In an active/passive GSLB design, how do you ensure clients receive the primary site's IP and only get the secondary when the primary is down?

1. Bind both sites with equal weight and round robin
2. Disable ADNS on the primary
3. Configure a backup GSLB vServer (or weighted/primary-with-backup design) so the secondary site IP is handed out only on primary failure
4. Use SSL bridging between sites