When a server does not need its own IPv4
A server without its own IPv4 has only an IPv6 address: it reaches the outside over IPv6 and reaches resources that stayed on IPv4 through a NAT64 gateway. That pays off when an address costs money and the service needs only IPv6 connections. If you cannot do without IPv4-only services, you will have to add a gateway.
Good candidates are internal services behind a proxy, test benches and cluster nodes. Be careful with a mail server: some recipients may accept mail over IPv4 only. Ordinary NAT has its own article: what NAT is and how it works.
What a separate IPv4 costs and why it keeps getting dearer
A public IPv4 address has become a line item: AWS charges 0.005 dollars per hour for every address since 1 February 2024, Hetzner Cloud charges 0.50 euro per month for a Primary IPv4, and a Primary IPv6 is free. For one server that is little; for a fleet of many machines it adds up.
| Provider | Price | Note |
|---|---|---|
| AWS | 0.005 dollars per hour for a public IPv4, from 1 February 2024 | about 3.6 dollars per month (my conversion) |
| Hetzner Cloud | Primary IPv4 — 0.50 euro per month, Primary IPv6 — free | the price page was edited in 2023 — check it |
The conversion is mine, not an AWS price: 0.005 × 24 × 30 gives about 3.6 dollars. The Hetzner price page was edited in 2023, and prices have been raised since, so check the 0.50 euro on the live page.
The cause of the shortage is pool exhaustion. RIPE NCC ran out of its IPv4 pool in November 2019, and addresses are now handed out from recovered space through a waiting list. On 23 October 2026 it held 806 applicants (LIRs) and the first in line had waited 487 days: roughly 800 applicants and about 16 months. The figure changes, so see the RIPE NCC waiting list page.
How a public address differs from a private one is explained in the article on white and grey IP addresses.
What breaks on a bare IPv6-only host
Everything that lives on IPv4 alone breaks. The most common example is GitHub: on 9 November 2026 github.com, api.github.com, codeload.github.com, objects.githubusercontent.com and ghcr.io have no AAAA records, so git clone from GitHub will not work without NAT64. Only raw.githubusercontent.com has AAAA. This is a measurement, not an assumption.
Repeat the check yourself: records can change, and empty output means the name has no IPv6 address.
dig AAAA github.com +short
dig AAAA raw.githubusercontent.com +shortFor balance: most of the ecosystem is already reachable over IPv6. On 9 November 2026 AAAA records exist for the other names checked, listed in the table.
| Names | AAAA record |
|---|---|
| github.com, api.github.com, codeload.github.com, objects.githubusercontent.com, ghcr.io | none |
| raw.githubusercontent.com | present |
| Docker Hub, npm, PyPI, RubyGems, crates.io, Packagist | present |
| deb.debian.org, archive.ubuntu.com, quay.io, mcr.microsoft.com, proxy.golang.org | present |
A caveat: what was checked is DNS records, not actual operation over IPv6. CDNs and redirects can lead to names without AAAA, so the real test is a trial package install and a trial repository clone.
How NAT64 and DNS64 work
NAT64 (RFC 6146) is a gateway that accepts a connection over IPv6 and, on its own behalf, opens a connection to the server over IPv4. DNS64 (RFC 6147) is a DNS extension: for a name without an AAAA record it makes one up from the A record. Together they give an IPv6-only client access to IPv4-only resources.
Synthesised addresses are built from a prefix. The standard prefix is 64:ff9b::/96 (RFC 6052), and it is not suitable for private IPv4 addresses; for those cases RFC 8215 reserves the local prefix 64:ff9b:1::/48. If a program reaches IPv4 by a numeric address, bypassing DNS, DNS64 cannot help: 464XLAT (RFC 6877) is described for that.
Google Public DNS64 (2001:4860:4860::6464 and 2001:4860:4860::64) is DNS64 only. Without a NAT64 gateway it is useless: the answers point at addresses in 64:ff9b::/96, where you have no route.
How to set up DNS64 step by step
Two components are needed: a DNS resolver with DNS64 and a working NAT64 gateway you have a route to. A resolver without a gateway will not help, and a gateway without a resolver will never be found. First make sure IPv6 is configured on the server, then follow the steps, from checking the address to a trial connection.
- Check that the server has an IPv6 address and a default route; configuration is covered in the article setting up IPv6 on a Linux VPS.
- Put the DNS64 resolver address into the system settings: in
/etc/resolv.confor in the network configuration; if systemd-resolved runs DNS, look at the result inresolvectl status. - Query a name without AAAA and make sure a synthesised address from the gateway prefix comes back.
- Test a real connection, not just the DNS answer:
curl -6to a site without an AAAA record.
ip -6 route show default
dig AAAA github.com +short @<DNS64-resolver>
getent ahostsv6 github.com
curl -6 -sI https://github.com | head -n 1If a synthesised address came back but the connection does not go through, the problem is the gateway: the resolver issued an address, but there is no route to NAT64.
What to check before giving up IPv4
Before giving up IPv4, list everything the server calls out to and check every name for AAAA. Anything missing from IPv6 will go through NAT64 and become a single point of failure. If the list is long or reliability matters, keep IPv4 at least at the entrance.
- GitHub and anything built from its repositories will not work without NAT64.
- External APIs and payment gateways: ask the vendor whether they have IPv6.
- Access to the server itself: your home or office provider must offer IPv6, otherwise you need an intermediate host.
If you still need an IPv4 address, extra addresses are covered in the article on additional IPv4 subnets.
Frequently asked questions
Can I run git clone from GitHub on an IPv6-only server?
Not without NAT64: on 9 November 2026 github.com has no AAAA record, check it yourself with dig AAAA github.com +short. Through DNS64 and a NAT64 gateway the clone works like an ordinary connection.
Is Google DNS64 alone enough?
No. It is only a resolver: it returns addresses from 64:ff9b::/96, and without a NAT64 gateway packets sent to them go nowhere.
What should ZevsHost customers do?
On shared hosting the network is not yours to manage. Our VPS plans already include a dedicated IPv4 address in the price, and a dedicated server comes with an IPv4 address and a /64 IPv6 block, so there is no address to save on here. NAT64 is useful if you deliberately build a network without IPv4, or reach an outside platform over IPv6; on your own server you configure it yourself.