1

I've heard before that one should set TTL for the domains of recovery emails to as high value as possible. The threat model here is that an attacker uses social engineering tactics to gain access to the DNS hosting account to the maliciously change the records to their own servers. In this case, you have longer to remedy the problem

I am also considering a second threat model: if the attacker gains control of the email server and I cannot easily gain back access for whatever reason, I am unable to quickly change the TTL to point to a different server.

Is either of these concerns valid? I know some DNS caches seem to simply ignore TTL, and it is also unreliable since some caches may happen to query for an update just after the hack even if the TTL is set for multiple days.

What should I set my TTL to for the most secure DNS?

Improve this question
1
  • Most major sites have the TTL set low - 60s or so. This gives flexibility in case you urgently need to change IP address
    – paj28
    Feb 6, 2016 at 20:14

1 Answer 1

Reset to default
4

What should I set my TTL to for the most secure DNS?

As you already state in your question: a high TTL conflicts with a possible insecure mail server and a low TTL conflicts with a possible insecure DNS server. Since the security of DNS and mail server depends in the actual setup there can be no general "most secure" TTL setting. Instead you have to evaluate the specific risks of your setup to find out the most secure value for your setup.

Improve this answer
2
  • Have there been any surveys of the Internet collecting TTL data?
    – Deer Hunter
    Feb 6, 2016 at 18:06
  • 1
    @DeerHunter: some checks with ` dig +nocmd +multiline +noall +answer any domain` show a broad range of values for the large mail domains like gmail.com, live.com etc. So there is no "typical value".
    – Steffen Ullrich
    Feb 6, 2016 at 18:33

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .