IPv4 works but IPv6 fails: a step-by-step troubleshooting guide

Begin with comparable conditions

IPv4 and IPv6 can resolve to different servers and traverse different networks. Hold the hostname, port, rounds and timeout consistent. If your machine lacks an IPv6 route or the domain has no AAAA record, report missing prerequisites instead of inventing a failed remote measurement.

1. Check DNS and local interfaces

pathtrial dns example.com --server 1.1.1.1
pathtrial diagnose --scenario local

Inspect A and AAAA answers and whether local IPv6 addressing and routing are available. Split DNS, VPNs and TUN interfaces can change the resolver or route. One manually selected resolver is a comparison point, not a substitute for the system resolver.

2. Perform a controlled dual-stack diagnosis

pathtrial diagnose --scenario dual-stack example.com --rounds 5 --timeout-ms 3000 --redact-ips
pathtrial scan example.com --profile web --rounds 5 --redact-ips

Use a domain you own or are authorized to test, with both address families available when possible. Treat SKIP and INCONCLUSIVE as different from failed or successful probes.

3. Separate TCP, TLS and HTTP

IPv6 TCP success with a TLS error is different from an IPv6 TCP timeout. Confirm SNI, certificate identity and the intended Host header if manually choosing destination addresses. Do not claim application health based only on socket connectivity.

4. Record explicit endpoint identity

PathTrial v1.5 supports the guided options --connect-ipv4, --connect-ipv6 and --target-ip when appropriate. Follow the CLI guide and preserve hostname identity when binding to an authorized IP. MCP probes require exact target authorization, with no wildcard bypass.

5. Compare results by category

Observation	Next check
No AAAA result	Determine whether the hostname actually publishes IPv6 service.
No local IPv6 route	Inspect router/VPN and host configuration with authorization.
IPv4 works, IPv6 TCP times out	Repeat with matched budgets and inspect the IPv6 service path.
IPv6 TLS fails after TCP success	Check SNI, certificate and negotiation independently.

Limits and privacy

Neither a traceroute timeout nor a dual-stack difference identifies a specific failing hop or ISP. PathTrial diagnostics are read-only. IP redaction is not complete anonymity: manually review hostnames, DNS, paths and credentials before publishing a report.