An address is not a working path
An AAAA record says that a name has an IPv6 destination. It does not establish that the client has usable IPv6 routing, that the service listens on IPv6 or that the return path works. Test both address families explicitly when diagnosing a dual-stack failure. A successful IPv4 result should not be reported as validation of IPv6.
Avoid blanket IPv6 fixes
IPv6 is not simply IPv4 with longer addresses. It relies on ICMPv6 for important network functions, so indiscriminately dropping it can break reachability in ways that resemble random application stalls. Keep the firewall policy tied to actual traffic requirements and verify it on the host's network. Do not disable an address family globally just to hide one service's untested path.
Choose a scope for exceptions
When only one application's IPv6 destination is unreliable, make a narrow, documented exception if that application supports it. Preserve other working paths. Revisit the exception after the upstream problem changes. Keep client connection addresses separate from the proxy server's outbound address-family policy: the two decisions affect different portions of a request.
At the terminal
curl -4 --noproxy '*' -I https://example.com/
curl -6 --noproxy '*' -I https://example.com/
ip -6 route show
ip -6 address show