DNS TTL check
Asks the public resolvers for seven record types and shows each TTL with its source: the Original TTL of a validated DNSSEC signature (the value set in the zone) or the time the resolver may still cache the record (normally a lower bound). Reports TTLs over a week, and short TTLs only when they are exact. The zone's name servers are not asked.
Updated 2026-10-28
What this tool checks
A, AAAA, MX, NS, TXT, CAA and SOA are asked through public resolvers, one query each:
- TTL and source: the exact TTL from a validated DNSSEC signature, or the resolver's remaining cache time as a lower bound in the normal case.
- Long and short TTLs: over a week for any row; under a minute, or under an hour for NS, only when exact.
- Negative caching: the SOA minimum against RFC 2308 (
SOA_NEGATIVE_TTL_LONG).
How to read the result
Each row shows the record type, the TTL and where it comes from. A note explains the cache rows when there are any.
Limitations
- For a zone without DNSSEC the configured TTL cannot be seen through a public resolver; that needs the zone's own name servers, which are not asked.
- The parent zone's copy of the NS records has its own TTL, which is not shown.
Use it from code
API reference for DNS TTL check
curl -i "https://api.lookproof.dev/v1/dns/ttl?domain=example.com"A request without payment is answered with 402 Payment Required and the exact price. See the API reference.
Limits
| Input | Domain |
|---|---|
| Deadline | 10 seconds |
| Freshness | Up to 5 minutes, never longer than the record TTL |
| Price | $0.01 per check |
Findings this tool can report
Ttl (3)
- Info
TTL_LONGA record set has a TTL of more than a week. - Info
TTL_NS_SHORTThe signed NS records have a TTL of less than an hour. - Info
TTL_SHORTA signed record set has a TTL of less than a minute.
Check (1)
- Warning
CHECK_QUERY_BUDGET_EXCEEDEDThe check stopped after reaching its DNS query limit.
DNS (3)
- Error
DNS_DOMAIN_NOT_FOUNDThe DNS resolver reported that the domain does not exist. - Warning
DNS_RESOLVER_FAILUREThe DNS resolver returned a server failure. - Warning
DNS_RESOLVER_TIMEOUTThe DNS resolver did not answer in time.
SOA record (1)
- Info
SOA_NEGATIVE_TTL_LONGThe SOA minimum (negative caching TTL) is longer than three hours.
Frequently asked questions
Why is the TTL different from what I set?
A public resolver answers from its cache and reports the time left before it asks again, not the TTL in your zone. Such rows are marked cache: the TTL you set is normally at least that long (some resolvers raise very low TTLs or serve stale answers).
When is the TTL exact?
When the zone is signed with DNSSEC and the resolver validated the answer. Each signature (RRSIG) carries the Original TTL of the records it covers, protected by the signature, so the tool shows that value and marks the row rrsig.
Which TTLs are too short or too long?
Over a week is reported for both kinds of row (TTL_LONG). Under a minute, or under an hour for NS, is reported only for exact rows (TTL_SHORT, TTL_NS_SHORT), because a low cache time may just be an entry about to expire.
What is the SOA minimum?
The last SOA field: how long resolvers remember that a name or type does not exist (negative caching, RFC 2308). It is data in the record, not a cache time, so it is always exact.