IPv6 is the internet's larger address space, and for most servers enabling it is optional. What is not optional is doing it completely, because a half-configured setup breaks things that would have worked fine without it.
What actually changes
The server gets a second address. Clients that have IPv6 connectivity generally prefer it when a domain publishes an AAAA record.
That preference is the whole risk. Publishing the record is a promise, and clients act on it before you find out whether it was true.
The failure mode
Three ways to break it, all producing the same symptom.
The service is not listening on IPv6. The address exists, the web server binds only to the IPv4 address, and connections are refused.
The firewall covers only IPv4. On Linux these are frequently separate rule sets, so a carefully built firewall can be wide open or entirely closed on IPv6 without anything indicating it.
The address is not routed. It is configured on the interface and the upstream network does not carry it.
In every case, visitors with IPv6 fail and visitors without succeed. From your own network (usually IPv4) the site works perfectly, and the report is a small number of users who cannot reach a site nobody else has trouble with.
The order that avoids this
Configure the address. Make the services listen. Open the firewall. Test from an IPv6-capable network. Publish the AAAA record last.
Until the record exists, an incomplete setup harms nobody. After it exists, it is live for a share of your visitors.
Checking
ip -6 addr show ping6 -c 3 google.com ss -tlnp | grep ':80' ip6tables -L -n
In the listening list, an address shown as * or [::] means both families; an IPv4 address alone means IPv4 only.
From outside, test with a client forced to IPv6:
curl -6 -I https://example.com
If that fails while curl -4 succeeds, the AAAA record should not be published yet.
Mail is where it matters
This is the case that catches servers whose administrators considered IPv6 irrelevant to them.
If the server has IPv6 connectivity, its mail server may use it for outbound delivery, and the receiving side then judges the IPv6 address rather than the IPv4 one.
Two things must therefore cover it. Reverse DNS for the IPv6 address must resolve to the server's hostname, large mail providers are notably strict about this on IPv6 and reject outright. And SPF must authorise the IPv6 address, using an ip6: entry, or the mail fails policy checks.
The symptom is mail that was working and now bounces from one large provider, with a reason mentioning an address you did not know your server used. Understanding SPF, DKIM and DMARC goes into the record, and PTR and reverse DNS walks through the other half.
The alternative, if IPv6 mail is not wanted, is to configure the mail server to send over IPv4 only: a legitimate choice, and better than sending from an address with no supporting records.
Logging and blocking
Once IPv6 is live, your logs contain IPv6 addresses, and anything that reads them must handle both formats.
Blocking tools written for IPv4 will silently fail to block an IPv6 source, which matters because an attacker with a large IPv6 allocation has effectively unlimited addresses. Blocking a single IPv6 address accomplishes very little; blocking a prefix is the equivalent action.
Setting up fail2ban explains making it cover both, and configuring a firewall deals with keeping the two rule sets in step.
Whether you need it at all
For a typical website, no. Every IPv6-capable client can still reach an IPv4 address, so nobody is excluded.
It becomes worth doing when a network you must serve is IPv6-only, when your provider charges for scarce IPv4 addresses, or when you are already handling IPv6 elsewhere and want consistency.
What is not a good reason is doing it because it is modern, then leaving it half-finished. Understanding bandwidth and network limits walks through the rest of the network side.
Confirm the whole path works, not just the address
An address configured on the interface is not the same as a working route, and each layer can fail independently.
ip -6 addr show scope global ip -6 route show default ping6 -c 3 2606:4700:4700::1111 curl -6 -sI https://example.com/ | head -1
Work upwards. An address with no default route reaches nothing. A route that answers a ping but fails on a name means resolution is the problem rather than connectivity.
The failure worth recognising is a machine that has an address, cannot actually route, and has a published record pointing at it. Clients that prefer the newer protocol try it first, wait for a timeout, and fall back, which is felt as a site that takes several seconds to start loading for some visitors and is instant for everyone else.
Your rules have to cover both families
Firewall and access rules written for one protocol do not apply to the other, and the gap is silent.
ip6tables -L INPUT -n -v --line-numbers 2>/dev/null | head -20 ss -tlnp | grep -E '\*:|::' | head grep -rn 'allow\|deny\|Require ip' ~/public_html/.htaccess 2>/dev/null | head
A service bound to both families with rules covering only one is reachable by anyone using the other. That is the common version of this and it exists on more servers than people expect, because the older rules were written first and never revisited.
The same applies to address based allow lists in an application or a control panel. An entry naming a single address protects that route only, and a visitor arriving on the other protocol is not matched by it.
Logs and blocking need it too
Tools that record and act on addresses handle the newer format inconsistently, and that shows up as protection which quietly stops working.
awk '{print $1}' ~/logs/example.com | grep -c ':'
fail2ban-client status sshd 2>/dev/null | tail -3
The first command counts how many requests arrived on the newer protocol. If that number is significant and your blocking tool only ever bans the older format, a source that is being blocked simply reconnects on the other one.
Check that whatever bans addresses is configured for both, and check that your log analysis groups them correctly. A single visitor appearing as two different sources distorts every figure derived from the log. Setting up fail2ban covers the configuration.