How to Configure IPv6 and IPv4 Address Precedence in Windows 11 Using NetPrefixPolicy

In modern dual-stack networking, Windows 11 adheres to RFC 6724 default address selection algorithms to determine whether an application should establish connections using IPv6 or IPv4. When a domain name resolves to both A (IPv4) and AAAA (IPv6) DNS records, Windows ranks destination addresses according to its prefix policy table. In corporate networks or environments with inconsistent IPv6 routing, network administrators often need to modify this precedence order to favour IPv4 or prioritise specific enterprise subnets without disabling IPv6 globally.

In this guide, you will learn how to inspect, modify, reset, and troubleshoot dual-stack address precedence in Windows 11 using PowerShell NetTCPIP cmdlets.

Understanding the Prefix Policy Table and RFC 6724

The Windows IP stack relies on a prefix policy lookup table containing three core properties for each IP prefix:

• Prefix: The CIDR notation representing an IP address block (e.g., ::/0, ::ffff:0:0/96, 2002::/16).
• Precedence: An unsigned integer used for sorting destination addresses. Higher values indicate higher priority during DNS resolution sorting.
• Label: An unsigned integer used to match destination prefixes with source interface prefixes. Windows matches source addresses sharing the same label as the selected destination.

By default, native IPv6 (::/0) has a precedence of 40, whereas IPv4-mapped addresses (::ffff:0:0/96) have a precedence of 35. Consequently, Windows 11 attempts connections over IPv6 before falling back to IPv4.

Viewing Current Prefix Policies in PowerShell

To inspect your current policy configuration, open an elevated PowerShell console (Run as Administrator) and execute Get-NetPrefixPolicy:

Get-NetPrefixPolicy | Sort-Object Precedence -Descending | Format-Table -AutoSize

Windows returns the default policy table:

Prefix           Precedence Label
------           ---------- -----
::1/128                  50     0
::/0                     40     1
::ffff:0:0/96            35     4
2002::/16                30     2
2001::/32                 5     5
fc00::/7                  3    13
::/96                     1     3

Notice that ::ffff:0:0/96 represents standard IPv4 traffic. Because its precedence (35) is lower than ::/0 (40), native IPv6 is preferred.

Configuring IPv4 Precedence over IPv6

If you encounter high latency or dropped packets across unoptimised IPv6 routes, you can elevate IPv4 precedence without disabling the IPv6 network stack entirely. This maintains local HomeGroup/Workgroup services and modern Windows features while routing external traffic over IPv4.

To prioritise IPv4, raise the precedence of ::ffff:0:0/96 to 45 (higher than IPv6’s 40):

Set-NetPrefixPolicy -Prefix "::ffff:0:0/96" -Precedence 45 -Label 4

Confirm the new precedence order:

Get-NetPrefixPolicy | Sort-Object Precedence -Descending

Now, whenever an application makes a connection to a host that advertises both IPv4 and IPv6 records, Windows places the IPv4 address at the top of the connection candidate list.

Adding Custom Prefix Policies for Enterprise Subnets

In hybrid cloud or multi-site enterprise environments, you may wish to assign elevated priority to internal IPv6 branch office subnets while keeping public internet traffic directed through local proxies or IPv4 egress firewalls.

To add a custom prefix policy rule, use New-NetPrefixPolicy:

New-NetPrefixPolicy -Prefix "fd00:abcd:1234::/48" -Precedence 48 -Label 10

Verify that the custom subnet appears in the routing policy:

Get-NetPrefixPolicy -Prefix "fd00:abcd:1234::/48"

If you later adjust subnet boundaries, update the policy in place with Set-NetPrefixPolicy:

Set-NetPrefixPolicy -Prefix "fd00:abcd:1234::/48" -Precedence 42 -Label 10

To delete the custom rule when decommissioning a network range:

Remove-NetPrefixPolicy -Prefix "fd00:abcd:1234::/48" -Confirm:$false

Testing Destination Address Resolution and Precedence

To verify which address Windows selects in practice, test hostname resolution against dual-stack targets using PowerShell or Resolve-DnsName:

Resolve-DnsName -Name "www.google.com" -Type A_AAAA

To observe connection sorting directly via the TCP stack, initiate a lightweight test connection using Test-NetConnection:

Test-NetConnection -ComputerName "www.google.com" -Port 443 -InformationLevel "Detailed"

Examine the RemoteAddress property in the command output. If IPv4 precedence was elevated to 45, the connection targets an IPv4 dotted-quad address rather than an IPv6 hexadecimal address.

Resetting Prefix Policy Table to Default Factory Values

If you experience unexpected network behaviour or no longer require custom routing rules, you can restore the Windows 11 default RFC 6724 configuration immediately.

Execute the following commands in an elevated PowerShell session to reset all standard prefixes:

# Reset IPv4 precedence back to default 35
Set-NetPrefixPolicy -Prefix "::ffff:0:0/96" -Precedence 35 -Label 4

# Verify default table alignment
Get-NetPrefixPolicy | Sort-Object Precedence -Descending

Alternatively, you can reset the entire Windows TCP/IP network stack via netsh if policies were modified across multiple subnets:

netsh int ipv6 reset
netsh int ipv4 reset

Restart Windows 11 after executing a complete TCP/IP stack reset to ensure all networking services re-read the factory policy table cleanly.