Problem: macOS Elastic Endpoint cannot establish outbound connections to Fleet Server or Elasticsearch when IPv6 is the only available path (AAAA DNS records and IPv6-only listeners). Elastic Agent and other integrations on the same host connect successfully. Defend stays degraded and security events are not uploaded.
Environment: macOS endpoints running Elastic Agent + Elastic Defend (observed on 9.4.2) against Elastic Stack 9.4, reaching internal Fleet Server and Elasticsearch ingest nodes over corporate/VPN networks that are IPv6-first or IPv6-only.
Repro:
- IPv6-only DNS and services →
Could not resolve host / Failed to connect … port 9200 (pre-TLS)
- Dual-stack (IPv4 A records + IPv4 listeners on Fleet/ES) → Endpoint connects; Defend recovers
Workaround: Maintain dual-stack — IPv4 in DNS and on Fleet Server / Elasticsearch ingest listeners.
Request: Support IPv6-only outbound connectivity from macOS Endpoint to Fleet Server (8220) and Elasticsearch output (9200), including:
- AAAA resolution and TCP/TLS over IPv6 (system-extension network path on macOS)
- Parity with Elastic Agent IPv6 behaviour on the same host
- Improve
elastic-endpoint test output error messages for IPv6-only scenarios and document macOS Endpoint IPv6 support in public docs.
Impact: IPv6-only or IPv6-first network designs block macOS Defend telemetry while other stack components work, creating detection gaps and inconsistent cross-platform behaviour.
Problem: macOS Elastic Endpoint cannot establish outbound connections to Fleet Server or Elasticsearch when IPv6 is the only available path (AAAA DNS records and IPv6-only listeners). Elastic Agent and other integrations on the same host connect successfully. Defend stays degraded and security events are not uploaded.
Environment: macOS endpoints running Elastic Agent + Elastic Defend (observed on 9.4.2) against Elastic Stack 9.4, reaching internal Fleet Server and Elasticsearch ingest nodes over corporate/VPN networks that are IPv6-first or IPv6-only.
Repro:
Could not resolve host/Failed to connect … port 9200(pre-TLS)Workaround: Maintain dual-stack — IPv4 in DNS and on Fleet Server / Elasticsearch ingest listeners.
Request: Support IPv6-only outbound connectivity from macOS Endpoint to Fleet Server (8220) and Elasticsearch output (9200), including:
elastic-endpoint test outputerror messages for IPv6-only scenarios and document macOS Endpoint IPv6 support in public docs.Impact: IPv6-only or IPv6-first network designs block macOS Defend telemetry while other stack components work, creating detection gaps and inconsistent cross-platform behaviour.