The "answers ping while the application is down" failure is the one that burns people, because every layer reports green except the one users actually touch. One wrinkle on the 30-60s TTL guidance: a meaningful share of resolvers clamp minimum TTLs, so your real failover time is the clamp, not the config. Worth measuring from the outside before you need it.