2001:4860:4860::8888: Google Public DNS (IPv6)

2001:4860:4860::8888 is the primary IPv6 address of Google Public DNS. It runs the same anycast resolver as 8.8.8.8 and answers queries arriving over IPv6. The secondary is 2001:4860:4860::8844, and both mirror the IPv4 pair digit for digit.

Reading the address

Break it into its parts and it stops looking arbitrary.

• 2001: is the prefix IANA delegates for global unicast assignments to registries.
• 2001:4860::/32 is Google’s allocation from ARIN.
• 2001:4860:4860::/48 is the subnet Google set aside for the public resolver, with the repeated group chosen to be memorable.
• ::8888 is the interface identifier, picked to echo 8.8.8.8. The :: collapses five groups of zeros.

The secondary follows the same logic with ::8844 for 8.8.4.4. Cloudflare copied the idea when it built 2606:4700:4700::1111, so encoding the IPv4 address in the interface identifier is now a convention among public resolvers.

Why it matters on a dual stack network

A machine with working IPv6 will often prefer an IPv6 resolver when one is configured, following the source address selection rules in RFC 6724. Configure only 8.8.8.8 and your IPv6-capable device may still send its lookups to whatever resolver came from your router’s Router Advertisement, which is usually the ISP’s. People who switch resolvers for privacy or filtering reasons and then find their queries still going to the ISP have almost always missed the IPv6 half.

Check whether your connection has IPv6 at all on /ipv6-test before spending time on this.

When you see it

• In ipconfig /all under “DNS Servers” on a dual stack Windows machine.
• In resolvectl status or scutil --dns output on Linux and macOS.
• In Router Advertisement configuration on routers that support RDNSS.
• In Kubernetes and container network configuration, where an IPv6-only pod needs an IPv6 resolver.
• In firewall rules permitting outbound UDP 53 over IPv6.

How to configure it

1. Windows: adapter properties, Internet Protocol Version 6, preferred 2001:4860:4860::8888, alternate 2001:4860:4860::8844.
2. macOS: System Settings, Network, Details, DNS, add both IPv6 addresses alongside the IPv4 ones.
3. Linux with systemd-resolved: add them to the DNS= line in /etc/systemd/resolved.conf.
4. Router: set them in the IPv6 DNS or RDNSS field, which is separate from the IPv4 DHCP DNS field on most firmware.
5. Test: dig @2001:4860:4860::8888 example.com AAAA on macOS or Linux.

Privacy and policy

The Google Public DNS privacy notice covers all four addresses. Temporary logs hold the full client address for 24 to 48 hours, permanent logs drop it, and Google states the data is not used for ad targeting. The resolver validates DNSSEC and supports EDNS Client Subnet, forwarding a truncated prefix to authoritative servers that request it. For IPv6 clients that truncation is coarser than a /24, but the principle is the same: some network location is shared.

What it is not

This is not an address your device can be assigned, and it is not an IPv6 gateway. It is also not a way to reach IPv6 sites from an IPv4-only connection; the resolver has to be reachable over IPv6 for you to use it at all. If ping6 to it fails, your network has no working IPv6 path and the address is useless to you regardless of how it is configured.