The way DNS works, resolvers cache query results per TTL defined in the response. Consider an authoritative DNS server that is compromised, its main
A record set to a different IP and TTL of that record set to something very high (like a month).
Is there any mechanism/process which would invalidate the cache of all those resolvers that cached the malicious record before the TTL expiry? Because without one, the website could be down for a month for some users regardless of how quickly the DNS record is reverted by the admins.
Also note that the attacker could access the target website from various locations around the world right after the attack in order to poison the cache of their respective resolvers.