Capping DNS TTL at up to 36,000 seconds — Cloudflare Gateway now blocks malicious domains faster
Hi everyone, I'm Shiichan! Today I found a DNS-related update from Cloudflare, so let's take a look!
Cloudflare Changelog
developers.cloudflare.com
What was announced?
The Cloudflare Changelog announced that Cloudflare One's Gateway now lets you set a maximum TTL (Time-To-Live) for DNS responses. When an upstream DNS record's TTL exceeds your configured maximum, Gateway caps it down to that value. This means DNS policy changes — like blocking a domain you've just identified as malicious — can now reach all your clients much faster.
The story so far
Until now, there was no way to cap the TTL of a DNS response, so whatever TTL the upstream DNS server returned was used as-is for how long the record stayed cached. If an upstream record had a very long TTL, then even after you added that domain to your block list, clients could keep using the old, cached resolution until their local cache expired on its own. In other words, a policy change didn't reach every client at once — there was always some lag.
What changes
With a maximum TTL configured, Gateway now forcibly caps the cache lifetime at your specified value, no matter how long the upstream TTL is. Since records expire sooner, newly applied policies — like blocking a freshly identified malicious domain — reach clients much faster. That's a welcome change if you're responsible for security policy, since it gives you more control over how quickly a policy change actually takes effect.
Dive Deep
Here's how the setting works in practice.
- The configurable range is 60 to 36,000 seconds (1 minute to 10 hours)
- At the account level, the setting lives under Traffic Policies, in Traffic Settings, under Proxy and inspection. This sets the default cap for every DNS location
- Each DNS location can also be configured individually — inherit the account setting, disable the cap, or override it with its own custom value
Two new fields also show up in DNS logs.
upstream_record_ttls— the original TTL from the upstream responseapplied_max_ttl— the cap Gateway actually applied
Both are available in the log's column picker and in Logpush datasets, so you can verify the cap is actually working as expected.
Wrap-up
- Cloudflare One's Gateway now supports setting a maximum TTL for DNS responses
- The configurable range is 60 to 36,000 seconds, settable at both the account and location level
- Each location can inherit the account setting, disable the cap, or override it with a custom value
- DNS logs gain two new fields,
upstream_record_ttlsandapplied_max_ttl, also available via Logpush - A nice update if you manage Cloudflare Gateway and want DNS policy changes — like blocking a malicious domain — to reach every client faster.
