What is TTL (Time To Live) in DNS?
Still have a question, spotted an error, or have a better explanation or a source we should cite?
You just spotted a typo in your SPF record. Great catch. But how fast will the rest of the internet know you've fixed it? That depends on TTL.
TTL (Time To Live) is a number, measured in seconds, that tells DNS resolvers how long to hold onto a cached copy of your record before going back to check for a fresher version. It's not about your record expiring. It's about how long other servers are allowed to remember the old one.
A TTL of 3600 means one hour. A resolver that looked up your SPF record two minutes ago won't check again for another 58 minutes, even if you've already pushed a fix. That's the trade-off you're working with.
Lower TTL (300-900 seconds) means changes spread faster. Resolvers check back sooner, so a fix or update reaches most of the internet in minutes. The cost is more DNS queries hitting your authoritative server. For most email senders, that's not a real concern.
Higher TTL (3600-86400 seconds) means resolvers cache your records longer, responses come from cache faster, and your authoritative server gets fewer requests. The cost is that any change you make takes longer to be seen everywhere. If you update a broken DKIM record and your TTL is 24 hours, some mail servers won't see the fix until tomorrow.
The practical playbook most DNS admins use: keep your email records (SPF, DKIM, DMARC, MX) at 3600 seconds normally. If you're planning a change, drop the TTL to 300 seconds a day or two before you make the edit. Once the change is confirmed live and propagation is complete, bring the TTL back up.
Still one thing people miss: TTL only controls how long resolvers cache the record after they've looked it up. It doesn't make DNS propagation happen faster on its own. It just means resolvers will ask for fresh data sooner once their current cache expires.
If you've just made a DNS change and you're not sure why mail is still failing, our free Email Header Analyzer can show you what authentication records the receiving server actually saw at delivery time.
Contributors
Who worked on this answer
Every name links to their profile. Every company links to their site. Real people, real accountability.
