Edge and reliability / Advanced / 6 min
Multi-region failover: when a whole region goes dark
Kill the primary region and time the outage: health checks, replica promotion and DNS TTL. Async loses writes, sync costs latency.
Start the simulation → Change the load, break a part, watch what happens. Free, no sign-up.
In short
- What it is
- Multi-region failover moves traffic and the primary database to another region when a whole region fails.
- Why it matters
- Regions do go down (power, network, bad deploys), and one region cannot promise high availability on its own.
- The trade-off
- Async loses the last writes (RPO above 0), sync adds a cross-region round trip; fast checks and low DNS TTLs cut downtime (RTO) but risk false failovers.
- Say it in an interview
- "Active-passive, health checks with a quorum to avoid split brain, automatic replica promotion, low-TTL DNS or a global load balancer, and RTO/RPO targets that pick async or sync."
Check yourself
Why can a region failover take minutes even with healthy replicas?
Answer: Detection needs several failed health checks, then users keep the old address until their DNS cache expires. RTO is detection + promotion + the DNS tail; short check intervals and low TTLs (or anycast/global load balancers) shrink it.
With async replication, what is lost when the primary region dies?
Answer: Writes confirmed to users but not yet copied to a replica. That gap is the RPO. Sync replication makes it zero, at the cost of a cross-region round trip on every write.
What does a lower DNS TTL buy you?
Answer: Users move to the new region sooner, at the cost of more DNS lookups. Clients re-ask DNS more often, so after a failover their cached answer to the dead region expires quickly.