DNS failover changes future answers after health policy changes. Detection, cached answers, and client reconnection determine recovery.

Health checks write the answer

Cloud DNS health checks monitor endpoints continuously and remove non-responsive infrastructure from eligible answers. Operators should not be the health check.

The delivery model

How it works

DNS failover

  1. 01DetectProbes identify a failed endpoint.
  2. 02WithdrawPolicy removes it from eligible answers.
  3. 03ReconnectClients obtain a usable answer and retry.
Conceptual model for this configuration. The actual path depends on provider policy and application behavior.

TTL is the other half

A short published TTL can reduce the lifetime of newly cached answers, but detection time and client behavior remain separate. Resolver policies can also affect how quickly clients observe the change.

DNS failover is not BGP failover

DNS changes the record. BGP changes how an address is announced. Many architectures use both. Application load balancers still sit inside a pool once the client has arrived.

Rehearse the empty set

Fail a check in staging. Confirm resolvers stop receiving that answer. Decide what happens if every endpoint is down — DNS cannot invent a healthy target.

Validate before production

Disable a staging endpoint and record detection time, authoritative answer change, resolver behavior, and client recovery independently. Test both partial and total failure. Keep a defined response for the case where every endpoint is unhealthy.

  • Record the configuration and expected result before changing traffic.
  • Keep evidence of the test and a working rollback for the previous behavior.

Sources & further reading