Why does one hostname resolve to multiple IP addresses?
Learn why a single hostname may return multiple A or AAAA answers and how to interpret that in DNS and email troubleshooting.
Tools For This Topic
This is often normal
It is very common for a single hostname to resolve to multiple IP addresses. This is typically intentional and forms part of how modern services are designed.
Cloud platforms, CDNs, and large-scale email providers routinely return multiple A (IPv4) and AAAA (IPv6) records for the same hostname.
You can inspect all returned IPs with the DNS Pro Record Lookup tool.
For comparison, you can also use MXToolbox: https://mxtoolbox.com/DNSLookup.aspx
Why this happens in practice
Multiple IP addresses are typically used to improve reliability, performance, and scalability.
- Load balancing → distributes traffic across multiple servers
- Redundancy → ensures availability if one endpoint fails
- Geographic routing → directs users to the nearest infrastructure
- Provider architecture → reflects distributed backend systems
example.com. 300 IN A 203.0.113.10
example.com. 300 IN A 203.0.113.11
example.com. 300 IN AAAA 2001:db8::1A vs AAAA records
A hostname may return both IPv4 (A) and IPv6 (AAAA) records simultaneously.
Modern clients will typically prefer IPv6 if available, but may fall back to IPv4 depending on connectivity.
Seeing both record types is normal and expected in modern environments.
Why one tool may show fewer IPs than another
Different DNS tools can return different views of the same hostname.
- Some tools only display a subset of responses
- Different resolvers may return different answer orders
- Provider-side load balancing may rotate IP responses
- Caching and TTL differences can affect results
This is why one tool may show a single IP while another shows multiple.
What to check
- The IP ranges belong to the expected provider
- Both IPv4 and IPv6 responses are understood
- The behaviour aligns with the service design
- There are no unexpected or rogue IP addresses
If you are troubleshooting DNS fundamentals, see: /articles/what-is-dns
When multiple IPs may be suspicious
Multiple IP addresses are not inherently suspicious, but context is critical.
- IP addresses do not belong to the expected provider
- Unexpected changes occur during a migration
- Mixed infrastructure appears without explanation
- Security concerns such as DNS hijacking are suspected
In these cases, further investigation is warranted rather than assuming the behaviour is normal.
Basic validation commands
# Query A and AAAA records
dig A example.com
dig AAAA example.com
# Alternative
nslookup example.comUse These DNS Pro Tools
If you want to validate this topic in practice, these DNS Pro tools are the fastest next step.
Related Tools
Related Articles
Why does a domain have multiple MX records?
Learn why multiple MX records are normal, how priority works, and what to check when a domain publishes more than one receiving mail host.
Private vs Public IP Addresses Explained
Learn the difference between private and public IP addresses, how special-use ranges fit in, and why correct IP classification matters in troubleshooting.
How to Check DNS Propagation
A practical guide to checking DNS propagation, including what to compare, how TTL affects results, and how to interpret inconsistent answers.