The number of internet devices long ago outgrew IPv4 address space, so mobile operators and ISPs are gradually moving to IPv6. Most users still have both protocols, so an IPv4-only site keeps working for them. Enabling IPv6 properly prepares you for the future and can give more direct connections on some networks. Enabling it badly can make the site slow or unreachable for some visitors, so do it step by step.
What an IPv6 address looks like in DNS
An IPv6 address is 128 bits written as eight hexadecimal groups separated by colons, with runs of zeros shortened, for example 2001:db8:10::25. The 2001:db8::/32 range used here is reserved for documentation. IPv4 uses an A record, IPv6 uses AAAA, and having both is called dual-stack: the client chooses which protocol to use.
example.uz. 3600 IN A 203.0.113.10
example.uz. 3600 IN AAAA 2001:db8:10::25Step one: does the server really have IPv6
Before adding AAAA, confirm the server has a working global address reachable from outside. A link-local fe80:: address is not enough. On shared hosting, IPv6 availability depends on the provider; for sayt.uz hosting or VPS you can check in the cabinet or with support. If there is no address, do not publish AAAA at all: a broken AAAA record is worse than none.
ip -6 addr show scope global
ping -6 -c 3 2001:4860:4860::8888
curl -6 -I https://example.uzMake the web server listen on IPv6
Many servers listen only on IPv4 by default. In Nginx each server block needs separate IPv6 listen lines, otherwise DNS resolves but connections hang.
server {
listen 80;
listen [::]:80;
listen 443 ssl;
listen [::]:443 ssl;
http2 on;
server_name example.uz www.example.uz;
}Check with nginx -t, reload with systemctl reload nginx, and confirm with ss -tlnp | grep ':443' that [::]:443 appears. In Apache, Listen 443 usually covers both protocols, but virtual hosts bound to a specific IPv4 address need the IPv6 address added too.
Firewall and application blind spots
IPv4 firewall rules do not carry over to IPv6: iptables and ip6tables are separate, so open ports 80 and 443 for IPv6 as well, and with UFW make sure IPV6=yes is set in /etc/default/ufw. The reverse risk is just as real: a database or SSH port closed on IPv4 may be wide open on IPv6. In the application, IP allowlists for an admin panel must include IPv6 addresses, a VARCHAR(15) IP column cannot hold IPv6 (use at least 45 characters), and log parsers or fail2ban must understand IPv6.
Email: SPF and PTR
If your mail server sends over IPv6, add an ip6: mechanism to SPF and set up reverse DNS for the IPv6 address. Large mailbox providers apply noticeably stricter PTR and authentication checks to IPv6 senders; if you cannot set PTR, keep outbound mail on IPv4 for now.
example.uz. 3600 IN TXT "v=spf1 ip4:203.0.113.10 ip6:2001:db8:10::25 -all"Testing, with a real-world order of steps
When a private clinic in Tashkent moved its site to a VPS, the administrator first confirmed a global address and outbound ping, then added listen [::] lines and opened firewall ports, then published AAAA with a short 300-second TTL and tested from an IPv6 network. After a few quiet days the TTL went back to normal.
dig AAAA example.uz +short
curl -6 -sS -o /dev/null -w '%{http_code}\n' https://example.uz
curl -4 -sS -o /dev/null -w '%{http_code}\n' https://example.uzBoth curl calls should return the same status code. Certificates are issued for names, not IPs, so you do not need a new certificate, but Let's Encrypt HTTP validation may reach the domain over IPv6, so port 80 must be open on IPv6 for renewals to work.
When to back out
If users report the site "hangs for a while" after AAAA goes live, suspect the IPv6 path. Modern browsers race both protocols, but older apps and some API clients do not. Removing AAAA while you investigate is the safest move, because IPv4 keeps the site running.