Smarter by Design.Simpler for Business
TR7Enterprise Application Delivery & Security Platform
What is fail-safe; what does GTM answer if no address is healthy?
Short answer
Fail-Safe Records are the last-resort addresses of a record: if, after health filtering and the operating mode are applied, no address remains to be included in the answer, the DNS Service answers with these addresses; in Datacenter mode, fail-safe is not applied in the Client Based data center selection. It is turned on in the record form with the Enabled / Disabled switch (default Disabled), and one or more addresses suitable for the record type are entered; no HC condition is bound to these addresses, and they are returned regardless of their health status. While fail-safe is in effect, the status of the record becomes Fail-safe; if no fail-safe is defined, the status becomes No healthy records and no address is returned in the answer for this record (record status values). When a healthy address comes back, the answer returns to normal by itself.
How Does It Work?
Fail-safe is the last step in forming the answer (record resolution logic). When it comes into play varies according to the operating mode:
| Operating mode | When fail-safe is returned |
|---|---|
| Standalone | While none of the addresses in the group is healthy. |
| Disaster Recovery | While there is no healthy address in the group answering at that moment (Main DC or DR DC). Under the default condition, when the Main DC becomes empty, a switchover to the DR DC is made first; fail-safe is returned if there is no healthy address in the DR DC either. |
| Datacenter | While there is no healthy address in any data center. While DC Selection = Client Based is selected, fail-safe is never applied. |
Situations that do not trigger fail-safe: only a part of the addresses being unhealthy (the status becomes Partially OK (a record is down)), and the Topological Selection rules not matching the client.
Fail-safe Records in TR7
- Configuration: The Fail-Safe Records field at the end of the record form; the addresses are validated against the format of the record type (such as IPv4 on an A record, a name ending with a dot on a CNAME).
- Typical use: An address serving a maintenance page, a backup vService in another region, or a static redirect target. Whether this target is up is not verified by GTM.
- Monitoring: The red Status value Fail-safe in the Records list and the Fail-safe badge in the Summary column; the Fail-Safe Records row in the record preview (preview).
- Log: In the Standalone and Disaster Recovery modes, the transition to fail-safe is written to the GTM Logs screen as
<name>/<type>: Fail-safe records are on, and when there is neither a healthy address nor a fail-safe, as<name>/<type>: No healthy records left. - Cluster: Each device calculates the status of the record itself; a separate status per device is seen in the list (operating mechanism).
Common Misconceptions
- "The fail-safe address is also monitored with a health check." Fail-safe addresses are returned unconditionally; the administrator must make sure that the target is working.
- "In Disaster Recovery mode, fail-safe takes the place of the DR DC." When the switchover condition occurs, a switchover to the DR DC is made first; fail-safe is returned only when no healthy address remains in the answering group (How does the switchover between the primary and backup data centers work in Disaster Recovery mode?).
- "If there is no fail-safe, GTM keeps returning the last known address." If no fail-safe is defined, the record goes into the No healthy records status and there is no address for this record in the answer; clients that cached the answer earlier, however, use the old address until the TTL expires.
- "Fail-safe is the last resort in every mode and every selection." In Datacenter mode, the Fail-Safe Records are not applied in the Client Based data center selection; in this selection, if no healthy address remains at all, there is no address for this record in the answer.
- "Fail-safe comes into play when an address goes down." Fail-safe is returned only when no healthy candidate remains at all; in a partial failure, the answer is given with the remaining healthy addresses.
How it is done in the documentation
