TTL (Time to Live)

TTL controls caching duration for DNS records and limits packet propagation in networks, balancing performance with update speed.

DNS TTL

• Specifies how long resolvers should cache a DNS record (in seconds).
• Lower TTL = faster propagation of changes, more DNS queries.
• Higher TTL = better caching performance, slower change propagation.
• Typical values: 300 (5 min) to 86400 (24 hours).

Common TTL strategies

• Before changes: Lower TTL to 300 seconds 24-48 hours in advance.
• During migration: Keep TTL low until changes verify correctly.
• Steady state: Increase TTL for frequently queried, stable records.
• High availability: Lower TTL for records that may need quick failover.

TTL for different scenarios

# Low TTL (5 min) - frequent changes expected
example.com.  300  IN  A  192.0.2.1

# Medium TTL (1 hour) - balanced approach
example.com.  3600  IN  MX  10  mail.example.com.

# High TTL (24 hours) - stable records
example.com.  86400  IN  NS  ns1.example.com.

Network/IP TTL

• Limits how many router hops a packet can traverse.
• Decremented by 1 at each router; packet discarded at 0.
• Prevents routing loops from circulating packets indefinitely.
• Used by traceroute to map network paths.

Security implications

• Long DNS TTL delays propagation of security-related changes.
• Attackers may time attacks around TTL expiration for cache poisoning.
• IP TTL manipulation used in OS fingerprinting and evasion techniques.