IPv6 and fallback affect resolution results, route selection, and rule matching. Enable and validate them individually for your network. Do not force IPv6 without stable support, and set nameserver-policy separately for special domains. Without reliable dual stack, disable AAAA responses. Use nameserver-policy to assign upstreams for internal or corporate domains, then verify each domain's path in the logs.
First determine whether you need IPv6
Query A and AAAA records separately and confirm that the device, router, and egress can complete an IPv6 connection. Receiving AAAA without a usable route creates a black hole.
- Do the device and router have stable IPv6?
- Do subscription nodes support IPv6 destinations or UDP?
- Does fallback-filter remove valid results?
- Does a specific domain need nameserver-policy?
Recommended configuration order
- Without stable IPv6, disable IPv6 first or avoid returning AAAA(See Advanced Networking FAQ)
- Set nameserver-policy for internal, corporate, or local domains
- Use logs to confirm which DNS upstream resolved the domain
- When connections black-hole, compare IPv4-only with IPv6 dual stack
IPv6 availability depends on the ISP, router, and system settings
More fallback upstreams are not always better; too many make troubleshooting harder(See DNS documentation)
Do not send internal domains to public DNS