Leftover AAAA records

A leftover AAAA record is an IPv6 address that still points at your old server after you moved the site on IPv4. Dual-stack phones and networks prefer IPv6, so they keep hitting that old box even when your A record is correct. Office Wi-Fi that only offers IPv4 will look fine on your laptop and hide the problem. Align every AAAA with the new host, or remove the record if you are not serving IPv6.

Check what DNS still publishes

Start by asking a public resolver what AAAA answers exist for the names you actually serve. The apex, www, and mail each can carry their own AAAA, so check each one you use in production.

dig example.com AAAA +short

If that command prints an address, that address is still in play for dual-stack clients. Compare it to the A record for the same name. When they point at different machines, you effectively have two live productions. Publishing AAAA because it felt modern, while the target does not listen on IPv6, creates intermittent failures: some networks fall back, and phones can look broken without a clear error.

Confirm the host listens on IPv6

If you intend to serve IPv6, the web server and firewall must accept traffic on that address. It is common to lock down IPv4 in CSF or iptables and leave IPv6 open by accident. On shared hosting, LiteSpeed can bind to :: when IPv6 is enabled for the account. A leftover AAAA aimed at the old host is worse than a missing one: the old machine may still serve last week’s files, an outdated TLS certificate, and a stale database. AutoSSL on the new cPanel account does not revoke certificates on the previous server.

TLS, mail, and how you test

Clients that arrive over IPv6 use whatever certificate that box presents. Mixed-content warnings and odd HSTS behavior after a move are sometimes caused by this split. Mail over IPv6 also needs matching PTR and AAAA data; a leftover AAAA on the MX hostname is effectively a leftover mail server.

After you correct DNS, verify the new host actually answers on IPv6. From a machine that has IPv6, or from your VPS itself, run curl -6 -I https://example.com/. If that fails while AAAA is still published, dual-stack visitors will keep seeing failures or fallbacks. Either bind the web server on IPv6 and open the firewall, or remove the AAAA records. Do not leave a dangling AAAA as a later to-do. Fix both www and the apex; people often correct one name and leave the other pointing at the old address.

SRV records are a separate topic, except that they can also point at an old host by name. See SRV records if the leftover is a service name rather than an address.