Don't force AAAA record

[nathan-felix]

Would it be possible for us to only use A records for Apex domains?
We are trying to create the simplest process for our customers and adding one record would be better than adding two.

[jbergstroem]

I usually to create my apps this way (I only need ipv6 and proxy ipv4 via cloudflare):

1. flyctl create --org foo --name bar
2. create youor config or save a default (flyctl config save)
3. flyctl volumes -c myconfig.toml ..
4. flyctl regions -c myconfig.toml ..
5. flyctl ips allocate-v{4,6} -c myconfig.toml
6. flyctl deploy -c myconfig.toml

[jsierles]

You should be able to use an A record pointing directly at your app IP address, visible in fly ips list. The AAAA record is required for issuing certificates.

[nathan-felix]

Yes sorry, I meant for issuing the certificate as well.
Is there no way to have a certificate on an apex domain, with only the A record?

[ignoramous]

These solutions involving cname dark-arts may help:

Creating a cert for an IPv4-only DNS name not working

Use the second option for domain validation and add a _acme-challenge CNAME example.com.XyZ2.flydns.net. instead the first option of adding a AAAA record. See the second option in the output of flyctl certs check ... for the exact string to add as CNAME. This works for me with a wildcard domain “*.example.ch”. Validation may take a few minutes. In one case, it took 10+ min until a domain was signed after I had added the _acme-challenge CNAME... .

IPv6 UDP?

Hi, While waiting for support of UDP on IPv6 to arrive, would it be possible to add an option to disable Fly’s DNS servers to return AAAA records to DNS requests for selected hosts in the *.fly.dev. domain? This might provide us a temporary workaround for situations like @tomklein and others had mentioned above. For @thomas @kurt, this is my “Use Case”: I have managed to get TFTP servers build and run on Fly, for ex. at tftpNN.fly.io. Distributed machines connect to them using their PXE networ…

[jsierles]

We use Ipv6 to ward off potential attacks due to recycled IPv4 addresses. More information here: How CDNs Generate Certificates · Fly.