You enabled IPv6 on a Friday afternoon. The change window was clean, the ip -6 addr output looked right, smoke tests passed. By Monday, half your monitoring was green and lying to you. Your blackbox exporter was happily probing https://10.0.4.12/health over IPv4 while user traffic from mobile carriers — which are all v6-first now — fell over a cliff on a path your dashboards never touched.

That is the defining property of dual-stack failure: it doesn't break IPv4 loudly. It breaks it silently , by making IPv6 preferred (RFC 6724 address selection) and then failing on a path nobody instrumented. A broken v6 route doesn't lose to a working v4 route — it wins, and then it times out.

This guide is for sysadmins, SREs, and network/security engineers running real infrastructure. By the end you'll have working configs for Linux hosts, nginx, HAProxy, systemd-resolved, and nftables, plus a rollout order that keeps you off the 3am page.…