Most VPS plans include IPv6, and most are left half-configured: the address is assigned, an AAAA record exists, but the firewall or the web server never listens on it. A visitor with IPv6 then tries the fast path, waits for it to time out, and only then falls back to IPv4. The site feels slow for reasons no IPv4 test will show.

Is it actually working

ip -6 addr show
ping6 -c2 ipv6.google.com
curl -6 -sS -o /dev/null -w '%{http_code}\
' https://yourdomain.com

The last line is the one that matters. If it hangs or fails while the IPv4 version answers, your AAAA record is pointing at a door nobody is behind.

The three places to check

  • The web server - Nginx needs its own listen line: listen [::]:443 ssl;
  • The firewall - ufw and firewalld handle v6 separately; iptables rules do not apply to ip6tables at all.
  • DNS - an AAAA record only helps if the two above are true.
# nginx
listen 80;
listen [::]:80;
listen 443 ssl;
listen [::]:443 ssl;

Your application will see a different address

An IPv6 client arrives with an address like 2001:db8::1. Code that stores an IP in a 15-character column, or that compares against a v4 allow-list, silently breaks. Rate limiting keyed on the full address is also too narrow, since one customer usually has a whole /64.

Behind Cloudflare or any proxy, the address your server sees is the proxy. Read the real one from the forwarded header - see Cloudflare and the real visitor IP.

If you are not going to finish the job

Remove the AAAA record. No IPv6 is a clean, fast IPv4 connection. Broken IPv6 is a timeout on every first visit.