Adding IPv6 without creating a second outage
Dual-stack checks for DNS, listeners, NAT, and return routes.
This note documents a practical approach used in Steppe Infrastructure Notes. The goal is a setup that can be explained, reproduced, and checked from outside the machine.
Publish addresses deliberately
Only add AAAA records after the service answers on IPv6. Check each virtual host and firewall rule; an IPv4 allowlist does not automatically describe the intended IPv6 policy.
dig +short AAAA example.com
ss -lntVerify the return path
A listener can accept a packet even when replies take the wrong route. Inspect the default gateway and any NAT66 or prefix mapping used by the provider. Test from an independent dual-stack network.
ip -6 route
curl -6 https://example.com/Keep application checks equal
Run the same certificate, hostname, and content tests over both families. A green monitoring check that prefers IPv4 will not notice an IPv6-only failure.
curl -4 -I https://example.com
curl -6 -I https://example.com