After upgrading the website's load balancing, some users keep reporting DNS errors!

Hi Alex, monitoring shows everything green but users report Origin DNS Errors? That's a classic scenario—basically, everything looks fine on the backend, but users are actually encountering issues when accessing your site. The root cause often isn't whether your server is alive, but where users are actually being resolved to. The most common reasons fall into these three categories: DNS records haven't propagated consistently: Different regions or ISPs may resolve to different IPs.Perhaps your load balancer just switched, but some locations still point to old, decommissioned IPs. TTL settings are tricky: TTL set too long, or caching layers like cloud DNS, CDN, or local ISP prevent new records from fully propagating. CDN or backend issues: CDN nodes in a specific region fail to reach your origin server (or LB).Possible causes include new nodes not added to whitelists or firewalls blocking origin IP ranges. Why does it work in the office but not for users? This is crucial—it indicates the issue isn't universal. Your office DNS cache may have updated to the correct IP, but external users' ISP DNS still points to problematic nodes, or a CDN node in a specific region is down. 👉 So for these issues, 90% isn't about "whether the service is faulty," but rather "where each user is being resolved to." Follow the suggested troubleshooting sequence below for maximum efficiency: First, test DNS resolution across multiple regions. Don't just ping from your own computer—use online tools or ask friends in different locations to run dig commands. Verify if the returned IPs are consistent.Focus on checking if any outdated, decommissioned IPs are being returned. Then verify that all backend nodes are "identical." For every server behind the load balancer, check: - Are certificates present and correct? - Is the virtual host configuration properly bound to this domain? - Are business code/files consistent (e.g., did a new machine miss uploading files?) - Did Nginx/Apache reload the configuration properly?We often encounter situations where "health checks pass" (only port testing), but actual access fails due to missing certificates or website files. Next, check the CDN/cloud provider's origin server logs. Look for 5xx errors, "origin unreachable," or timeout errors originating from specific regions. This helps quickly pinpoint which node is failing to reach the origin server. Finally, review DNS TTL and caching settings.If you've recently switched architectures, pay special attention to DNS record TTL values and verify that cloud DNS resolution and CDN cache settings are configured correctly. Sometimes you think you've switched over, but a cached entry at some layer in the lookup chain still holds the old record. So, instead of staring at monitoring charts, start by tracing back from "which IP the user is actually resolved to."