Health-based DNS failover
Publish eligible endpoint answers while accounting for probe state and client caches.
DNS failover selects published answers from a configured set of endpoints and health checks. It changes authoritative answers rather than moving existing client connections.
Configure a record policy
Under DNS → Record set → Failover, identify primary and fallback endpoints, health checks, and the no-healthy-target behavior. Checks need the intended protocol, port, hostname, and success criteria.
A TCP probe establishes connection acceptance. An HTTP probe can establish the configured response condition. Neither automatically verifies every application dependency. Use a readiness endpoint appropriate to the service.
Health transitions
The policy evaluates its configured failure and recovery thresholds. A single miss does not change answers when the threshold requires several consecutive failures. A paused or unknown check follows the explicitly selected unknown-state policy; missing data is not a successful probe.
Inspect both evaluated health and active publication revision. A newly selected fallback becomes authoritative only after publication succeeds.
Cache effects
Recursive resolvers and clients can retain the previous answer until its TTL expires. Lowering TTL during an incident does not shorten an older cached TTL. Existing connections can continue to the former endpoint independently of DNS.
Plan for overlap and client retries. DNS failover cannot revoke a cached address or fence a database writer in a failed region. Perform storage or application promotion separately before publishing the recovered service.
No healthy endpoint
Choose explicit behavior: return no eligible service answer or retain a designated last-resort endpoint. Retaining a last-resort answer does not make that endpoint healthy; its use is visible in policy status.
Test and remove
Run a controlled probe failure and inspect authoritative answers, publication history, and a recursive client path. Restore health and observe recovery thresholds before ending the exercise.
Disabling failover leaves the explicitly reviewed static answer set. Deleting a health check used by active failover is blocked until that dependency is removed. See DNS API, regional recovery, and load-balancer readiness.