diff --git a/apisix/cli/ops.lua b/apisix/cli/ops.lua
index fbf01608ae87..604625a4313f 100644
--- a/apisix/cli/ops.lua
+++ b/apisix/cli/ops.lua
@@ -545,6 +545,16 @@ Please modify "admin_key" in conf/config.yaml .
         sys_conf["dns_resolver"] = dns_addrs
     end
 
+    for i, r in ipairs(sys_conf["dns_resolver"]) do
+        if r:match(":[^:]*:") then
+            -- more than one colon, is IPv6
+            if r:byte(1) ~= str_byte('[') then
+                -- ensure IPv6 address is always wrapped in []
+                sys_conf["dns_resolver"][i] = "[" .. r .. "]"
+            end
+        end
+    end
+
     local env_worker_processes = getenv("APISIX_WORKER_PROCESSES")
     if env_worker_processes then
         sys_conf["worker_processes"] = floor(tonumber(env_worker_processes))
diff --git a/t/cli/test_dns.sh b/t/cli/test_dns.sh
index 90db8ce00767..62985eacc9ce 100755
--- a/t/cli/test_dns.sh
+++ b/t/cli/test_dns.sh
@@ -59,3 +59,24 @@ if [ "$count" -ne 2 ]; then
 fi
 
 echo "pass: dns_resolver_valid takes effect"
+
+echo '
+apisix:
+  stream_proxy:
+    tcp:
+      - 9100
+  dns_resolver:
+    - 127.0.0.1
+    - "::1"
+    - "[::2]"
+' > conf/config.yaml
+
+make init
+
+count=$(grep -c "resolver 127.0.0.1 \[::1\] \[::2\];" conf/nginx.conf)
+if [ "$count" -ne 2 ]; then
+    echo "failed: can't handle IPv6 resolver w/o bracket"
+    exit 1
+fi
+
+echo "pass: handle IPv6 resolver w/o bracket"
diff --git a/t/node/upstream-domain-with-special-ipv6-dns.t b/t/node/upstream-domain-with-special-ipv6-dns.t
new file mode 100644
index 000000000000..5ec838bca7b4
--- /dev/null
+++ b/t/node/upstream-domain-with-special-ipv6-dns.t
@@ -0,0 +1,71 @@
+#
+# Licensed to the Apache Software Foundation (ASF) under one or more
+# contributor license agreements.  See the NOTICE file distributed with
+# this work for additional information regarding copyright ownership.
+# The ASF licenses this file to You under the Apache License, Version 2.0
+# (the "License"); you may not use this file except in compliance with
+# the License.  You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+BEGIN {
+    $ENV{CUSTOM_DNS_SERVER} = "[::1]:1053";
+}
+
+use t::APISIX 'no_plan';
+
+repeat_each(1);
+log_level('debug');
+no_root_location();
+no_shuffle();
+
+add_block_preprocessor(sub {
+    my ($block) = @_;
+
+    my $yaml_config = $block->yaml_config // <<_EOC_;
+apisix:
+    node_listen: 1984
+    config_center: yaml
+    enable_admin: false
+_EOC_
+
+    $block->set_value("yaml_config", $yaml_config);
+
+    my $routes = <<_EOC_;
+routes:
+  -
+    uri: /hello
+    upstream_id: 1
+#END
+_EOC_
+
+    $block->set_value("apisix_yaml", $block->apisix_yaml . $routes);
+});
+
+run_tests();
+
+__DATA__
+
+=== TEST 1: AAAA
+--- listen_ipv6
+--- apisix_yaml
+upstreams:
+    -
+    id: 1
+    nodes:
+        ipv6.test.local:1980: 1
+    type: roundrobin
+--- request
+GET /hello
+--- error_log
+connect to [::1]:1053
+--- no_error_log
+[error]
+--- response_body
+hello world