On 02/09/2018 05:26 PM, @lbutlr wrote:
But to answer your question, off-hand, I'd say that any TTL under 60s is suspicious and any TTL under 10s is almost certainly intentionally abusive.

I thought there was a lower recommended boundary, particularly to detect and avoid things like fast flux.

I /thought/ it was somewhere between 1 and 5 minutes.

Grant. . . .
unix || die

Attachment: smime.p7s
Description: S/MIME Cryptographic Signature

Please visit https://lists.isc.org/mailman/listinfo/bind-users to unsubscribe 
from this list

bind-users mailing list

Reply via email to