The internet ran out of IPv4 addresses years ago. The replacement, IPv6, has been finished and available since 1998, and the usual way of describing its progress is a global adoption chart that climbs slowly and reassuringly. That chart measures users. It does not measure the places users have to go.
So we measured those instead. Eighteen institutions across six ASEAN economies, chosen by the same three slots in every country: the largest retail bank, the primary government portal, and the largest mobile operator. These are not sites you choose. You do not shop around for your tax portal.
Seven of the eighteen publish an IPv6 address. Five of the six banks do not.
What we asked, exactly
An IPv6 connection needs one precondition: the name has to resolve to an IPv6 address, published in DNS as an AAAA record. No AAAA means an IPv6-only device cannot reach the host at all without somebody else running a translation layer on its behalf.
That is the whole test. It is a low bar, deliberately — we are not asking whether the site is fast over IPv6 or well configured, only whether the door exists.
| Country | Bank | Government | Telco |
|---|---|---|---|
| Thailand | yes | yes | yes |
| Malaysia | no | yes | yes |
| Singapore | no | yes | no |
| Philippines | no | yes | no |
| Indonesia | no | no | no |
| Vietnam | no | no | no |
Thailand answers on all three. Indonesia and Vietnam answer on none. Government portals are the strongest slot at four of six; banks are the weakest at one of six, and the one is Thailand's.
The mistake we made first, because you will make it too
Our first run of this measurement returned 11.8% — three of eighteen. That number was wrong, and the way it was wrong is worth more than the number itself.
It asked each institution's bare domain. But gov.ph has no address record of any kind: the apex does not serve a website at all, while www.gov.ph answers with both IPv4 and IPv6. Reporting "the Philippine government portal has no IPv6" would have been a false negative, an error caused by our own test list.
Once every name was checked at both the apex and the www form, the figure went from 11.8% to 38.9%. It more than tripled. Four of the seven institutions with IPv6 answer on www only — their bare domain has no AAAA at all.
If you are auditing your own estate, this is the trap: example.com and www.example.com are different names in DNS and there is no rule that they carry the same records. A tool that checks one and reports on "the site" is answering a question you did not ask.
The banks are not short of budget
The easy explanation for a bank lagging on infrastructure is cost or caution. The measurement points somewhere more specific.
Four of the eleven institutions without IPv6 — DBS, Singtel, Maybank and BDO — serve their DNS from Akamai. Their nameservers are akam.net hosts. These organisations are already paying for a global content delivery network that has supported IPv6 for over a decade.
The capability is already bought and paid for, just not switched on. That makes the absence a decision rather than a gap, and decisions have owners in a way that gaps do not.
The contrast inside our own sample makes the same point. Thailand's SCB, the one bank in the set with IPv6, is not obviously better resourced than DBS. It made a different call.
Why this is not just a plumbing complaint
This has three consequences, from the network layer up to your fraud team.
Mobile networks in this region are increasingly IPv6-only inside. When a carrier runs IPv6 internally and the destination is IPv4-only, traffic goes through a translation layer — usually NAT64 or a carrier-grade NAT. It works. It also adds a hop, a piece of state, and a device that can be overloaded, and it is operated by your carrier rather than by the bank. Every IPv4-only banking session in an IPv6 mobile network is being translated by a third party.
Carrier-grade NAT shares one public address among many subscribers. That is why a fraud team looking at an IP address in a log sees something far less identifying than they think, and why one abusive user can get a whole block of neighbours rate-limited. The security team that wants IP-based signals and the network team that has not deployed IPv6 are working against each other.
And it is a cost you pay quietly. IPv4 addresses are a traded commodity now; the scarcity has a price, and it is embedded in what everyone pays for hosting. Staying on IPv4 doesn't avoid this cost; it just hides it in someone else's budget until it lands in yours.
How to check your own
You can check any site yourself with a single command:
dig +short AAAA example.com
dig +short AAAA www.example.comOutput means an address is published. No output means there is none. Check both names — that is the whole lesson of our first wrong answer. If you want the same for mail or a subdomain, ask for those names specifically; nothing inherits.
We looked at the same institutions from a different angle in your bank is not one domain, which reads their published mail records rather than their addresses.
Our own DNS lookup tool does the same query from a browser if you would rather not open a terminal, and our IP lookup will tell you what your own connection is currently using.
What this measurement does not tell you
This is a small sample, which has three main limitations.
An AAAA record is an advertisement, not a working connection. We resolved names; we did not open sockets. A host can publish an address and still fail to serve on it, so 38.9% is an upper bound on readiness, and the true figure for working IPv6 is somewhere at or below it.
Eighteen institutions is a sample, not a census. Six countries, three slots, chosen before we looked at any answer — which protects against picking to fit a conclusion, but does not turn eighteen into a survey. The country-level splits especially, at three sites each, should be read as an indication and not a ranking.
And a landing page is not the whole institution. A bank could serve its public site over IPv4 and its mobile API over IPv6; we did not test the apps. We tested what a visitor's browser finds—the part of an institution most people actually encounter.
The measurement script is in our repository and re-runnable. Figures are from 19 August 2026, and the two controls we check on every run — cloudflare.com and google.com, both known to publish IPv6 — answered correctly, so a low result here is not a broken resolver on our end.
View author profile → · Editorial policy
