2026 IPv6, AAAA records, and Happy Eyeballs when SSH feels slow to a ProxyMac Mac mini

Engineers love blaming “the Tokyo region” when ssh mini.jp.example takes three breaths before the banner appears—yet the same host screams on ssh -4. Modern resolvers return both A and AAAA; modern stacks implement Happy Eyeballs–style racing (see RFC 8305 for the general algorithm your libraries converge toward) so IPv6 attempts can stall just long enough to feel like packet loss even when the ProxyMac Mac mini in Hong Kong, Japan, Korea, Singapore, or the United States is healthy. This article is not IPv6 advocacy—it is a decision worksheet: a four-row symptom matrix, client knobs on macOS (ssh -4, ssh -6, AddressFamily), bracket literal syntax for literal v6 addresses, a seven-step runbook that points to DNS & split-horizon failures when answers differ by VPN, PMTUD when large TCP segments vanish, and keepalive tuning once the address family is honest. If policy hairpins everything through Zero Trust first, read VPN routing before you chase AAAA ghosts.

When the mini is fine but SSH “hesitates” on the first connect

Symptoms cluster into three families: (1) fixed multi-second pause only on the first TCP attempt each minute, (2) intermittent stalls that correlate with DNS TTL expiry, (3) stalls that scale with payload size (SCP) rather than connection setup. Family 1 screams address-family racing; family 3 usually is not IPv6 at all—jump to MTU instead of reading this page twice.

• Always capture ssh -vvv timestamps for the gap between Connecting and Connection established.
• Compare the same hostname against ssh -4 and default—if only default is slow, you have a v6 hypothesis worth proving.
• Literal IPv6 requires brackets: ssh user@[2001:db8::1] so the parser does not treat colons as port delimiters.

A vs AAAA symptom matrix (first hop of triage)

What you feel	Likely layer	First command	Deep link
2–5s pause then fast session; ssh -4 removes pause	Broken or hair-pinned IPv6	dig AAAA hostname +time=2	This article + DNS guide
Works by numeric IP, fails by name	Resolver order / split DNS	scutil --dns | head -n 80	DNS guide
Interactive OK, SCP dies mid-transfer	PMTUD / middlebox	Packet size sweep	MTU guide
Idle disconnect after tens of minutes	NAT timers	ServerAlive probes	Keepalive guide

Happy Eyeballs–style racing on macOS laptops (what OpenSSH inherits)

Applications that resolve dual-stack names may start parallel connection attempts and prefer whichever completes first. When IPv6 is almost right—router advertises prefixes but upstream filters ICMPv6—you pay latency taxes that do not show up as clean “connection refused.” Document the VPN on/off delta because many ZTNA clients reorder resolver lists or inject virtual IPv6 routes that differ from coffee-shop Wi-Fi.

OpenSSH flags, ~/.ssh/config, and pinning address family responsibly

Use ssh -4 and ssh -6 as diagnostic switches, then encode the winning outcome in a Host stanza with AddressFamily inet or inet6 once policy agrees. Avoid permanent -4 on laptops that roam between v6-clean campuses and legacy v4-only hotels without a Match exec guard—split configs reduce surprise.

Host proxymac-jp-stable HostName mini.example.jp User build AddressFamily inet ServerAliveInterval 30 ServerAliveCountMax 4

What the rented mini must expose (and what you still must verify)

ProxyMac hands you predictable SSH entrypoints, but authoritative DNS for customer-owned hostnames may still sit in your registrar unless delegated. Confirm whether your zone publishes only A, only AAAA, or both—and whether corporate resolvers strip AAAA answers “for security.” If IT silently drops AAAA, your laptop will not magically invent IPv6; conversely, if AAAA exists but uplink is broken, your client may still try v6 first.

Seven-step runbook before you ask operations to “move the mini”

1. Snapshot dig A / dig AAAA from office, VPN, and home contexts.
2. Time ssh -vvv vs ssh -4 -vvv to the same name—delta >1s is suspicious.
3. Check scutil --dns ordering when VPN toggles; misordered search domains masquerade as IPv6 issues.
4. Rule out MTU with the linked guide if bulk copy fails while shells feel fine.
5. Layer keepalives after the address family is stable.
6. Document the final Host stanza in Git beside firewall tickets.
7. Only then compare regions using MTR evidence—not vibes.

FAQ

Should I disable IPv6 on the mini? Prefer fixing the broken path; disabling v6 globally can break legitimate dual-stack monitoring.

Does Screen Sharing inherit the same racing? Often yes—Screen Sharing is still TCP under QUIC-less paths; validate DNS + address family before blaming encoder settings.

Will CGNAT change this story? CGNAT changes port mapping cadence, not DNS racing—pair with corporate CONNECT SSH when only 443 exits.

Why ProxyMac Mac mini stays the right anchor once DNS and dual-stack are understood

Apple Silicon M4 minis in HK / JP / KR / SG / US give you a hostname you can attach to real measurements: the same dig today should read like dig tomorrow. After resolver truth matches routing policy, automation agents, CI workers, and human developers all hit the same metal your finance team already approved. Reserve regions from the pricing page, keep help center SSH snippets beside your runbook, and fall back to VNC when macOS demands a GUI witness for TCC prompts.