TTL set too low overloads authoritative nameservers

dig +noall +answer example.com A
dig +noall +answer example.com CNAME

# a record in trouble looks like this, TTL under 120 seconds
# with no migration in progress:
# example.com.        60      IN      A       203.0.113.10

dig +short NS example.com
dig @ns1.example-dns.com example.com A +noall +answer

# good confirmation: the authoritative answer shows the same low TTL,
# meaning it really is configured that way, not just a stale cache

# pull DNS analytics from your provider, for example Cloudflare:
curl -s -H "Authorization: Bearer $CLOUDFLARE_API_TOKEN" \
  "https://api.cloudflare.com/client/v4/zones/$CLOUDFLARE_ZONE_ID/analytics/dashboard"

# rough math: estimated_qps = unique_resolvers_per_day / ttl_seconds / 86400
# example: 500000 unique resolvers/day at TTL=60 is roughly 0.096 qps per
# resolver-cache-cycle, but the real authoritative load scales with how
# many separate resolvers hold a cache entry, so a TTL drop from 3600 to
# 60 is still about a 60x multiplier on the query count either way

dig +trace example.com

# good result if no migration is active: the chain resolves cleanly and
# nobody on the team can point to a reason the TTL still needs to be short

; before: left over from a migration months ago
example.com. 60 IN A 203.0.113.10

; after: normal production traffic, one hour
example.com. 3600 IN A 203.0.113.10

; or, if you need faster failover on this record specifically
example.com. 300 IN A 203.0.113.10

; records that rarely change, like NS or MX, can go up to a full day
example.com. 86400 IN NS ns1.example-dns.com.

curl -s -X PATCH \
  -H "Authorization: Bearer $CLOUDFLARE_API_TOKEN" \
  -H "Content-Type: application/json" \
  "https://api.cloudflare.com/client/v4/zones/$CLOUDFLARE_ZONE_ID/dns_records/$RECORD_ID" \
  -d '{"ttl": 3600}'

# note: use "ttl": 1 only intentionally, to mean "Auto" on a proxied
# record, never as a stand-in for a real short value

dig +noall +answer example.com A
# good result: TTL column now shows 3600 (or your chosen value)
# instead of 60

dig @ns1.example-dns.com example.com A +noall +answer
# confirms the authoritative source itself now serves the new TTL

dig @8.8.8.8 example.com A +noall +answer
dig @1.1.1.1 example.com A +noall +answer
# good result: both public resolvers agree on the new, longer TTL once
# their old cached copies expire

# then watch the Cloudflare Analytics API, or your authoritative query
# logs, over the next cache cycle for a drop in queries per second on
# this record, roughly proportional to the TTL increase

"""Detect a TTL that is too low for a record's real traffic and, on
repair, raise it back to a safe value through the Cloudflare API.
Safe to run on a schedule. Stays in dry run until DRY_RUN=false.
"""
import os
import logging

logging.basicConfig(level=logging.INFO, format="%(asctime)s %(levelname)s %(message)s")
log = logging.getLogger("ttl_too_low")

TTL_LADDER = (60, 120, 300, 900, 3600, 86400)


def assess_ttl_risk(ttl_seconds, daily_unique_resolvers, qps_risk_threshold=5.0, min_safe_ttl=300):
    """Pure decision function. No DNS I/O, no network calls.

    ttl_seconds: the record's current TTL, in seconds, as read from a
        live answer (dnspython) or the provider API.
    daily_unique_resolvers: a known or estimated count of unique
        resolvers/clients hitting the domain per day.
    qps_risk_threshold: flag the record once estimated authoritative
        queries per second crosses this value.
    min_safe_ttl: flag the record if its TTL is below this floor,
        regardless of estimated QPS (a 30 second TTL is a red flag
        even on a quiet domain).

    Returns {"risky": bool, "estimated_qps": float, "recommended_ttl": int}.
    """
    safe_ttl = max(ttl_seconds, 1)
    estimated_qps = daily_unique_resolvers / safe_ttl

    risky = estimated_qps > qps_risk_threshold or ttl_seconds < min_safe_ttl

    recommended_ttl = safe_ttl
    for candidate in TTL_LADDER:
        if daily_unique_resolvers / candidate <= qps_risk_threshold and candidate >= min_safe_ttl:
            recommended_ttl = candidate
            break
    else:
        recommended_ttl = TTL_LADDER[-1]

    return {
        "risky": risky,
        "estimated_qps": estimated_qps,
        "recommended_ttl": recommended_ttl,
    }


def run():
    # Imported lazily so the pure function above can be tested with no
    # network libraries installed at all.
    import dns.resolver
    import requests

    domain = os.environ["DNS_DOMAIN"]
    zone_id = os.environ["CLOUDFLARE_ZONE_ID"]
    api_token = os.environ["CLOUDFLARE_API_TOKEN"]
    daily_unique_resolvers = int(os.environ.get("DAILY_UNIQUE_RESOLVERS", "50000"))
    dry_run = os.environ.get("DRY_RUN", "true").lower() == "true"
    headers = {"Authorization": f"Bearer {api_token}", "Content-Type": "application/json"}

    resolver = dns.resolver.Resolver()
    answer = resolver.resolve(domain, "A")
    current_ttl = answer.rrset.ttl
    log.info("Live TTL for %s A record: %d seconds", domain, current_ttl)

    result = assess_ttl_risk(current_ttl, daily_unique_resolvers)
    log.info(
        "Estimated QPS: %.4f, risky: %s, recommended TTL: %d",
        result["estimated_qps"], result["risky"], result["recommended_ttl"],
    )

    if not result["risky"]:
        log.info("No fix needed. TTL is within a safe range for this traffic level.")
        return

    if dry_run:
        log.info(
            "Dry run: would raise TTL for %s from %d to %d seconds",
            domain, current_ttl, result["recommended_ttl"],
        )
        return

    list_resp = requests.get(
        f"https://api.cloudflare.com/client/v4/zones/{zone_id}/dns_records",
        headers=headers,
        params={"type": "A", "name": domain},
        timeout=30,
    )
    list_resp.raise_for_status()
    records = list_resp.json().get("result", [])
    record_id = next((r["id"] for r in records), None)
    if record_id is None:
        log.warning("No existing A record id found to update at %s", domain)
        return

    patch_resp = requests.patch(
        f"https://api.cloudflare.com/client/v4/zones/{zone_id}/dns_records/{record_id}",
        headers=headers,
        json={"ttl": result["recommended_ttl"]},
        timeout=30,
    )
    patch_resp.raise_for_status()
    log.info("Raised TTL for %s to %d seconds", domain, result["recommended_ttl"])


if __name__ == "__main__":
    run()

/**
 * Detect a TTL that is too low for a record's real traffic and, on
 * repair, raise it back to a safe value through the Cloudflare API.
 * Safe to run on a schedule. Stays in dry run until DRY_RUN=false.
 */
import { pathToFileURL } from "node:url";

const TTL_LADDER = [60, 120, 300, 900, 3600, 86400];

export function assessTtlRisk(ttlSeconds, dailyUniqueResolvers, qpsRiskThreshold = 5.0, minSafeTtl = 300) {
  // Pure decision function. No DNS I/O, no network calls.
  //
  // ttlSeconds: the record's current TTL, in seconds, as read from a
  //   live answer (node:dns) or the provider API.
  // dailyUniqueResolvers: a known or estimated count of unique
  //   resolvers/clients hitting the domain per day.
  // qpsRiskThreshold: flag the record once estimated authoritative
  //   queries per second crosses this value.
  // minSafeTtl: flag the record if its TTL is below this floor,
  //   regardless of estimated QPS.
  //
  // Returns { risky, estimatedQps, recommendedTtl }.
  const safeTtl = Math.max(ttlSeconds, 1);
  const estimatedQps = dailyUniqueResolvers / safeTtl;

  const risky = estimatedQps > qpsRiskThreshold || ttlSeconds < minSafeTtl;

  let recommendedTtl = TTL_LADDER[TTL_LADDER.length - 1];
  for (const candidate of TTL_LADDER) {
    if (dailyUniqueResolvers / candidate <= qpsRiskThreshold && candidate >= minSafeTtl) {
      recommendedTtl = candidate;
      break;
    }
  }

  return { risky, estimatedQps, recommendedTtl };
}

export async function run() {
  // Imported lazily so the pure function above can be tested with no
  // network modules touched at all.
  const dns = await import("node:dns");
  const resolvePromises = dns.promises;

  const domain = process.env.DNS_DOMAIN;
  const zoneId = process.env.CLOUDFLARE_ZONE_ID;
  const apiToken = process.env.CLOUDFLARE_API_TOKEN;
  const dailyUniqueResolvers = Number(process.env.DAILY_UNIQUE_RESOLVERS || 50000);
  const dryRun = (process.env.DRY_RUN || "true").toLowerCase() === "true";
  const headers = { Authorization: `Bearer ${apiToken}`, "Content-Type": "application/json" };

  const records = await resolvePromises.resolve4(domain, { ttl: true });
  const currentTtl = records[0].ttl;
  console.log(`Live TTL for ${domain} A record: ${currentTtl} seconds`);

  const result = assessTtlRisk(currentTtl, dailyUniqueResolvers);
  console.log(
    `Estimated QPS: ${result.estimatedQps.toFixed(4)}, risky: ${result.risky}, recommended TTL: ${result.recommendedTtl}`
  );

  if (!result.risky) {
    console.log("No fix needed. TTL is within a safe range for this traffic level.");
    return;
  }

  if (dryRun) {
    console.log(`Dry run: would raise TTL for ${domain} from ${currentTtl} to ${result.recommendedTtl} seconds`);
    return;
  }

  const listRes = await fetch(
    `https://api.cloudflare.com/client/v4/zones/${zoneId}/dns_records?type=A&name=${encodeURIComponent(domain)}`,
    { headers }
  );
  if (!listRes.ok) throw new Error(`Cloudflare API list returned ${listRes.status}`);
  const listBody = await listRes.json();
  const record = (listBody.result || [])[0];
  if (!record) {
    console.warn(`No existing A record id found to update at ${domain}`);
    return;
  }

  const patchRes = await fetch(
    `https://api.cloudflare.com/client/v4/zones/${zoneId}/dns_records/${record.id}`,
    {
      method: "PATCH",
      headers,
      body: JSON.stringify({ ttl: result.recommendedTtl }),
    }
  );
  if (!patchRes.ok) throw new Error(`Cloudflare API patch returned ${patchRes.status}`);
  console.log(`Raised TTL for ${domain} to ${result.recommendedTtl} seconds`);
}

if (process.argv[1] && import.meta.url === pathToFileURL(process.argv[1]).href) {
  run().catch((err) => { console.error(err); process.exit(1); });
}

from ttl_too_low import assess_ttl_risk


def test_low_ttl_high_traffic_is_risky():
    result = assess_ttl_risk(60, daily_unique_resolvers=500000)
    assert result["risky"] is True
    assert result["estimated_qps"] > 5.0


def test_normal_ttl_low_traffic_is_not_risky():
    result = assess_ttl_risk(3600, daily_unique_resolvers=1000)
    assert result["risky"] is False


def test_ttl_below_min_safe_is_risky_even_with_low_traffic():
    result = assess_ttl_risk(30, daily_unique_resolvers=100)
    assert result["risky"] is True


def test_recommended_ttl_is_from_the_ladder():
    result = assess_ttl_risk(60, daily_unique_resolvers=500000)
    assert result["recommended_ttl"] in (60, 120, 300, 900, 3600, 86400)


def test_recommended_ttl_brings_qps_under_threshold():
    result = assess_ttl_risk(60, daily_unique_resolvers=100000, qps_risk_threshold=5.0)
    assert 100000 / result["recommended_ttl"] <= 5.0


def test_zero_ttl_does_not_divide_by_zero():
    result = assess_ttl_risk(0, daily_unique_resolvers=1000)
    assert result["estimated_qps"] == 1000.0
    assert result["risky"] is True

import { test } from "node:test";
import assert from "node:assert/strict";
import { assessTtlRisk } from "./ttl-too-low.js";

test("low TTL with high traffic is risky", () => {
  const result = assessTtlRisk(60, 500000);
  assert.equal(result.risky, true);
  assert.ok(result.estimatedQps > 5.0);
});

test("normal TTL with low traffic is not risky", () => {
  const result = assessTtlRisk(3600, 1000);
  assert.equal(result.risky, false);
});

test("TTL below min safe is risky even with low traffic", () => {
  const result = assessTtlRisk(30, 100);
  assert.equal(result.risky, true);
});

test("recommended TTL comes from the ladder", () => {
  const result = assessTtlRisk(60, 500000);
  assert.ok([60, 120, 300, 900, 3600, 86400].includes(result.recommendedTtl));
});

test("recommended TTL brings QPS under the threshold", () => {
  const result = assessTtlRisk(60, 100000, 5.0);
  assert.ok(100000 / result.recommendedTtl <= 5.0);
});

test("zero TTL does not divide by zero", () => {
  const result = assessTtlRisk(0, 1000);
  assert.equal(result.estimatedQps, 1000);
  assert.equal(result.risky, true);
});