IPv6 enablement checklist for a website

Goal

Serve the site over IPv6 as reliably as over IPv4, with no client seeing a slower or failing connection because an AAAA record was published before the path behind it worked.

Prerequisites

An IPv6 address routed to the host or load balancer, control of the zone, and shell access to run tests from a network that has IPv6.

Steps

1. Configure the address on the host and open the firewall for it separately; with iptables, ip6tables is a separate rule set, and a host that answers on v4 only because v6 rules were never written is a common state.
2. Make the web server listen. nginx's documentation explains that ipv6only, on by default, determines whether an IPv6 socket on the wildcard address [::] accepts only IPv6 connections or both; with the default, listen [::]:443 ssl; must be accompanied by listen 443 ssl; for IPv4. Restart and check with ss -ltn that both sockets exist.
3. Test by address before publishing DNS: curl -6 --resolve example.com:443:[2001:db8::1] https://example.com/ and the same for HTTP-to-HTTPS redirects and for every hostname; check the certificate over v6 as in the TLS chain article.
4. Check everything behind the front: reverse proxies passing the client address, rate limiting and abuse rules keyed by address (a subscriber usually holds a whole prefix, so per-address limits behave differently), geolocation, log parsing, and any allow-list that contains only IPv4 addresses.
5. Publish the AAAA record with a short TTL. RFC 3596 defines AAAA as the record type that stores a single IPv6 address; RFC 8305 has dual-stack clients query AAAA and A back to back.
6. Watch logs for v6 traffic and errors. RFC 8305 describes how Happy Eyeballs clients resolve both families, prefer IPv6 and fall back to IPv4 after a short delay if the first attempt does not connect; a client with this behaviour therefore masks a broken v6 path as a small delay, while a client without it waits for its timeout or fails. Test with curl -6, which forces the family, as well as with a browser.
7. Add monitoring probes that connect over IPv4 only and over IPv6 only, so that a failure of one family is visible instead of being averaged away. Raise the TTL when stable.

Expected result

Both address families serve identical content and certificates, monitoring shows them separately, and no rule behind the front end treats v6 clients differently by accident.

Limits and test basis

Mail, SSH and other services on the same hostname gain an AAAA record too and need the same check. The order of steps and the client behaviour follow the cited RFCs and documentation; no traffic shares or latencies are claimed.