Pair with SVCB, ECH, and TLS p95, split-horizon GeoDNS latency, and SCP and SFTP RTT matrices. Public pages: help, home, pricing.
1) ECS can map the resolver instead of the engineer. 2) One aggressive TTL poisons every cache row during cutover. 3) Artifact p95 spikes often mean wrong-city answers, not slow disks.
| Probe mode | ECS on | ECS off |
|---|---|---|
| GeoDNS accuracy | Authority sees client prefix when policy allows | Answers follow resolver anycast; larger roaming deltas |
| Drift vs traceroute | Lower median gap when VPN hairpins are documented | Higher tail mismatch; watch JP and US West public resolvers |
| Privacy | Subnet reaches authority; shorten prefix under GDPR | Less telemetry; add synthetic probes per PoP |
Treat each mismatch as routing until proven otherwise. Log answers, TTL remaining, and resolver ID beside SSH latency so KR and SG diffs stay in one warehouse.
Resolver drift: Geo answers versus traceroute
GeoDNS keys off the wire source. ECS replaces that with the client subnet option. Without it, the source is the recursive. Corporate VPNs add a third story. Run paired probes per office profile and label outer resolver, inner tunnel, and target vpshalo region.
TTL layering: apex, control plane, artifacts
Keep interactive SSH names on short TTL. Use longer TTL on artifact hosts only after poisoning tests pass. Split apex, health CNAMEs, and HTTPS bindings per the SVCB checklist.
Decision matrix: ECS hints versus static probes
Score with security, networking, and release engineering before changing resolver contracts.
| Workload | Prefer ECS on | Prefer ECS off plus probes |
|---|---|---|
| Roaming split-tunnel VPN | Yes with redacted logs and short prefix masks | Yes when subnet disclosure is blocked; use vantage agents |
| CI on fixed SG NAT | Optional when anycast already matches city | Default off if one resolver cluster serves all runners |
| Artifact backhaul to HK | Yes for per-office steering inside one country | Yes when answers should follow CDN only; pair with RTT matrix |
# Resolver with ECS hint (replace prefix with your office lab net)
dig @203.0.113.53 ssh.builder.internal A +subnet=198.51.100.0/24 +norecurse +noall +answer
# Same question without ECS emulation (no client subnet option)
dig @203.0.113.53 ssh.builder.internal A +norecurse +noall +answer
# Trace delegation while you iterate TTL decay after a cutover
dig @203.0.113.53 ssh.builder.internal A +subnet=198.51.100.128/27 +trace +noall +answerRegional artifact p95 gates
Five-minute rolling windows after caches warm. Widen sampling only with a filed exception.
| PoP | City drift bar | One GB artifact p95 | TTL residual alarm |
|---|---|---|---|
| JP | Ninety-five percent probes match traceroute city | Under nine minutes unless object storage is explicit | Residual TTL over policy by thirty seconds |
| KR | Same bar; watch resolvers anycast outside peninsula | Match JP unless fiber proves faster | Same thirty second skew rule |
| HK | Allow SG only when ECS proves intent | Eight percent tighter than JP when cables share borders | Stricter skew during submarine maintenance seasons |
| SG | Log resolver ASN because ECS variance is higher | Default JP ceiling unless throughput proves higher | Dual resolver policies differ by at most one TTL step |
| US West | Watch Colorado versus Oregon resolver swaps | Slightly looser than HK when Pacific paths win | Match JP alarm but allow longer health CNAME chains |
Six rollout steps
- 1 Inventory resolvers; tag ECS capable versus stripping paths per VPN.
- 2 Save paired dig outputs with and without subnet, join to traceroute cities.
- 3 Publish TTL bands: short for SSH, medium for health, long only for proven artifact names.
- 4 Replay one gigabyte fixtures from every region through the production DNS path.
- 5 Plot ECS delta versus artifact p95 on one dashboard line.
- 6 Sign with security and networking; attach evidence to help tickets for auditors.
FAQ: ECS and cache collisions
Privacy: Redact subnets before logs leave the zone; use country-level prefix when possible. Caches: Mixed ECS and non-ECS resolvers on one anycast IP can collide—split names or partition resolvers until charts stay clean.
Cite in reviews: Ninety-five percent city match before MSS work. Thirty seconds residual TTL skew triggers rollback. One gigabyte stays the minimum fixture.
Green rows mean you can align checkout with probes via purchase and Tokyo, Seoul, Hong Kong, Singapore, or US West.
Lock the PoP that cleared your ECS and artifact matrix
Start from purchase for the Mac mini M4 monthly bundle aligned to the regions in this checklist. Use help for SSH and console onboarding, home for product positioning, and pricing when finance needs list rates.
Regional carts: Tokyo, Seoul, Hong Kong, Singapore, US West. Continue the Halo ingress series on the blog index.