{
    "api_version": "1",
    "kind": "dse_post",
    "self": "https://update.dsesecurity.com/api/v1/posts/separate-cloudflare-record-ttl-from-nameserver-delegation-ttl-during-a-dns-change/",
    "item": {
        "id": "https://update.dsesecurity.com/updates/separate-cloudflare-record-ttl-from-nameserver-delegation-ttl-during-a-dns-change/",
        "slug": "separate-cloudflare-record-ttl-from-nameserver-delegation-ttl-during-a-dns-change",
        "url": "https://update.dsesecurity.com/updates/separate-cloudflare-record-ttl-from-nameserver-delegation-ttl-during-a-dns-change/",
        "alternate_urls": {
            "markdown": "https://update.dsesecurity.com/updates/separate-cloudflare-record-ttl-from-nameserver-delegation-ttl-during-a-dns-change.md",
            "json": "https://update.dsesecurity.com/api/v1/posts/separate-cloudflare-record-ttl-from-nameserver-delegation-ttl-during-a-dns-change/"
        },
        "title": "Separate Cloudflare record TTL from nameserver delegation TTL during a DNS change",
        "summary": "Changing one caching interval does not necessarily shorten every layer of the lookup path.",
        "format": {
            "slug": "guide",
            "name": "Guide"
        },
        "priority": {
            "slug": "info",
            "name": "Information"
        },
        "featured": false,
        "image": {
            "theme": "network-infrastructure",
            "label": "Networks & infrastructure",
            "alt": "Resilient network core with engineered blue and gold data paths.",
            "card_url": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-card.webp?v=1.8.20",
            "hero_url": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-hero.webp?v=1.8.20",
            "social_url": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-social-v2.jpg?v=1.8.20",
            "width": 2400,
            "height": 1350
        },
        "topics": [
            {
                "slug": "cybersecurity",
                "name": "Cybersecurity",
                "url": "https://update.dsesecurity.com/topic/cybersecurity/"
            },
            {
                "slug": "networks-infrastructure",
                "name": "Networks & Infrastructure",
                "url": "https://update.dsesecurity.com/topic/networks-infrastructure/"
            }
        ],
        "author": {
            "name": "DSE Security Editorial Team",
            "url": "https://update.dsesecurity.com/#editorial-team",
            "type": "Organization"
        },
        "publisher": {
            "name": "Detection Systems & Engineering",
            "url": "https://dsesecurity.com/"
        },
        "published_at": "2026-10-20T18:16:53+00:00",
        "modified_at": "2026-10-20T18:34:36+00:00",
        "reviewed_on": "2026-10-20",
        "reading_minutes": 2,
        "word_count": 254,
        "potentially_affected": "This concerns Cloudflare TTL controls and caching boundaries.",
        "dse_recommendation": "DSE recommends documenting whether the change affects an address, proxy status, or delegation before planning the window.",
        "primary_source": {
            "name": "Cloudflare — Time to Live (TTL)",
            "url": "https://developers.cloudflare.com/dns/manage-dns-records/reference/ttl/",
            "published_on": null,
            "authority": "developers.cloudflare.com"
        },
        "publishing_principles": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/",
        "usage_info": "https://update.dsesecurity.com/usage/",
        "copyright_notice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.",
        "content_html": "<p>Changing one caching interval does not necessarily shorten every layer of the lookup path.</p>\n<h2>Source facts</h2>\n<p>Cloudflare distinguishes ordinary DNS record TTL from nameserver TTL. Proxied records use the service&#8217;s fixed Auto TTL, while DNS-only records allow a configurable range that depends on plan. The guide notes local caching can make observed changes take longer than the advertised proxied TTL and that nameserver TTL is a separate feature.</p>\n<p>Source: <a href=\"https://developers.cloudflare.com/dns/manage-dns-records/reference/ttl/\">Cloudflare — Time to Live (TTL)</a>.</p>\n<h2>Applicability</h2>\n<p>This concerns Cloudflare TTL controls and caching boundaries.</p>\n<h2>DSE recommendation</h2>\n<p>DSE recommends documenting whether the change affects an address, proxy status, or delegation before planning the window. Capture the current authoritative TTL and allow existing cached answers to age out when reducing a value. Keep old and new endpoints viable for the expected transition where possible. Avoid repeatedly changing the record because one client still shows an older result; first identify which resolver or local cache supplied it. Write the transition plan as separate address-record and delegation observations, with the queried authority shown for each. Ask the operator to retain one old-answer sample before cutover. Keep overlap availability decisions tied to the service requirement rather than a promised universal propagation deadline.</p>\n<h2>Verification</h2>\n<p>Compare authoritative answers with selected recursive and local resolver observations, recording TTLs and timestamps. Check delegation data separately when nameservers changed. Confirm the application works through both expected transition paths, and report actual observations rather than promising that every user will switch at the exact configured TTL boundary.</p>\n<h2>Official reference</h2>\n<p><a href=\"https://developers.cloudflare.com/dns/manage-dns-records/reference/ttl/\">Cloudflare — Time to Live (TTL)</a>. Reviewed October 20, 2026.</p>",
        "content_text": "Changing one caching interval does not necessarily shorten every layer of the lookup path.\nSource facts\nCloudflare distinguishes ordinary DNS record TTL from nameserver TTL. Proxied records use the service’s fixed Auto TTL, while DNS-only records allow a configurable range that depends on plan. The guide notes local caching can make observed changes take longer than the advertised proxied TTL and that nameserver TTL is a separate feature.\nSource: Cloudflare — Time to Live (TTL).\nApplicability\nThis concerns Cloudflare TTL controls and caching boundaries.\nDSE recommendation\nDSE recommends documenting whether the change affects an address, proxy status, or delegation before planning the window. Capture the current authoritative TTL and allow existing cached answers to age out when reducing a value. Keep old and new endpoints viable for the expected transition where possible. Avoid repeatedly changing the record because one client still shows an older result; first identify which resolver or local cache supplied it. Write the transition plan as separate address-record and delegation observations, with the queried authority shown for each. Ask the operator to retain one old-answer sample before cutover. Keep overlap availability decisions tied to the service requirement rather than a promised universal propagation deadline.\nVerification\nCompare authoritative answers with selected recursive and local resolver observations, recording TTLs and timestamps. Check delegation data separately when nameservers changed. Confirm the application works through both expected transition paths, and report actual observations rather than promising that every user will switch at the exact configured TTL boundary.\nOfficial reference\nCloudflare — Time to Live (TTL). Reviewed October 20, 2026.",
        "content_markdown": "Changing one caching interval does not necessarily shorten every layer of the lookup path.\n\n## Source facts\n\nCloudflare distinguishes ordinary DNS record TTL from nameserver TTL. Proxied records use the service’s fixed Auto TTL, while DNS-only records allow a configurable range that depends on plan. The guide notes local caching can make observed changes take longer than the advertised proxied TTL and that nameserver TTL is a separate feature.\n\nSource: [Cloudflare — Time to Live (TTL)](https://developers.cloudflare.com/dns/manage-dns-records/reference/ttl/).\n\n## Applicability\n\nThis concerns Cloudflare TTL controls and caching boundaries.\n\n## DSE recommendation\n\nDSE recommends documenting whether the change affects an address, proxy status, or delegation before planning the window. Capture the current authoritative TTL and allow existing cached answers to age out when reducing a value. Keep old and new endpoints viable for the expected transition where possible. Avoid repeatedly changing the record because one client still shows an older result; first identify which resolver or local cache supplied it. Write the transition plan as separate address-record and delegation observations, with the queried authority shown for each. Ask the operator to retain one old-answer sample before cutover. Keep overlap availability decisions tied to the service requirement rather than a promised universal propagation deadline.\n\n## Verification\n\nCompare authoritative answers with selected recursive and local resolver observations, recording TTLs and timestamps. Check delegation data separately when nameservers changed. Confirm the application works through both expected transition paths, and report actual observations rather than promising that every user will switch at the exact configured TTL boundary.\n\n## Official reference\n\n[Cloudflare — Time to Live (TTL)](https://developers.cloudflare.com/dns/manage-dns-records/reference/ttl/). Reviewed October 20, 2026."
    },
    "json_ld": {
        "@context": "https://schema.org",
        "@graph": [
            {
                "@type": "Organization",
                "@id": "https://dsesecurity.com/#organization",
                "name": "Detection Systems & Engineering",
                "alternateName": "DSE Security",
                "url": "https://dsesecurity.com/",
                "logo": {
                    "@type": "ImageObject",
                    "url": "https://update.dsesecurity.com/assets/dse-logo-20260812.png?v=1.8.20"
                }
            },
            {
                "@type": "Organization",
                "@id": "https://update.dsesecurity.com/#editorial-team",
                "name": "DSE Security Editorial Team",
                "url": "https://update.dsesecurity.com/",
                "parentOrganization": {
                    "@id": "https://dsesecurity.com/#organization"
                }
            },
            {
                "@type": "WebSite",
                "@id": "https://update.dsesecurity.com/#website",
                "name": "DSE Updates",
                "alternateName": "DSE Security Knowledge Hub",
                "url": "https://update.dsesecurity.com/",
                "inLanguage": "en-US",
                "publisher": {
                    "@id": "https://dsesecurity.com/#organization"
                },
                "potentialAction": {
                    "@type": "SearchAction",
                    "target": {
                        "@type": "EntryPoint",
                        "urlTemplate": "https://update.dsesecurity.com/?q={search_term_string}"
                    },
                    "query-input": "required name=search_term_string"
                }
            },
            {
                "@type": "WebPage",
                "@id": "https://update.dsesecurity.com/updates/separate-cloudflare-record-ttl-from-nameserver-delegation-ttl-during-a-dns-change/",
                "url": "https://update.dsesecurity.com/updates/separate-cloudflare-record-ttl-from-nameserver-delegation-ttl-during-a-dns-change/",
                "isPartOf": {
                    "@id": "https://update.dsesecurity.com/#website"
                },
                "lastReviewed": "2026-10-20"
            },
            {
                "@type": "BreadcrumbList",
                "@id": "https://update.dsesecurity.com/updates/separate-cloudflare-record-ttl-from-nameserver-delegation-ttl-during-a-dns-change/#breadcrumbs",
                "itemListElement": [
                    {
                        "@type": "ListItem",
                        "position": 1,
                        "name": "DSE Updates",
                        "item": "https://update.dsesecurity.com/"
                    },
                    {
                        "@type": "ListItem",
                        "position": 2,
                        "name": "Cybersecurity",
                        "item": "https://update.dsesecurity.com/topic/cybersecurity/"
                    },
                    {
                        "@type": "ListItem",
                        "position": 3,
                        "name": "Separate Cloudflare record TTL from nameserver delegation TTL during a DNS change",
                        "item": "https://update.dsesecurity.com/updates/separate-cloudflare-record-ttl-from-nameserver-delegation-ttl-during-a-dns-change/"
                    }
                ]
            },
            {
                "@type": [
                    "Article",
                    "TechArticle"
                ],
                "@id": "https://update.dsesecurity.com/updates/separate-cloudflare-record-ttl-from-nameserver-delegation-ttl-during-a-dns-change/#article",
                "identifier": "https://update.dsesecurity.com/updates/separate-cloudflare-record-ttl-from-nameserver-delegation-ttl-during-a-dns-change/",
                "url": "https://update.dsesecurity.com/updates/separate-cloudflare-record-ttl-from-nameserver-delegation-ttl-during-a-dns-change/",
                "headline": "Separate Cloudflare record TTL from nameserver delegation TTL during a DNS change",
                "description": "Changing one caching interval does not necessarily shorten every layer of the lookup path.",
                "abstract": "Changing one caching interval does not necessarily shorten every layer of the lookup path.",
                "articleBody": "Changing one caching interval does not necessarily shorten every layer of the lookup path.\nSource facts\nCloudflare distinguishes ordinary DNS record TTL from nameserver TTL. Proxied records use the service’s fixed Auto TTL, while DNS-only records allow a configurable range that depends on plan. The guide notes local caching can make observed changes take longer than the advertised proxied TTL and that nameserver TTL is a separate feature.\nSource: Cloudflare — Time to Live (TTL).\nApplicability\nThis concerns Cloudflare TTL controls and caching boundaries.\nDSE recommendation\nDSE recommends documenting whether the change affects an address, proxy status, or delegation before planning the window. Capture the current authoritative TTL and allow existing cached answers to age out when reducing a value. Keep old and new endpoints viable for the expected transition where possible. Avoid repeatedly changing the record because one client still shows an older result; first identify which resolver or local cache supplied it. Write the transition plan as separate address-record and delegation observations, with the queried authority shown for each. Ask the operator to retain one old-answer sample before cutover. Keep overlap availability decisions tied to the service requirement rather than a promised universal propagation deadline.\nVerification\nCompare authoritative answers with selected recursive and local resolver observations, recording TTLs and timestamps. Check delegation data separately when nameservers changed. Confirm the application works through both expected transition paths, and report actual observations rather than promising that every user will switch at the exact configured TTL boundary.\nOfficial reference\nCloudflare — Time to Live (TTL). Reviewed October 20, 2026.",
                "datePublished": "2026-10-20T18:16:53+00:00",
                "dateModified": "2026-10-20T18:34:36+00:00",
                "mainEntityOfPage": {
                    "@id": "https://update.dsesecurity.com/updates/separate-cloudflare-record-ttl-from-nameserver-delegation-ttl-during-a-dns-change/"
                },
                "inLanguage": "en-US",
                "isAccessibleForFree": true,
                "author": {
                    "@type": "Organization",
                    "name": "DSE Security Editorial Team",
                    "url": "https://update.dsesecurity.com/#editorial-team"
                },
                "publisher": {
                    "@id": "https://dsesecurity.com/#organization"
                },
                "image": {
                    "@type": "ImageObject",
                    "@id": "https://update.dsesecurity.com/updates/separate-cloudflare-record-ttl-from-nameserver-delegation-ttl-during-a-dns-change/#primaryimage",
                    "url": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-social-v2.jpg?v=1.8.20",
                    "contentUrl": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-social-v2.jpg?v=1.8.20",
                    "width": 1200,
                    "height": 630,
                    "caption": "Separate Cloudflare record TTL from nameserver delegation TTL during a DNS change"
                },
                "articleSection": [
                    "Cybersecurity",
                    "Networks & Infrastructure"
                ],
                "keywords": [
                    "Cybersecurity",
                    "Networks & Infrastructure",
                    "Guide",
                    "Information priority"
                ],
                "genre": "Guide",
                "about": [
                    {
                        "@type": "Thing",
                        "name": "Cybersecurity",
                        "url": "https://update.dsesecurity.com/topic/cybersecurity/"
                    },
                    {
                        "@type": "Thing",
                        "name": "Networks & Infrastructure",
                        "url": "https://update.dsesecurity.com/topic/networks-infrastructure/"
                    }
                ],
                "wordCount": 254,
                "timeRequired": "PT2M",
                "publishingPrinciples": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/",
                "usageInfo": "https://update.dsesecurity.com/usage/",
                "copyrightHolder": {
                    "@id": "https://dsesecurity.com/#organization"
                },
                "copyrightNotice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.",
                "citation": {
                    "@type": "CreativeWork",
                    "name": "Cloudflare — Time to Live (TTL)",
                    "url": "https://developers.cloudflare.com/dns/manage-dns-records/reference/ttl/"
                }
            }
        ]
    }
}