Please note this is a pretty nerdy thing, but this probably accounts for issues with Mobile apps not working properly at times. Invariably when we are out and about we are on ipv6.

That said I am not sure how to get a hold of any tech staff inside Merill, and my hope is somebody from inside ML/BoA reads this. Do keep in mind I 100% used AI to figure this out, but once I forced my Macbook to go exclusively ipv4 things did start working properly hence my post here.

Here goes.

`www.ml.com\` loads, but its CSS, JS and images come from `www.ml.bac-assets.com\`. Over IPv6 that host returns **403 Access Denied** (an Akamai error page), while over IPv4 the same URL returns 200. Dual-stack browsers prefer IPv6, so the page loads without its assets.

**Reproduce** (any dual-stack client that gets AAAA records for the host):

“`

URL=https://www.ml.bac-assets.com/ml/ml-dap/spa-assets/css/styles-294f529c8ba3d414e2aa.m.css

curl -4 -sS -o /dev/null -w "%{http_code}\n" $URL # 200

curl -6 -sS -o /dev/null -w "%{http_code}\n" $URL # 403

“`

The IPv6 edges are `2600:1408:c400:11::17cd:6b51` and `::17cd:6b58`, both 403. I got the same result forcing each one with `–resolve`, so it is not caused by DNS.

**Scope**

– I saw the 403 from three different networks: a home connection on Optimum/Altice, and two Oracle Cloud hosts in different regions.

– The CNAME chain is `www.ml.bac-assets.com\` → `ml-cdn.gwimglb.ml.com` → `www.ml.bac-assets.com.edgekey.net\` → `e200256.dsca.akamaiedge.net`.

– The GSLB returns AAAA records only for some resolvers. 1.1.1.1 and 8.8.8.8 return none, so most users get IPv4 and never see this. Users whose resolver does get AAAA see the broken page.

– I confirmed the 403 from all three of my vantage points, but I have not confirmed that it affects every IPv6 client.

**Example Akamai error reference:** `#18.58dfda17.1789780013.2d54bccb` (`https://errors.edgesuite.net/18.58dfda17.1789780013.2d54bccb\`)

**Likely fix:** serve the IPv6 edge addresses for this hostname, or stop returning AAAA for it, so both IP families behave the same.