Records are published with a very long TTL
What this check looks for
Resolvers are told to remember these records for a very long time. If you need to change or undo one, a large part of the internet will keep using the old value for hours or days.
Why it matters
A long TTL is a long recovery time. Moving a server, failing over after an incident, or withdrawing a record you published by mistake all take as long as the TTL you set before it, and there is nothing you can do to speed it up once it is cached.
When the check passes, your report says: “Record TTLs are short enough to change without a long wait”.
What it costs your score
When this check fails it removes 3 points from your DNS score, before the status, confidence and repeat multipliers are applied. DNS carries a weight of 10 in the overall score.
It shares the dns.records.ttl family ceiling of 6 points: however many findings that family produces, together they cannot remove more than that from DNS. One underlying problem showing up in several places is still one problem.
- Severity
- low
- Default confidence
- confirmed
- Status when triggered
- warn
- Deduction
- 3 points
- Family cap
- dns.records.ttl · 6
- Category
- DNS
- Module
- Dns records
- Fix owned by
- dns host
- In the ruleset since
- 2026.09
How to fix it
Lower the TTL to one hour so a future change is not locked in for days.
The TTL you publish today is the minimum time a mistake tomorrow will last.
Set the TTL on these records to 3600 seconds.
Before any planned migration, lower it to 300 seconds and wait a full old-TTL period before making the change.
Restore 3600 once the migration is complete and verified.
How to confirm it worked
dig +noall +answer A ‹domain› — check the TTL column
A named slot like ‹domain› — and the braces left in the configuration below — is filled in with your own values when this rule appears on a report.
Technical detail
These record sets publish a TTL above ‹maximum seconds› seconds: ‹record list›. Nothing is broken; the cost is entirely in how long a future change takes to take effect. Long TTLs are judged only on records an operator changes — A, AAAA, CNAME, MX, TXT and HTTPS — because registries publish NS records at two days by design and that is theirs, not yours.
Standards and references
- RFC 1035 §3.2.1 — Format § 3.2.1
Test this on your domain
Run the check that produces this finding, on its own, against any domain.
Other dns records checks
- The domain has no IPv6 address
- The domain apex is a CNAME, which the DNS does not allow
- A CAA record marked critical uses a tag no authority understands
- CAA forbids every authority from issuing a certificate
- The CAA reporting address is not a usable URL
- No CAA record says which authorities may issue certificates
- Two TXT records of the same kind are published at one name
- The domain has no A or AAAA record
- Records are published with a very short TTL
- A TXT record looks cut off at the 255-character limit
- A wildcard record answers for every subdomain