Latest / The Cloud Business Podcast with Fexingo: AWS, Azure, GCP, and Enterprise Infrastructure / How Cloud Contracts Now Charge for DNS to On-Prem Failover Testing
Transcript
- Lucas: So last month, a financial services company in Chicago — let's call them Midwest Fin — got a cloud bill that included a line item they had never seen before. It was labeled 'DNS to On-Prem Failover Testing — 14,230 queries.' The charge was $4,700. And their cloud architect told me they had been running failover drills every hour for three years. Luna: Wait — they had been doing that for three years and only now got charged for it? Lucas: Exactly. And that's the story of today's episode. Cloud providers — AWS, Azure, GCP — have quietly started charging for DNS traffic that originates in the cloud and goes to on-premises endpoints as part of failover testing. It's not a new product. It's a new billing dimension. Luna: So it's not the DNS query itself that's new — it's the destination. Cloud-to-on-prem health checks now have a price tag. Lucas: Right. Let me give you the mechanics. When you set up a failover policy in Route 53, Azure Traffic Manager, or Google Cloud DNS, you configure health checks that hit your on-premises servers. Those health checks are DNS queries — but they also generate either HTTP or TCP probes to verify the endpoint is alive. Historically, those probes were included in the base DNS price. Not anymore. Luna: So what changed? Did they announce it? Lucas: AWS updated their Route 53 pricing page in March 2025. Azure followed in June. GCP had been charging for it since late 2024 but only made it explicit in their cost management console earlier this year. The logic, they say, is that cloud-to-on-prem traffic uses cross-region or cross-network infrastructure that costs them real money. Luna: And that Midwest Fin case — $4,700 for one month. How many health checks is that? Lucas: They were running 120 health checks per minute — two per second — hitting 15 on-prem endpoints across three regions. Each check generates a DNS query and a small data probe. At AWS's new rate of about thirty-three cents per 10,000 DNS queries plus egress charges, it adds up fast. Their annualized cost: roughly fifty-six thousand dollars. Luna: That's real money. And the worst part is, they weren't even using those results for production traffic — just testing. Lucas: That's the key insight. Failover testing is often done on a cadence that's way more aggressive than what production needs. Every hour feels safe. But at cloud scale, every hour becomes a billing event. Luna: So what's the alternative? Do you stop testing? Lucas: You don't stop testing. You optimize the test frequency and the test methodology. First, consolidate your health checks. If you have five endpoints that always return the same status, you can test one of them and assume the rest are healthy. Second, use synthetic monitoring tools like AWS CloudWatch Synthetics or Azure Monitor that can run fewer, smarter probes. Luna: And third? You negotiate. These aren't published rates. Lucas: Right. Third, negotiate a flat-rate failover clause in your enterprise agreement. Some of the large cloud providers are willing to cap the DNS health check charges if you commit to a certain volume of compute or storage. Midwest Fin ended up signing a three-year compute commitment and got the failover testing charges waived entirely. Luna: So the billing change is real, but it's also a negotiation lever. That's actually useful — if you know about it. Lucas: And that's the whole reason we're talking about it. Most cloud architects don't look at their DNS line item. They look at compute, storage, egress. But these nickel and dime line items — health checks, API calls, DNS queries — they're the ones that balloon without anyone noticing. Luna: I've seen a similar thing with secret rotation fees. A team rotated secrets every hour during development and racked up thirty thousand dollars in a quarter before anyone caught it. Lucas: Exactly the same pattern. And that's why episodes like this exist — to surface the stuff that doesn't make the headlines but hits your budget. Honestly, if these conversations are useful for what you're building or running, a couple of dollars a month is genuinely what keeps these going — buy me a coffee dot com slash fexingo, if you've gotten something out of them. Luna: Yeah, it's a small thing that makes a big difference for keeping the show ad-free and focused on exactly this kind of detail. Lucas: So back to failover testing: the other strategy is to use a third-party provider for health checks. Companies like Checkly or Pingdom can run external probes that don't count as cloud-to-on-prem traffic. You pay them a flat monthly fee, often less than what the cloud provider would charge. Luna: But doesn't that add latency or a single point of failure? Lucas: It can, if you route everything through one provider. But you can run probes from multiple regions, and many third-party tools support multi-region testing natively. The trade-off is cost versus complexity. For a small team, it's simpler to just reduce your health check frequency and accept a slightly longer detection window. Luna: What's the recommended cadence then? Lucas: For most enterprises, every five minutes is sufficient for production failover detection. For testing, once per hour is plenty — but you don't need to run all your tests every hour. Rotate which endpoints you test. Midwest Fin reduced their testing to every four hours and rotated the endpoint set, cutting their bill from $4,700 to about $400 per month. Luna: That's a ninety percent reduction. Just from changing the schedule. Lucas: And they didn't lose any reliability because they still had production health checks running every five minutes. The test-specific checks were redundant coverage. So the lesson is: separate your monitoring from your testing. Monitoring needs to be frequent. Testing can be sparse. Luna: I think the bigger takeaway is that cloud billing is becoming more granular across the board. We're past the era of 'everything is included.' Now it's 'everything is metered.' Lucas: Absolutely. And that means cloud architects need to be as fluent in pricing as they are in architecture. The days of 'just spin it up and we'll figure out the cost later' are over — if they ever existed. Luna: So for someone listening who's managing a hybrid cloud environment, what's the one thing they should do this week? Lucas: Open your cloud billing console, filter by 'DNS' or 'Route 53' or 'Traffic Manager,' and look for any line item with 'health check' or 'failover' in the name. If you see charges, check the frequency of your tests. If you don't see charges, check again in a month — because the pricing changes are rolling out gradually. Luna: And if you find a surprise charge, at least now you know what to do. Lucas: Exactly. Consolidate, negotiate, or outsource. Those are your three levers. Luna: Alright, I think that's a solid playbook. Thanks, Lucas. Lucas: Thanks, Luna. And thanks to everyone listening — keep your cloud bills lean.