If the origin dies and DNS still returns it, every client retries the outage. Failover that waits on a 300-second TTL is not failover. It is a delayed post-mortem.
Health checks write the answer
Cloud DNS health checks monitor endpoints continuously and remove non-responsive infrastructure from eligible answers. Operators should not be the health check.
TTL is the other half
A one-second minimum TTL lets planned and automatic changes take effect on a production clock. Some resolvers clamp TTLs; still lower them, and do not publish dead targets in the first place.
DNS failover is not BGP failover
DNS changes the record. BGP changes how an address is announced. Many architectures use both. Application load balancers still sit inside a pool once the client has arrived.
Rehearse the empty set
Fail a check in staging. Confirm resolvers stop receiving that answer. Decide what happens if every endpoint is down — DNS cannot invent a healthy target.