Your DR plan assumes a 60-second DNS TTL gives 60-second failover. Traffic to the failed region continues for 20 minutes. Explain and design something better.

Why the assumption fails

TTLs are honoured inconsistently at every layer.

Recursive resolvers sometimes enforce their own minimums regardless of what you publish. Operating systems cache independently of the resolver. Several runtimes cache aggressively — the JVM historically cached successful lookups for the process lifetime unless configured otherwise, and long-lived server processes are exactly the clients you care about in a DR event.

Connection pools compound it: an established connection is not re-resolved. A pooled client keeps using the dead address until the connection itself fails.

So there is always a long tail. Plan for it rather than tuning around it.

Design that actually fails over

Anycast — the same address advertised from multiple locations, with failover by BGP route withdrawal. Convergence in seconds, requiring nothing of the client and unaffected by DNS caching. This is how large DNS and CDN providers achieve fast failover.

Health-checked load balancing at a layer below DNS. A global load balancer with a single stable address moves traffic without any client re-resolution.

Client-side awareness where you control the client: multiple endpoints, health-aware selection, circuit breaking and connection recycling. Set the JVM's networkaddress.cache.ttl explicitly.

If DNS failover is the only option

Lower TTLs hours in advance of a planned change — the old TTL governs how long the old value persists, so lowering it at cutover time is too late.

Keep steady-state TTLs moderate (a very low TTL is a query-volume and availability cost paid continuously for a rare event).

Measure the actual drain curve in a game day rather than assuming, and put the measured number into the DR plan — the RTO must reflect the tail, not the TTL.

What a strong answer adds

Meta's 2021 outage as the counter-example in the same domain: their name servers withdrew BGP routes when isolated from the backbone — individually correct behaviour that, when all of them did it at once, removed the domain from the internet. DNS is a control plane, and its failure modes are architectural.