A Halo-style global entry is a contract: resolvers, caches, and automation must agree on which PoP you mean before SSH or your CI/CD runner spends a second on TCP. Split-horizon and GeoDNS solve different halves of that contract—TTL and cache stickiness decide how fast reality changes when you move a remote Mac fleet or repoint an artifact origin.

This note is for platform engineers who must sign off cross-region SSH and large binary pulls in the same review. It complements the broader PoP matrix in GeoDNS, SSH latency and regional acceptance (2026) by zooming in on resolver behaviour, executable record choices, and a p95 artifact pull acceptance list. Start from the English home or jump straight to a locale that matches your audience—Korean, Japanese, Simplified Chinese, Traditional Chinese (Taiwan), plus German and French landing pages—then align DNS and monitoring with the tables below.

Split-horizon vs GeoDNS decision matrix

Split-horizon DNS serves different answers inside the corporate network (or CI VPC) than on the public Internet. GeoDNS (often EDNS Client Subnet–aware) steers public clients toward a regional target based on resolver hints and policy weights. Neither replaces the other: split horizon removes ambiguity for automation; GeoDNS optimises human discovery behind a single brand hostname.

Dimension Split-horizon (internal view) GeoDNS (public view)
Primary win Deterministic CI / runner targets Low-friction global hostname for humans and laptops
TTL stance Often 300–3600 s; can be aggressive because you control resolvers Shorter during change windows (60–300 s); longer in steady state (600–1800 s)
Cache stickiness risk Sticky forwarders or transparent DNS proxies in offices ISP and public recursive caches ignoring ECS; stale continent maps
SSH handshake story Jump hosts and bastions map 1:1 to PoP IDs Handshakes follow whatever the resolver cached; validate per market
Artifact origin Easy to pin registry.internal to in-region VIPs Requires ALIAS/ANAME or apex rules; watch CDN dual-stack divergence
Failure mode Drift between internal catalog and public marketing DNS Partial steering during TTL overlap; flapping health checks

Executable DNS record types (cookbook)

Use the smallest record set that still lets you fail over without renaming hostnames. Prefer stable owner names (ssh-asia.prod.example) and CNAME indirection for services that move between clouds; keep apex zones on provider-native ALIAS/ANAME or flattened A/AAAA.

Record Typical role When to choose it
A / AAAA SSH bastions, legacy VPN, bare metal edges Lowest indirection; pair both families for dual-stack Mac builders
CNAME Service aliases to weighted targets or CDN hostnames Never at apex unless your DNS supports flattening
ALIAS / ANAME (vendor) Apex to dynamic targets (GeoDNS pools, managed gateways) Marketing root domain with changing PoP sets
SRV Discoverable SSH or internal gRPC when clients honour it Great for automation catalogs; many SSH clients still need wrappers
TXT Ownership, ACME, canary tokens Keep short; avoid stuffing operational state into TXT
NS / delegation Per-region child zones When legal or billing boundaries require separate SOA owners

TTL bands and cache stickiness probes

TTL is not “how fast DNS updates” globally—it is the upper bound on how long an answer may live in a recursive cache that respects TTL. Stickiness also comes from application pools (connection reuse), happy-eyeballs reordering, and CDNs that pin you to an edge POP. Treat TTL plus observed cache age as one metric.

Lifecycle Suggested TTL window Intent
Steady production 600–1800 s for regional A/AAAA; 300–900 s for fast-moving pools Reduce resolver chatter while allowing same-day corrections
Planned migration Pre-cut to 60–120 s for ≥ previous TTL window Guarantees most caches refresh before the cut
Emergency rollback 30–60 s only with health-checked automation Short TTL amplifies QPS—watch authoritative limits
Internal split view 300–3600 s depending on DHCP lease alignment Match campus forwarder caches; document override paths 
# Compare public vs internal answers (replace ZONE/HOST)
dig +ttlunits A ssh.example.com @8.8.8.8
dig +ttlunits A ssh.example.com @10.0.0.2    # corporate resolver example

# Trace full chain including CNAME flattening
dig +trace +ttlunits A ssh.example.com

# Measure HTTPS edge stickiness (TLS + TTFB); repeat from two ISPs
curl -sS -o /dev/null -w 'dns:%{time_namelookup} connect:%{time_connect} tls:%{time_appconnect} ttfb:%{time_starttransfer}\n' \
  https://registry.example.com/v2/
Log the effective TTL remaining (dig output) alongside your SSH and HTTP probes. If engineers in Seoul still land in Virginia after a “green” DNS change, the incident is usually cache stickiness—not BGP.

Cross-region SSH handshake probes

SSH adds key exchange and host-key verification on top of TCP. For cross-region remote Mac sessions, measure wall-clock from SYN to first remote prompt, not only ICMP. Run probes from CI subnets and developer home networks because GeoDNS may disagree between them.

  • Handshake budget: track p50 / p95 of time ssh … exit; alert when p95 grows 40 % week-over-week for a PoP pair.
  • Key path: prefer -o BatchMode=yes for automation; keep host keys stable per PoP to avoid trust flapping.
  • MTU / VPN: repeat probes inside split-tunnel VPN; clamp MSS if black-hole behaviour appears only on encrypted paths.
# Wall-clock SSH probe (read-only automation user)
for i in $(seq 1 30); do
  /usr/bin/time -p ssh -o BatchMode=yes -o ConnectTimeout=12 \
    -o StrictHostKeyChecking=accept-new user@HOST 'exit' 2>&1 | awk '/^real/{print $2}'
  sleep 1
done | sort -n | awk 'NR==1{min=$1} {sum+=$1; a[NR]=$1} END{
  print "samples:", NR, "min:", min, "max:", a[NR], "p95:", a[int(0.95*NR)] }'

# OpenSSH verbose once per change window (redact keys before attaching logs)
ssh -vvv -o BatchMode=yes user@HOST true 2>&1 | tee /tmp/ssh-trace.txt

Artifact origin pull — p95 acceptance checklist

Container layers, SwiftPM binary artifacts, and Git LFS objects stress DNS differently than SSH: many parallel HTTPS connections, range requests, and CDN redirects. Sign-off should reference end-to-end p95 from the builder NIC, not only CDN dashboards.

Check Pass criteria (staging → prod) Probe idea
DNS answers match PoP ≥ 99 % of jobs resolve to in-region targets during steady state Log getent / resolver output at job start; compare to allow list
TLS and redirect depth ≤ 2 HTTP redirects; p95 TLS setup ≤ 250 ms within region curl -w template above with -L --max-redirs
Throughput floor p95 pull time for a 500 MB fixture ≤ team baseline × 1.25 Artifact fixture job in pipeline; archive timings in observability
Range / resume Interrupted pulls resume without full re-download Inject mid-transfer kill; verify byte ranges in access logs
Failover drill After TTL window, ≥ 95 % jobs pick secondary origin without manual /etc/hosts Weighted record flip + synthetic canary region
IPv6 parity AAAA path not slower than A-only by more than 20 % p95 Force -4 / -6 in paired curl harness
Disclaimer: Figures are internal engineering targets for acceptance testing, not public SLAs. Combine these probes with flow logs and supplier-native health views. Companion piece: Halo-style global entry matrix (GeoDNS & SSH); mesh-oriented automation in OpenClaw multi-region notes.

When the matrix, TTL plan, and p95 checklist align, provision builders in the same metro as your registry mirrors so DNS changes and binary locality move together. vpshalo offers monthly remote Mac capacity across multiple regions—pick the PoP that matches both resolver policy and artifact gravity.

No account required to compare

Pick a region, then rent in a few clicks

Browse the English home, open pricing and purchase without signing in first, read help, or explore other locales (JA, KO, ZH, TW) from the same decision matrix.

Rent a Mac now View plans Help center More articles