DNS is the first step in reaching anything. A domain whose authoritative servers are all operated by one provider has that provider as a single point of failure for the website, the mail, the API and every integration that resolves its name.
What an outage takes with it
Authoritative DNS unavailable ├── website unreachable once TTLs expire ├── inbound mail deferred (MX unresolvable) ├── outbound mail failing SPF/DKIM lookups at receivers ├── API clients failing ├── MTA-STS policy unfetchable └── ACME validation failing -> certificates cannot renew Nothing is down. Nothing can be found.
TTLs provide the only cushion, which makes the usual advice to run short TTLs a trade rather than a rule: a five-minute TTL means a five-minute cushion.
It is not hypothetical
Large authoritative providers have had multi-hour outages, from denial-of-service attacks against them and from their own configuration errors, taking down thousands of unrelated organisations at once. An estate concentrated on one provider inherits its worst day.
The options
| Arrangement | Protects against | Cost |
|---|---|---|
| One provider, anycast | Regional network problems and moderate attack volume | Usually included. Not a second provider. |
| Primary plus a secondary at the same provider | A server failure | Little. Not a provider failure. |
| Two independent providers, both authoritative | One provider failing entirely | Real setup and synchronisation work |
| Two providers with automated sync from a single source | The same, without manual drift | The same plus tooling, and worth it |
Only the last two address the risk in the lesson title. A secondary inside the same provider shares its control plane, its network and its bad afternoon.
Anycast, honestly
- It is real and valuable. The same address is announced from many locations, so queries reach the nearest node and a node failing is absorbed.
- It is not redundancy across providers. One control plane, one set of credentials, one configuration error.
- Every provider advertises it, which makes it a poor differentiator and no reason to skip a second provider.
Ask what the delegation actually contains
dig +short NS example.com is the test. Four nameservers under one provider’s domain is one provider, however many locations it announces from. Two names under each of two domains is two providers, and it is visible in one query.