An IPv6-only network gives devices native IPv6 connectivity while transition technologies provide access to services that still exist only on IPv4.
IPv6 destinations are reached directly.
Helps IPv6 clients discover IPv4-only services.
Translates traffic between IPv6 and IPv4.
IPv6-only does not necessarily mean losing access to the IPv4 Internet. Translation allows the two worlds to coexist during the transition.
For many years, Internet-connected devices have commonly received both an IPv4 address and an IPv6 address.
This is known as dual stack.
An IPv6-only network takes a different approach.
Devices use IPv6 as their native network protocol and do not require ordinary IPv4 connectivity.
When the destination also supports IPv6, communication happens directly over IPv6.
No translation is required.
The interesting question is what happens when the destination still supports only IPv4.
This is where technologies such as DNS64, NAT64 and, in some environments, 464XLAT become important.
Running IPv4 and IPv6 simultaneously works well, but it means operating two network protocols at the same time.
Every network, security policy, routing decision and operational process may need to consider both protocols.
IPv6-only networks aim to make IPv6 the normal internal transport while treating IPv4 as a compatibility service.
This can reduce dependence on scarce IPv4 addresses and simplify the long-term transition toward IPv6.
The access network can operate primarily with IPv6 instead of maintaining IPv4 and IPv6 everywhere.
IPv6 provides enough address space to avoid many of the addressing limitations associated with IPv4.
Translation can be used only when an IPv6 client needs to reach an IPv4-only destination.
There are two basic possibilities.
DNS returns an IPv6 AAAA record.
There is no native IPv6 destination to connect to.
Instead, DNS64 and NAT64 can work together to provide compatibility.
DNS64 is a DNS mechanism designed to help IPv6-only clients communicate with IPv4-only servers.
Suppose an IPv6-only device asks DNS for the IPv6 address of a website.
If the website already has an IPv6 AAAA record, DNS returns that address normally.
But if the destination has only an IPv4 A record, DNS64 can create a synthetic AAAA record.
The IPv6 device performs a normal DNS lookup.
The destination is IPv4-only.
The IPv4 address is represented inside a special IPv6 address.
To the client, the result looks like an IPv6 destination.
The client can therefore initiate a normal IPv6 connection.
Imagine an IPv4-only server has this DNS record:
There is no real AAAA record.
A DNS64 resolver can construct an IPv6 address that represents the IPv4 destination.
Using the well-known NAT64 prefix as a simple example, the synthesized result could conceptually look like:
The IPv6-only client connects to the synthesized IPv6 address.
Traffic for that address is routed toward the NAT64 translator.
DNS64 solves the discovery problem.
NAT64 solves the communication problem.
NAT64 is a gateway between an IPv6 network and an IPv4 network.
When the IPv6 client sends packets toward the synthetic IPv6 destination, the NAT64 system recognizes the special address.
It extracts the corresponding IPv4 destination and translates the traffic.
Replies from the IPv4 server travel back through NAT64 and are translated into IPv6 for the client.
Neither endpoint needs to speak both protocols.
DNS64 and NAT64 solve two different parts of the same problem.
| Technology | Role |
|---|---|
| DNS64 | Creates an IPv6 DNS answer for an IPv4-only destination. |
| NAT64 | Translates the actual IPv6 traffic into IPv4 traffic. |
DNS64 tells the IPv6 client where to connect. NAT64 makes the connection work.
From the user's perspective, the website normally behaves like any other destination.
NAT64 is a transition mechanism.
It is not used when both sides already support IPv6.
If a service publishes a real IPv6 AAAA record, an IPv6-only client can communicate with it directly.
| Destination | Connection |
|---|---|
| IPv6-capable service | Native IPv6 |
| IPv4-only service | DNS64 + NAT64 |
As more Internet services support IPv6, less traffic needs translation.
DNS64 works particularly well when applications connect to services using domain names.
But some older applications were designed around IPv4 and may use IPv4 addresses directly.
For example, an application may attempt to connect directly to:
No DNS lookup occurs in that situation.
Because DNS64 is never consulted, it has no opportunity to synthesize an IPv6 address.
This is one reason another transition technology, 464XLAT, is important in some IPv6-only environments.
464XLAT allows many IPv4 applications to continue operating while the underlying network is IPv6-only.
It introduces another translation function close to the client.
This component is commonly called the CLAT, or customer-side translator.
A second translator in the provider network is commonly called the PLAT.
The important idea is that an application can still behave as though IPv4 exists locally while the provider network transports the traffic using IPv6.
Some applications are not completely protocol-independent.
They may:
DNS64 alone cannot fix these cases because DNS may not participate in the connection.
464XLAT provides an additional compatibility layer for many of these applications.
| Technology | What it does |
|---|---|
| DNS64 | Generates synthetic IPv6 DNS answers for IPv4-only destinations. |
| NAT64 | Translates network traffic between IPv6 and IPv4. |
| 464XLAT | Helps IPv4 applications operate across an IPv6-only access network. |
Dual stack and IPv6-only represent two different transition strategies.
| Dual stack | IPv6-only |
|---|---|
| Devices receive IPv4 and IPv6 connectivity | Devices primarily receive IPv6 connectivity |
| IPv4 destinations use native IPv4 | IPv4 destinations are normally reached through translation |
| Two protocols operate throughout the access network | IPv6 becomes the primary network protocol |
| Requires continued IPv4 address management | Can significantly reduce IPv4 requirements at the edge |
Not immediately.
The Internet still contains many IPv4-only systems.
An IPv6-only architecture changes where IPv4 exists.
Instead of providing IPv4 directly to every device, IPv4 compatibility can be concentrated in translation infrastructure.
IPv4 + IPv6 everywhere
IPv6-only approach:IPv6 everywhere + IPv4 translation where needed
IPv6-only networks require careful planning.
Most normal web, email and client-server applications can work well through IPv6 or transition mechanisms, but some legacy applications may still assume native IPv4.
Potential difficulties include:
Technologies such as 464XLAT improve compatibility, but IPv6-only deployment should still be tested against the applications used by the organization.
DNS plays a central role in an IPv6-only environment.
It determines whether the client can reach a destination natively over IPv6 or whether IPv4 compatibility is required.
DNS therefore becomes part of the transition architecture, not simply a directory of Internet names.
Moving to IPv6-only does not remove the role of DNS security.
Devices still resolve domain names before reaching most Internet services.
Protective DNS and RPZ filtering can therefore continue to identify or block malicious domains.
In a DNS64 environment, security policy and DNS64 synthesis should be coordinated so that unwanted destinations can be rejected before a translated connection is created.
Large service providers may need to connect millions of devices.
Continuing to assign IPv4 connectivity to every customer increases dependence on limited IPv4 address space and large-scale address translation.
An IPv6-only access network allows the provider to use IPv6 natively while maintaining a smaller shared translation layer for destinations that remain IPv4-only.
As more destinations become IPv6-capable, the proportion of traffic requiring translation can decrease.
Enterprises can also adopt IPv6-only networks, particularly for new environments where legacy IPv4 requirements are limited.
Possible examples include:
Legacy systems can remain reachable through translation or dedicated compatibility networks while new infrastructure becomes IPv6-native.
The goal is not necessarily to remove every IPv4 system overnight.
Instead, the architectural change is to stop making IPv4 a requirement for every new network and every new device.
IPv6 becomes the normal network.
DNS64, NAT64 and 464XLAT make this possible while significant parts of the Internet still depend on IPv4.
IPv6-only networking does not require waiting until the entire Internet supports IPv6.
IPv6 destinations are reached natively. IPv4-only destinations can be reached through DNS64 and NAT64. 464XLAT provides additional compatibility for applications that still expect IPv4.
This allows organizations and service providers to make IPv6 the primary network protocol while continuing to reach the remaining IPv4 Internet.
DNS64, NAT64 and 464XLAT are standardized technologies documented by the Internet Engineering Task Force.
An IPv6-only network provides IPv6 connectivity to its devices without requiring native IPv4 connectivity. IPv6 destinations are reached directly, while transition mechanisms can provide access to IPv4-only services.
Yes. DNS64 and NAT64 can allow an IPv6-only client to communicate with many IPv4-only servers.
DNS64 can generate a synthetic IPv6 AAAA record from an IPv4 A record so an IPv6-only client can reach an IPv4 destination through NAT64.
NAT64 translates traffic between IPv6 and IPv4, allowing IPv6-only clients to communicate with many IPv4-only services.
464XLAT provides additional IPv4 compatibility across an IPv6-only network and is particularly useful for applications that still expect IPv4 connectivity.
No. Dual stack provides both IPv4 and IPv6. IPv6-only uses IPv6 natively and relies on transition mechanisms when IPv4 compatibility is necessary.
No. IPv4 may remain behind translation infrastructure while end-user networks operate primarily with IPv6.