Whose Location Counts

Your GeoDNS policy sends South American users to a Sao Paulo region. Telemetry shows a sizeable group of Brazilian users being answered with the Virginia address, and they all use a large public resolver. What is going on?

Anycast overrides GeoDNS whenever both are configured, so the routing layer pulled those users to the Virginia site regardless of the DNS answer given

The authoritative server geolocates the recursive resolver's address, not the end user, so without EDNS Client Subnet the answer reflects where the resolver sits

Public resolvers strip geolocation policies from the response and fall back to whichever record the zone lists first, which in your zone is the Virginia address

The Sao Paulo record's TTL expired inside the public resolver, and resolvers serve the previously cached alternative region until a client explicitly requests a refresh