DNS in cloud: redundancy pitfalls

Overview

DNS outages look like “the internet is broken.” Cloud DNS (Route 53, Azure DNS, Cloud DNS) is resilient, but misconfiguration and stale delegations still cause incidents.

Checklist

• Registrar glue records point to the right nameservers; document the party who holds the registrar login (often not the MSP—get delegated access).
• Health checks and failover records for multi-region endpoints; understand TTL tradeoffs during migrations.
• Split-horizon or private zones linked to the correct vNets/VPCs; stale links after vNet peering changes = silent resolution failures.

Migration discipline

Lower TTLs before cutover; verify with dig +trace from external and internal resolvers; keep rollback old records documented 48 hours.

Security

Disable zone transfers to untrusted parties; enable DNSSEC where client requirement and registrar support align; monitor for subdomain takeover on deleted app services.