The signed NS records have a TTL of less than an hour.

TTL_NS_SHORT · Severity: Info

• InfoTTL_NS_SHORT

  The signed NS records have a TTL of less than an hour.

  The TTL comes from the DNSSEC signature, so it is the value set in the zone. Name server records rarely change, and a short TTL makes resolvers fetch the delegation again and again (RFC 1912 section 2.2 suggests stable values). The parent zone's copy of the NS records has its own TTL.

  Recommendation: Use an NS TTL of several hours or a day, unless a move is planned.

Reported by

• DNS TTL check

Available through the API

• DNS TTL check API

Related findings

• Info TTL_LONG A record set has a TTL of more than a week.
• Info TTL_SHORT A signed record set has a TTL of less than a minute.

All findings