The thing about fail-over plans is that no matter how well you plan, unless you actually test them, you’re probably missing something. We ran into just this situation with our authentication services over the Thanksgiving break. We made the assumption that DNS clients were not caching the IPs of aliases. We were wrong.
At least now our plan is tested.