From Monday, every instance we build arrives with an IPv6 /64 routed to it. No request, no ticket, no checkbox, no charge. Existing instances were given theirs during the same rollout and nobody had to ask.
Anyone who needs to subnet properly can have a /48 for four euro a month, delegated rather than carved out of ours.
Routed, not proxied
This distinction is the whole point and it is worth being tedious about.
A proxied arrangement means the site answers neighbour discovery on your behalf and forwards packets to you. It works for a single address and falls apart the moment you want to put addresses on containers, run a router inside your instance, or move an address between machines. There is also a dependency you did not ask for: your traffic relies on a piece of the fabric behaving, which is one more thing to break.
Routed means the prefix is in the routing table, pointed at your instance, and what happens to the addresses inside it is your business. You can put them on containers, hand them to virtual machines nested inside your instance, or leave them unused. Nothing in our fabric needs to know.
Delegation is by DHCPv6-PD for the /48, static routing for the /64.
Reverse DNS
Editable per address from the panel, across the whole prefix, without a support ticket. Forward and reverse both, with the usual delay for anything cached upstream. Mail operators care about this more than anyone and it was the second most common request we received about IPv6.
What we do not filter
We do not filter the ICMPv6 types that path MTU discovery depends on. Blocking them is the classic way to produce a network that appears to work until somebody sends a large packet, and a distressing number of providers do it by accident.
Router advertisement guard runs on the fabric, so a misconfigured instance cannot advertise itself as everybody else’s default route. That protects your neighbours from you and you from them, and it is the only IPv6 filtering we do.
Why bother now
IPv4 addresses are becoming genuinely expensive, and the price is moving in exactly one direction. Additional addresses cost three euro a month here, which reflects what we pay rather than a margin we invented, and that figure will not be going down over the next decade.
Every workload that can run dual-stack today is a workload that will not need a second IPv4 address in three years. We would rather spend a fortnight of engineering now than have that conversation with a thousand customers later.
There is also a plainer reason. Charging for IPv6, or making people request it, is a habit the industry picked up when address space was a scarce thing to be administered. It has not been scarce for a long time.
The rough edges
Two sites did not have a suitable /48 allocation on the fabric at launch and got the feature nine days after everywhere else. Those customers were told individually rather than being left to discover it, which is a low bar, and we mention it because a rollout announcement that claims perfect coverage is usually lying.
One image in the catalogue shipped with IPv6 disabled in the kernel by default and had to be rebuilt. If you built an instance from a stale local copy of that image, enabling it is a single sysctl and the knowledge base has the specifics.
What still needs IPv4
More than it should. A meaningful share of home and mobile networks remain IPv4-only, several package mirrors are still single-stack, and plenty of corporate networks will not route a AAAA record to save themselves. Every instance keeps at least one IPv4 address for that reason and we are not proposing to take it away.
Dual-stack is the sensible default and will be for years yet. The change here is that half of it is no longer something you have to ask for.