The reason simply is that when no type is specified, `dig` performs a lookup for an A record (i.e. IPv4 address). When you manually specify AAAA, it does AAAA lookup, which returns IPv6 address. (details in `man dig`)

One possibility: You might be getting that AAAA from a v4 DNS server (or resolver/cache), whereas `dig -6 fly.io` attempts the query over v6. For example, try `dig -4 fly.io AAAA` ("use a v4 DNS server address from /etc/resolv.conf to get the v6 (AAAA) record") versus `dig -6 fly.io` ("use a v6 DNS server from /etc/resolv.conf to get the address") - the latter may not work if you don't have IPv6 set up on your local network. Basically, your /etc/resolv.conf on your computer (or home router) is pointing at an IPv4 address for a DNS server, so that DNS server/resolver is probably defaulting to giving you a v4 record back.

Your browser, however, may also be circumventing all of this and may be using DoH to a public DNS server, and therefore may have a completely different DNS querying experience than what you're seeing with dig...so you should also take a look at what your browser's network inspector tells you about the host you're getting the fly.io content from.

I wonder if there's a good service for testing the IPv6 readiness of a website. Something like SSL Labs or Mozilla Observatory, but for IPv6 on the server side.