DNS TTL Decrease Alerts
Last updated: 2026-10-08
Before a domain is moved to a new server, provider, or CDN, the record’s TTL (time to live) is usually lowered so caches expire quickly and the change spreads fast. That makes a sudden TTL drop a useful early signal: something is about to change, intentionally or not.
DNS monitors now watch for this automatically and send you an informational alert when it happens. There is nothing to configure.
When an Alert Is Sent
On every successful DNS check, the monitor reads the TTL of the first answer for the record type it checks and compares it to the TTL it saw on the previous successful check.
An alert is sent only when both conditions are true:
- The TTL fell by more than half compared to the previous check, and
- The new TTL is 300 seconds (5 minutes) or less.
For example, a TTL going from 3600 s to 300 s triggers an alert. A drop from 3600 s to 1800 s does not, and neither does a record that simply has a low TTL all the time.
The first successful check only records a baseline, so a brand-new monitor never alerts on its first run. Checks that fail do not update the baseline.
What You Receive
The alert goes to the notification channels enabled for the monitor’s status page, and also shows up as an in-app notification (DNS TTL reduced) linking to your monitors.
It includes the monitor name, the monitored domain, the previous TTL and the new TTL, for example:
The DNS TTL for ‘Main site DNS’ (example.com) has been significantly reduced. Previous TTL: 3600 s. New TTL: 60 s.
This is an informational alert. It does not open an incident and does not mark the monitor as down.
What to Do With It
- You planned the change: nothing to do. Keep an eye on the monitor after the switch.
- You did not plan it: check with whoever manages your DNS. An unexpected TTL cut can be an early sign of a misconfiguration or an unauthorized change.
- Combine it with your expected DNS values so the monitor also alerts if the record changes to something you did not expect.
Things to Know
- The alert is sent for DNS monitors only.
- It is based on the record type the monitor checks, using the TTL reported by the DNS answer at check time.
- If the TTL cannot be read during a check, no alert is sent and the previous baseline is kept.
- Test runs from the monitor form never send TTL alerts.