To prevent dnsmasq from creating AAAA records for DHCPv6 clients, you must disable the DHCPv6 service entirely using --no-dhcp6 or by omitting it from configuration. Since dnsmasq only generates DNS entries for leases it manages, removing DHCPv6 stops it from associating IPv6 addresses with hostnames. For networks requiring both IPv4 and IPv6, rely on static host-record directives for specific devices or use a separate authoritative DNS server for dynamic IPv6 records.
Understanding the Root Cause
The core issue stems from how dnsmasq handles dynamic host registration. When dnsmasq is configured to provide DHCPv6 services (either via stateful DHCPv6 or as part of a mixed configuration), it receives lease information from clients. By default, if a client requests a hostname or if the server has a mapping, dnsmasq will automatically create an A record for IPv4 and an AAAA record for IPv6 in its internal cache and on disk (ifdhcp-hostsfile is used).
Many administrators assume that tweaking DNS options can suppress just the AAAA record while keeping the DHCPv6 lease active. However, there is no native flag in dnsmasq to "suppress AAAA but keep DHCPv6." The architecture couples the lease management with the DNS generation. If you want dynamic IPv6 addressing for your clients but do not want those addresses reflected in your local DNS zone managed by dnsmasq, you have two primary architectural choices:
1. Remove DHCPv6 from dnsmasq entirely and let another daemon handle IPv6 leasing.
2. Keep DHCPv6 in dnsmasq but explicitly override the DNS behavior for specific hosts using static mappings, though this does not scale well for large dynamic pools.
For most dual-stack home or small office networks, the cleanest solution is to offload IPv6 address assignment to a different service, such as radvd (for SLAAC) or dhcpd (from ISC), while letting dnsmasq focus on IPv4 DHCP and DNS.
Disabling DHCPv6 in dnsmasq
The most direct way to stop dnsmasq from creating AAAA records for dynamically assigned IPv6 addresses is to ensure it is not listening for or managing DHCPv6 traffic. This is achieved by disabling the DHCPv6 functionality in the configuration file. In your/etc/dnsmasq.conf (or included files), look for lines related to DHCPv6. Common configurations might include:
# Example of what might currently be present
dhcp-range=::,constructor:eth0,ra-only
# Or stateful DHCPv6
dhcp-range=2001:db8::10,static,64m
no-dhcp6
--enable-ra combined with DHCPv6 ranges, although --enable-ra alone is often acceptable if you only need Router Advertisements without managing leases. However, note that even with ra-only, if dnsmasq is acting as a DHCPv6 server for other reasons, it may still attempt to register hosts. The no-dhcp6 flag is the definitive switch to turn off all DHCPv6 processing.
After making this change, restart the dnsmasq service:
sudo systemctl restart dnsmasq
Handling IPv4-Only Hostnames
With DHCPv6 disabled, your network remains fully functional for IPv4 communications. Clients will obtain IPv4 addresses via standard DHCP, and dnsmasq will continue to create A records for them as expected. This ensures that tools relying on reverse DNS or forward lookups for local resources continue to work for IPv4 hosts. If you have critical servers that require both IPv4 and IPv6 addresses to be resolvable by name, you must handle the IPv6 side differently. Since dnsmasq is no longer tracking their dynamic IPv6 leases, you have two options: 1. Static Entries: Use thehost-record option in dnsmasq to manually map a hostname to a specific IPv6 address. This is suitable for servers with stable IPv6 prefixes.
host-record=server.example.com,[2001:db8::10]
Using Radvd for SLAAC
Since dnsmasq is no longer providing DHCPv6, you should ensure your network still provides IPv6 connectivity via SLAAC. This is typically handled byradvd (Router Advertisement Daemon). Install and configure radvd to advertise the IPv6 prefix on your interface:
interface eth0 {
AdvSendAdvert on;
MinRtrAdvInterval 3;
MaxRtrAdvInterval 10;
prefix 2001:db8::/64 {
AdvOnLink on;
AdvAutonomous on;
AdvValidLifetime 86400;
};
};
Verifying the Configuration
After applying these changes, verify that AAAA records are no longer being created for DHCPv6 clients. You can check the dnsmasq cache using thednsmasq --cache-size=0 diagnostic mode or by querying the local DNS directly.
dig @localhost AAAA client-hostname.localdomain
dig @localhost A client-hostname.localdomain
Common Pitfalls
Be aware that some distributions package dnsmasq with DHCPv6 enabled by default. Always audit your configuration files after updates. Additionally, if you are using systemd-networkd or NetworkManager, they may attempt to configure dnsmasq settings dynamically. Ensure that your staticdnsmasq.conf overrides any auto-generated settings.
Another common mistake is assuming that ra-only disables DHCPv6 lease management. While ra-only tells dnsmasq not to assign IP addresses via DHCPv6, it does not necessarily prevent it from interacting with the DNS subsystem in complex setups where other components inject data. The no-dhcp6 flag is the safest and most comprehensive method to sever the link between IPv6 leasing and DNS generation.
Frequently Asked Questions
Will disabling DHCPv6 break IPv6 connectivity?
No, disabling DHCPv6 in dnsmasq does not break IPv6 connectivity. Clients will still receive IPv6 addresses via SLAAC (Stateless Address Autoconfiguration) if your router sends Router Advertisements. You simply lose the ability for dnsmasq to manage IPv6 leases and generate corresponding DNS records.How do I make specific servers resolvable via IPv6 if DHCPv6 is off?
You must use static DNS entries. Addhost-record=hostname,[ipv6-address] to your dnsmasq configuration for each server that needs an AAAA record. This bypasses the dynamic lease mechanism and manually maps the name to the address.
Can I use dhcpcd or isc-dhcp-server instead for IPv6?
Yes. If you need dynamic IPv6 address assignment and DNS integration, consider using isc-dhcp-server for IPv6. It can be configured to send DDNS updates to a separate BIND or PowerDNS server, keeping dnsmasq focused solely on IPv4 and caching.Why are AAAA records still appearing after adding no-dhcp6?
Ensure that no other process is injecting AAAA records into dnsmasq. Also, check if you are using--enable-ra alongside other DHCPv6 parameters. The no-dhcp6 flag must be the sole directive regarding DHCPv6 status. Clear the cache with systemctl restart dnsmasq to remove stale entries.