IPv6

Eight groups of four hexadecimal digits separated by colons. Leading zeros in a group may be omitted, and one run of all-zero groups may be replaced by a double colon.

In a URL an IPv6 literal is wrapped in square brackets so the colons do not collide with the port separator: `https://[2001:db8::1]:443/`.

The address space is large enough that network address translation is unnecessary, so a device can hold a globally routable address directly.

A single interface normally holds several addresses at once — link-local, and one or more global — which is normal rather than a misconfiguration.

A dual-stack host publishes both A and AAAA records and serves on both. Clients resolve both and decide.

Address selection rules generally prefer IPv6 when it is available, which is why a broken AAAA record is more damaging than no AAAA record.

Happy Eyeballs softens this: clients start connections over both protocols with a short head start for IPv6 and keep whichever answers first, so a failing IPv6 path costs a delay rather than a failure on modern clients.

Older clients and non-browser software often lack that behaviour and will simply fail.

The address must actually serve the site, over the same ports, with the same certificate coverage and the same application behaviour.

Firewall rules have to be duplicated. IPv6 rules are separate from IPv4 rules on essentially every platform, and a host that is filtered on IPv4 and open on IPv6 is a common oversight.

Logging and rate limiting that key on an address need to handle both formats, and an allow-list containing only IPv4 ranges silently stops working for IPv6 clients.

If any of that is not ready, not publishing the AAAA record is the safe choice. IPv4-only is a supported configuration, not a defect.

`dig example.com AAAA +short` shows whether an IPv6 address is published.

`curl -6 -I https://example.com` forces an IPv6 connection and proves the address serves, which resolution alone does not.

Compare the response against `curl -4 -I https://example.com`. Different answers mean the two stacks reach different configurations.

Check the certificate on the IPv6 connection specifically. A host reached over IPv6 that presents a different or invalid certificate is a real failure for the visitors who prefer it.