DNS failover

1. Delegate a piece of your domain, such as gslb.example.com. Never the whole domain.
2. DNS Failover, Add a zone. Give one nameserver name per node, such as ns1.example.com and ns2.example.com. You are inventing these now.
3. Add a name, such as www, type A, TTL 30.
4. Add one answer per node. Pick the node and its address fills in.
5. Create the records the page prints at your domain host.
6. Point the name people actually use at it with a CNAME.

Two kinds and you need both. The page prints them with your addresses already filled in.

The glue records are the ones people forget, and forgetting them looks exactly like the feature being broken.

Open the hosted zone for example.com, which is the parent of the part you are delegating. Create these records there, not in a new hosted zone.

Do not create a hosted zone in Route 53 for gslb.example.com. Your nodes are the nameservers for it now, and a hosted zone as well gives two different sets of servers claiming the same name.

Ask each node directly, with no port on the end.

dig @203.0.113.10 www.gslb.example.com +short
dig @203.0.113.11 www.gslb.example.com +short

Both should answer and both should list every healthy node. Then ask the internet rather than the nodes, which tests the whole path:

dig shop.example.com +short

In this order, because the first two are where nearly all of these end.

1. Ask the node directly with no port on the end. If that answers, the software is working and the problem is the delegation.
2. Check the records at your domain host against the ones printed on the zone. The glue records are the ones people miss.
3. Look at the DNS listener panel on each node. It reports what that node is really doing, which is not always what the page shows.
4. Remember a name only starts working once the old answer has been forgotten everywhere, which can take longer than the TTL suggests.

The part that answers DNS runs without root on purpose, and a program without root cannot bind port 53. So it listens on 5353 instead, on UDP and TCP both, and a firewall rule the software manages sends UDP and TCP port 53 to it.

If you test against 5353 you get an answer whether or not the public path works. Always test with no port on the end, because that is the path your visitors use.

Thirty seconds is a sensible low number and is what the software suggests. Going much lower mostly buys extra lookups without moving anybody faster, because resolvers and browsers have their own ideas and some ignore very short values entirely.

DNS Failover, edit the name, and turn off the answer for that node. Save. Wait at least twice the TTL before doing anything else, because that is the time for computers elsewhere to forget the old answer.

Skipping that wait is the difference between nobody noticing and a few people getting errors.

Set If every node is down to hand them out anyway. If the health check itself is what broke, an empty answer takes the site down when it did not have to be.

The name at the very top of a domain cannot be a CNAME, so an apex needs addresses rather than an alias. Either delegate the apex, which moves everything including your mail records onto these nodes, or use your provider's own failover feature for that one name.

Removal is deliberately slower than restoring, so a brief hiccup does not move everybody.