use a DNS roundrobin with low TTLs and use monitoring to remove IPs when they go down. if you have 3 hosts in your production app's roundrobin, that makes it much less likely that they'll hit the dead server and if the TTL is 300, then it's only a few minute window anyway.