FILTER-AAAA(8)

💖 filter-aaaa(8) — the BIND 9 glow-up page 💖

Okay so this is the manual page for filter-aaaa(8) from BIND 9, and it's literally about filtering AAAA records in DNS responses when A is present. Yes bestie, we're doing selective IPv6 hiding, let's go. 🦋

---

✨ NAME ✨

filter-aaaa — filter AAAA in DNS responses when A is present. That's the whole name, periodt. 💅

🌸 SYNOPSIS 🌸

plugin query "filter-aaaa.so" [{ parameters }];

That's the summoning spell, bestie. 🎀

🦋 DESCRIPTION 🦋

filter-aaaa.so is a query plugin module for named, enabling named to omit some IPv6 addresses when responding to clients. It's giving selective AAAA suppression, lowkey. 😭

Until BIND 9.12, this feature was implemented natively in named and enabled with the filter-aaaa ACL and the filter-aaaa-on-v4 and filter-aaaa-on-v6 options. These options are no longer available in named.conf but can be passed as parameters to the filter-aaaa.so plugin, for example:

plugin query "filter-aaaa.so" {
        filter-aaaa-on-v4 yes;
        filter-aaaa-on-v6 yes;
        filter-aaaa { 192.0.2.1; 2001:db8:2::1; };
};

This module is intended to aid transition from IPv4 to IPv6 by withholding IPv6 addresses from DNS clients which are not connected to the IPv6 Internet, when the name being looked up has an IPv4 address available. Use of this module is not recommended unless absolutely necessary. No cap, the manual itself says not recommended unless absolutely necessary — so don't just enable this for funsies. 🙈

Note: This mechanism can erroneously cause other servers not to give AAAA records to their clients. If a recursing server with both IPv6 and IPv4 network connections queries an authoritative server using this mechanism via IPv4, it is denied AAAA records even if its client is using IPv6. That's the messy part, bestie — please read it twice. 💀

⭐ OPTIONS ⭐

• filter-aaaa — this option specifies a list of client addresses for which AAAA filtering is to be applied. The default is any. So if you don't specify, it's literally any client. 🌈
• filter-aaaa-on-v4 — if set to yes, this option indicates that the DNS client is at an IPv4 address, in filter-aaaa. If the response does not include DNSSEC signatures, then all AAAA records are deleted from the response. This filtering applies to all responses, not only authoritative ones. 🫶

If set to break-dnssec, then AAAA records are deleted even when DNSSEC is enabled. As suggested by the name, this causes the response to fail to verify, because the DNSSEC protocol is designed to detect deletions. That's the "break" part, bestie — it's not a cute nickname, it's a warning. 💅

Also, this mechanism can erroneously cause other servers not to give AAAA records to their clients. If a recursing server with both IPv6 and IPv4 network connections queries an authoritative server using this mechanism via IPv4, it is denied AAAA records even if its client is using IPv6. ⚠️

• filter-aaaa-on-v6 — this option is identical to filter-aaaa-on-v4, except that it filters AAAA responses to queries from IPv6 clients instead of IPv4 clients. To filter all responses, set both options to yes. Slay, now you've got both sides covered. 🎀

👑 SEE ALSO 👑

BIND 9 Administrator Reference Manual. — yes, go read the big manual too. 📚

🌸 Author 🌸

Internet Systems Consortium — iconic. 💜

🌈 Copyright 🌈

2026, Internet Systems Consortium — respect the copyright, bestie. 🫶

---

mwah 💋 — this page is from BIND version 9.20.30, dated 2026-10-12, and yes it's the FILTER-AAAA(8) manual. Bye bestie! 💖