Failover

With failover enabled on an A / AAAA record, the monitors connect to its address on a schedule. When every selected monitor keeps failing, the record is handled as you chose: fall back to the next line (down to the default line), switch to a backup address, or notify only; everything is restored automatically on recovery. Recommended for split-horizon setups: say the mainland-China line points at a Hong Kong box and the default line at Singapore — if Hong Kong goes down, mainland visitors automatically fall back to Singapore.

Turn it on

On the zone page, edit (or add) an A / AAAA record, expand "Failover" and tick the box.

Pick the monitors

Pick the monitors: overseas (Singapore / Nuremberg / Chicago) or mainland China (Chengdu / Guangzhou). The mainland, Telecom, Unicom, Mobile and CERNET lines default to mainland monitors, everything else to overseas — visitors on those lines are inside China, and an overseas probe cannot see "unreachable from China".

Pick the check

Pick the check: TCP port (a successful connection counts as up), or HTTP / HTTPS (port and path; 2xx / 3xx counts as up, Host is the record's hostname, redirects are not followed). Wildcard records have no fixed hostname and only support TCP.

Pick what happens on failure

One of three: notify only (resolution unchanged); fall back to the next line (default; recommended for split-horizon setups, visitors on this line get the next broader line's address down to the default line — a record on the default line itself has no next level, cannot fall back, and only notifies); switch to a backup address (1–3 public IPs of the same type; backups are monitored too, only the first healthy one is served, and it switches back automatically once the original recovers).

Save

Save. The record row shows "checking" and turns "healthy" after a few minutes.

IntervalEvery monitor checks every 60 seconds with a 5-second timeout; the same for everyone, not adjustable.

DownAt least 2 monitors on the selected side are online and each of them has failed 3 times in a row (about 3 minutes).

UpAny monitor succeeds twice in a row.

No fallback, no changeBefore falling back, we check that visitors on this line would still get a usable address from the next broader line (CIDR > country > continent > default). If not, nothing changes and the row shows "unreachable, no fallback, unchanged". With several addresses on the same name and line, only the failing one falls back.

Backup addressesWith "switch to a backup address", the backups are checked the same way as the original. When the original is down the record serves the first backup judged up; if none is healthy nothing changes and the row shows "no healthy backup, unchanged". The record value shown in the panel and exports is always the original you entered.

Too few monitorsIf fewer than 2 monitors on a side are online, that side makes no decisions and keeps the current state; records that already fell back or switched to a backup stay as they are.

NotificationsFallback, backup switch and recovery all notify the record owner (site message, plus email / Telegram per your preferences); at most once per record every 30 minutes.

Switching depends on TTL: visitors keep the old address until resolver caches expire, so set monitored records to TTL 60 (the minimum).

Editing the record yourself (including disabling / enabling) clears any fallback or backup switch immediately and the monitors judge afresh; turning failover off also restores the record immediately.

Private addresses (10.x, 192.168.x and so on) cannot be reached by the monitors and cannot be enabled; disabled records, suspended zones and brand-NS managed records are not checked.

Monitor source addresses are fixed: mainland 139.155.126.133 and 8.134.149.243 plus their IPv6, overseas 52.76.16.74, 46.38.235.67 and 207.211.188.115 plus their IPv6. Allow them if your origin has a firewall allow-list.

Available to every user with no cap on the number of checks; identical address, method and port are checked only once.