNS system.
Why it matters
Without an AAAA record, IPv6-only users and networks simply cannot look up your website — it is invisible to them.
Globally Routable IPv6
ScoredNot all IPv6 addresses are usable on the public internet. Some ranges are reserved for private networks, testing, or documentation. This check verifies your address is a real, publicly reachable one.
Why it matters
A private or reserved IPv6 address causes connection failures for anyone trying to reach you over IPv6, even if an AAAA record exists.
HTTP over IPv6
ScoredTests whether your web server accepts connections on port 80 (the standard HTTP port) when we connect to it exclusively over IPv6.
Why it matters
Even if you prefer HTTPS, port 80 handles initial connections and redirects. A server that ignores IPv6 on port 80 will time out for IPv6-only visitors.
Also measures: latency
When the connection succeeds, we record the Time To First Byte (TTFB) — measured from the moment we open the TCP connection until your server sends its first byte of response. This is reported in milliseconds and shown alongside the pass result.
HTTPS over IPv6
ScoredTests whether your web server accepts secure HTTPS connections (port 443) over IPv6. This is the connection type used by virtually all modern websites.
Why it matters
Most web traffic today is HTTPS. If your server only accepts HTTPS over IPv4, IPv6-only visitors will see a connection error.
Also measures: latency
When the connection succeeds, we record the Time To First Byte (TTFB) over the encrypted IPv6 connection — including DNS resolution, TCP handshake, TLS negotiation, and server response time. Reported in milliseconds alongside the pass result.
IPv6-Only Reachability
ScoredSimulates what happens when a visitor's network has no IPv4 at all — as is increasingly the case on mobile and enterprise networks. We attempt to reach your site with IPv4 completely disabled.
Why it matters
Many networks now issue only IPv6 addresses. If your site depends on IPv4 as a fallback, those visitors will be unable to reach you at all.
TLS Certificate Valid (IPv6)
ScoredWhen connecting over IPv6, we verify your SSL/TLS security certificate is valid, has not expired, and correctly matches your domain name. We also record the issuing authority and expiry date.
Why it matters
A certificate mismatch or expiry over IPv6 triggers browser security warnings that stop visitors in their tracks — even if IPv4 connections work perfectly.
Dual-Stack (IPv4 + IPv6)
ScoredChecks that your domain publishes both an A record (IPv4) and an AAAA record (IPv6), supporting both types of visitors simultaneously.
Why it matters
During the long transition to IPv6, dual-stack ensures no visitor — on old or new infrastructure — is left behind while the internet migrates.
HTTP/3 (QUIC)
Scored
HTTP/3 is the latest version of the web protocol, built for speed and reliability on modern networks. This check
looks for the Alt-Svc: h3 response header that tells browsers your server supports it.
Why it matters
HTTP/3 is natively IPv6-friendly and delivers faster page loads, especially on mobile. It is a strong signal of modern, forward-looking infrastructure.
DNS & DNSSEC
25% weightDNS (Domain Name System) is the internet's phone book — it translates domain names into IP addresses. These checks verify that your DNS infrastructure itself is reachable over IPv6, and that DNSSEC cryptographic signatures are in place to prevent DNS tampering.
NS Has AAAA Record
ScoredNameservers are the servers that answer questions like "what is the IP address of this domain?". This check verifies whether your nameservers themselves have IPv6 addresses published.
Why it matters
If your nameservers cannot be reached over IPv6, resolvers on IPv6-only networks may fail to look up your domain entirely.
NS Reachable via IPv6
ScoredHaving an IPv6 address is not enough — we verify the nameserver actually accepts TCP connections on port 53 (the DNS port) when contacted over IPv6.
Why it matters
A nameserver that doesn't respond over IPv6 causes DNS lookup failures for IPv6-native networks, making your whole domain unreachable for those users.
NS Answers Queries via IPv6
ScoredGoes one step further than connectivity — we actually send a DNS query to your nameserver over IPv6 and confirm it returns a valid answer, not just an open port.
Why it matters
Some servers accept the connection but fail to process queries over IPv6 due to misconfiguration. This check catches that subtle but impactful problem.
DNSSEC Validated
ScoredDNSSEC (Domain Name System Security Extensions) adds cryptographic signatures to DNS records so your browser can verify it is getting the genuine answer and not a forged one. We perform a full chain-of-trust validation.
Why it matters
Without DNSSEC, attackers can redirect visitors to fake websites by poisoning DNS caches — a technique known as DNS spoofing. DNSSEC prevents this.
Reverse DNS (PTR Record)
ScoredWhile AAAA records map names to addresses, PTR records map addresses back to names. This checks whether your IPv6 address has a PTR record published in the ip6.arpa reverse lookup zone.
Why it matters
PTR records are essential for email delivery, network diagnostics, and trust — many spam filters reject mail from servers with no reverse DNS entry.
DS Record at Parent
InfoThe Delegation Signer (DS) record is published by your domain registrar in the parent zone (e.g. .my), linking to your DNSSEC keys. Its presence is required for DNSSEC to work end-to-end.
Why it matters
Without a DS record at the parent zone, the DNSSEC chain of trust is broken — validation fails even if everything else is configured correctly.
RRSIG Valid
InfoRRSIG records are the actual digital signatures that DNSSEC uses to sign your DNS data. This confirms they are present and have not expired.
Why it matters
Expired RRSIG records cause DNSSEC validation failures. Modern resolvers treat this as a potential attack, which can block access to your site entirely.
Signing Algorithm
InfoDisplays which cryptographic algorithm is used to sign your DNSSEC records (for example ECDSAP256SHA256 or RSASHA256). This is informational — we display it but do not score it.
Why it matters
Older signing algorithms have known weaknesses. Modern algorithms like ECDSA P-256 provide strong security with smaller key sizes — worth knowing if you manage your own DNS.
Email Services
25% weightEmail is as critical as the web for most organisations. These checks verify that your mail infrastructure works over IPv6 and that you have deployed the three key anti-spam and anti-spoofing standards: SPF, DKIM, and DMARC.
MX Record Exists
ScoredAn MX (Mail Exchange) record tells the internet which server handles email for your domain. This check confirms at least one MX record is published in DNS.
Why it matters
Without an MX record, email sent to your domain has nowhere to go — messages will bounce immediately with a "no route to host" error.
MX Server Has IPv6
ScoredChecks whether your mail server (as named in the highest-priority MX record) resolves to an IPv6 address.
Why it matters
As email infrastructure migrates to IPv6, mail servers without IPv6 addresses may be unable to receive messages from IPv6-only sending servers.
SMTP Reachable via IPv6
ScoredSMTP is the protocol used to deliver email between mail servers. We connect to your mail server on port 25 over IPv6 and verify it responds with a proper greeting message.
Why it matters
A mail server that doesn't accept SMTP connections over IPv6 will silently fail to receive email from IPv6-only senders — a growing category as the internet transitions.
STARTTLS over IPv6
ScoredSTARTTLS upgrades a plain email server connection to an encrypted one. We check that your mail server supports this when we connect to it over IPv6.
Why it matters
Encrypted email transport protects message content in transit and is increasingly required by major email providers. Missing STARTTLS means unencrypted delivery for IPv6 senders.
SPF Record
ScoredAn SPF (Sender Policy Framework) record is a DNS entry that lists which servers are authorised to send email on behalf of your domain.
Why it matters
Without SPF, anyone can send email pretending to be from your domain. SPF allows receiving servers to reject forged messages — it is a baseline anti-spam requirement.
DMARC Record
ScoredDMARC (Domain-based Message Authentication, Reporting and Conformance) builds on SPF and DKIM to tell receiving mail servers what to do when authentication fails — reject, quarantine, or simply report it.
Why it matters
DMARC prevents domain spoofing used in phishing attacks. Major providers like Google and Microsoft now require DMARC to reliably accept email from your domain.
DKIM Selector
InfoDKIM (DomainKeys Identified Mail) allows your mail server to cryptographically sign outgoing emails, proving they have not been tampered with in transit. We probe common selector names to detect whether a DKIM public key is published in DNS.
Why it matters
DKIM signatures are a strong signal of email authenticity. Without them, your legitimate email is more likely to land in recipients' spam folders.
IPv4 Baseline
15% weightThe vast majority of internet traffic still travels over IPv4. These three baseline checks confirm your website is healthy on the current internet — because IPv6 readiness is only meaningful if the fundamentals are working.
A Record
ScoredAn A record maps your domain name to an IPv4 address. This confirms your domain still resolves to a valid IPv4 address in DNS.
Why it matters
The majority of internet users are still on IPv4. Maintaining an A record ensures existing visitors are not cut off during your transition to IPv6.
HTTP over IPv4
ScoredTests whether your web server responds to HTTP connections (port 80) when connected over IPv4 — the standard internet used by most visitors today.
Why it matters
This is a fundamental health check. A server failing here indicates serious infrastructure problems that need addressing before IPv6 concerns.
Also measures: latency
When the connection succeeds, we record the Time To First Byte (TTFB) over IPv4 in milliseconds. This provides a baseline to compare against the IPv6 result on the same domain.
HTTPS over IPv4
ScoredTests whether your web server responds to secure HTTPS connections (port 443) over IPv4.
Why it matters
HTTPS over IPv4 must work correctly before IPv6 readiness is meaningful. Most modern browsers require HTTPS — a failing result here affects all visitors.
Also measures: latency
When the connection succeeds, we record the TTFB over the encrypted IPv4 connection — including TCP handshake, TLS negotiation, and server response time. Reported in milliseconds as an IPv4 baseline.
Frequently Asked Questions
My domain scored "Full IPv6 Ready" — do I need to do anything?
No action required. A Full score means your domain scored ≥ 90% and meets the highest standard we test for. We recommend monitoring periodically as certificates expire and configurations change.
What does "Partial Support" mean in practice?
Partial means your domain scored between 30% and 89%. Some IPv6 users or networks may experience issues reaching your site or receiving your email. Check the individual check results to see which areas need improvement.
How often are the results updated?
Registered domains are checked on a regular schedule. Results shown on domain pages reflect the most recent check. You can also trigger an immediate re-check from the domain detail page (admin users), or test any domain yourself using the domain checker.
Can I test a domain that isn't in the list?
Yes — the Check Domain page lets anyone test any domain for free. Results are shown immediately in your browser and are never saved to the database.
What are "Informational" checks?
Informational checks (marked Info) provide useful context about your configuration — such as the DNSSEC signing algorithm or DKIM selector — but do not contribute to your score. We include them because they are worth knowing, not because their absence should penalise your domain.
Who runs this monitor?
This platform is a joint initiative by My6 Initiative Berhad and Pendakwah Teknologi Solutions, with the goal of accelerating Malaysia's transition to an IPv6-ready nation. For enquiries, contact contact@my6.my.