Skip to content

DNS High TTL Values

DNS High TTL Values

Description

High TTL values in DNS records refer to DNS configurations where the Time-to-Live (TTL) is set to an extended duration. TTL defines how long a DNS resolver should cache a record before checking back with the authoritative DNS server. While long TTL values can reduce DNS traffic and improve performance, they may introduce operational risks, especially in scenarios requiring rapid DNS updates, such as server migrations, IP address changes, or during DDoS mitigation efforts.

Impact: Having a high TTL value means that changes to DNS records, such as IP address updates, will take longer to propagate across the internet. This can lead to clients or users being directed to outdated or incorrect IP addresses during the TTL period. Furthermore, in the event of a distributed denial-of-service (DDoS) attack or other security incidents, it may be more difficult to quickly reroute traffic, increasing exposure to attacks.

Recommendation

To mitigate the risk associated with High TTL values, consider the following recommendations:

  • Use Moderately Short TTL Values: Set TTL values to a moderate length (e.g., 300 to 3600 seconds) for critical DNS records like web servers, load balancers, or email servers, to balance performance and flexibility.
  • Regularly Monitor DNS Records: Periodically audit TTL values across your DNS records to ensure they are optimized for current needs.
  • Security Measures: Ensure that your DNS servers are secured against cache poisoning and other attacks. Implement DNSSEC (DNS Security Extensions) to enhance the integrity of DNS responses.
  • Adjust TTL for Planned Changes: Before major DNS changes, lower TTL values temporarily to ensure rapid propagation of updates.

TTL Use Cases and Examples:

Use Case TTL Setting Reason
Web page content 300 seconds Frequently dynamic
API responses 60 seconds Data changes often
Load balancer records 60 seconds Machines go in/out of service
Website analytics 5 minutes Frequently updated

Standards

  • SOC2_CONTROLS:
    • CC_3_4
    • CC_4_1
    • CC_6_1
    • CC_7_2
  • CWE_TOP_25:
    • CWE_400
  • GDPR:
    • ART_32