This is very inconvenient but can't be helped.
A realistic (as far as my knowledge goes) solution could be this:
If the auth servers are down, have a backup auth server with a dynamic IP address take over, the HB/GB clients will receive this dynamic IP address only when the main servers are down.
Because the IP is dynamic you'll need a way to distribute the temporary address to the clients, also it will be harder to DDoS this backup server since it will get a new IP every time (I dunno how fast a dynamic IP can change, but if every 2-4 hours is possible it seems like a solid defence)
I hope something like this could be possible, if it doesn't make any sense at all please tell me I'd love to know why since I'm interested in stuff like this