DNS for Cloud Services: The Layer Everything Depends On

The records you will use

The apex problem is the one people meet first: you cannot CNAME example.com to a load balancer hostname. Every major DNS provider offers an ALIAS-style record that resolves this.

TTL strategy

TTL controls how long resolvers cache a record. It is the trade between change speed and query volume.

• Stable records — 3600 seconds or more. Fewer queries, slower to change.
• Records that might need to change — 300 seconds.
• Before a planned migration — lower to 60 seconds at least 48 hours in advance, so old cached values have expired.
• After the migration settles — raise it again.

Lowering TTL immediately before a change does not help: resolvers already hold the old value with the old TTL. Lowering it must happen well before.

Point at names, not addresses

Wherever a provider gives you a hostname for a load balancer or managed service, use it rather than resolving it to an address and hardcoding that. Those addresses change without notice, and a hardcoded one becomes an outage.

Routing policies

Managed DNS services can do more than return a fixed answer:

• Weighted — split traffic by percentage. Useful for gradual migration.
• Latency-based — return the endpoint closest in network terms.
• Geolocation — route by the querying resolver’s region, for residency or localisation.
• Failover — return the secondary only when a health check on the primary fails.
• Multi-value with health checks — return several healthy addresses.

DNS failover is genuinely useful for cross-region resilience, and it is slower than a load balancer because of caching. It complements load balancing rather than replacing it.

The mistakes that cause outages

1. Letting the domain expire. Set auto-renew and verify the contact address is monitored.
2. Changing nameservers without copying every record first. The new zone must be complete before delegation moves.
3. Long TTLs during a migration, leaving some users on the old endpoint for hours.
4. Dangling records pointing at deallocated addresses — a subdomain takeover risk if someone else claims that address.
5. Forgetting AAAA records when adding IPv6, or having one that points somewhere broken.
6. A single nameserver provider with no redundancy, in an outage that takes everything with it.

Dangling records deserve attention. Audit them whenever you decommission infrastructure, not only when something breaks.

Managed DNS options

Route 53, Cloud DNS, Azure DNS and OVHcloud’s DNS are all fast, anycast and inexpensive. Registrar-provided DNS is usually adequate for simple zones and generally lacks routing policies and health checks.

Keeping DNS with a provider separate from your hosting is worth considering: it means a provider account problem does not simultaneously remove your ability to redirect traffic elsewhere.

Common questions

Where to go next

See cloud networking basics and uptime and redundancy.