What’s the safest way to mitigate IPv6 DNS poisoning on Windows?

DNSSEC can help protect against forged or tampered DNS responses, so it’s worth enabling on supported internal and external DNS infrastructure. It isn’t a replacement for network controls, though: clients should still be prevented from using unauthorized DNS servers, and rogue router advertisements or DHCPv6 should be blocked at the network layer.

There’s disagreement in security guidance about disabling IPv6, and claims that it is always required or always harmless are too broad. Check the specific Windows and security baselines you follow, test the setting on representative systems, and document the decision. Prefer protocol configuration and network protections when they address the problem without removing IPv6 support.

Casually disabling IPv6 on Windows generally isn’t recommended. Some Windows components can depend on IPv6 even when the organization primarily uses IPv4, so unexpected behavior is possible. If the concern is rogue IPv6 configuration or DNS, control the actual sources with RA Guard, DHCPv6 Guard, switch security features, firewall rules, and tightly managed DNS servers.

Rather than disabling IPv6 across Windows, use Group Policy to configure the system to prefer IPv4 over IPv6. That preserves IPv6 functionality while making IPv4 the preferred protocol. Also address the network attack path directly—for example, use switch protections such as Router Advertisement Guard and DHCPv6 Guard, and block unauthorized DHCPv6 traffic at the appropriate network boundary.

If IPv6 is truly unused, you can reduce exposure by disabling LLMNR and DHCPv6, configuring clients to prefer IPv4, and preventing unauthorized router advertisements. Whether to disable IPv6 entirely should be based on testing and an explicit security policy rather than being treated as a universal fix. Some security teams still choose to disable it on selected servers, but that should be validated for compatibility.