IPv6 on a VPS: on by default, tested on purpose

On a LogicWeb VPS, IPv6 is on by default. If your template or DNS still publishes an AAAA record, dual-stack clients will try IPv6 first, so you must either serve traffic correctly on IPv6 or remove that record on purpose. Leaving a leftover AAAA after a move or a v4-only setup is not a soft warning; phones and other Happy Eyeballs clients will treat it as a live path to your site.

Prove both paths in the first hour

Firewall rules that only cover IPv4 are a common source of tickets after DNS has been live for days. Attackers can read AAAA records, and so can Let’s Encrypt. A virtual host bound only to 0.0.0.0 is not listening on ::. Some stacks dual-bind when you listen on * or an explicit IPv6 address; nginx and LiteSpeed often do. Some Java and Node defaults do not. Test both families yourself instead of waiting for “propagation.”

curl -6 -sI https://example.com | head

If that command fails while dig AAAA still returns an address, clients are being sent somewhere that does not answer. Repeat with curl --ipv4 and curl --ipv6 until both return the site you expect, or delete the AAAA record deliberately. IPv6 is optional only when the record is gone. Once it is published, dual-stack clients will prefer it.

Certificates, mail, and leftover AAAA records

HTTP-01 validation for AutoSSL follows AAAA when it exists. A broken IPv6 path can fail certificate renewal, then leave browsers on LTE still hitting a cached AAAA. Mail over IPv6 works when PTR, HELO, and the listener are in place, but many receivers still evaluate the IPv4 path they also see. Enabling IPv6 does not retire reverse DNS on IPv4. If you meant to stay v4-only after a migration, remove the old AAAA yourself; mobile clients will not do that for you.

Match your IPv6 firewall policy to IPv4. Opening ports 80 and 443 in iptables while leaving ip6tables or firewalld’s IPv6 zone at a default-allow stance can expose a service you bound to ::. Extra IPv4 addresses on the guest do not change that. Test IPv6 the same hour you point DNS, not after the first phone-related ticket arrives.

What to do on your VPS

You have root on a KVM VPS, so you control listeners, firewalls, and DNS at your registrar or panel. Confirm the application listens on :: or dual-binds as you intend. Align ip6tables or firewalld with the same ports you allow on IPv4. Keep or remove AAAA so it matches reality. When both stacks answer cleanly—or when AAAA is gone—AutoSSL and everyday clients behave the way you expect.