Any complete failure of that set of machines is (as far as I know) completely theoretical. IIRC, there was a direct *intentional* DDoS attack on them and about 3 or 4 of them were out of commission, but that had nothing to do with DNS TTLs.

Technically, I still don’t think MS changing their TTL to 60 seconds would pose any such threat to the root servers, because all the other servers in the chain would still be caching the results all along the chain, just not for very long. So, at most, the root servers would just be getting 1 hit per minute from the DNS servers that are referring directly to them (which isn’t that many - most DNS requests go through a long chain), so I hardly see that bringing them down, because pretty much every DNS server between you and them would be working to cache those results, and your request would only ever traverse all the way to the root servers if none of the servers in that path had gone that far within the last minute.

Also, only DNS requests (not other traffic) goes to them, so it would be difficult for there to be that many requests (since those are so small) to really flood them.

I did a brief search to satisfy my curiosity, and I didn’t turn up much of anything other than the virus reference I previously mentioned. I would think this would be a huge enough story to still show up pretty easily in a quick search. I didn’t look into it too deeply, though, so if you find any links on it, go ahead and post them, because I’d be interested in hearing about it.

The way it was explained to me it has very feasible. I’ll try to rehash it but I will most likely get some of it wrong.

Each user needs to be routed to a certain IP. There a lot of DNS servers that cache the IP’s of sites so the user can be routed to the IP directly without going to the *key* servers that run the web (this is where it gets foggy because if I remember right there are not a lot only 10+ in the world that route the internet). If the DNS servers had no cache because the TTL expired the user would be routed to the key servers making a bottle neck, choking and DDOSing the servers. And since these key servers are down the caching servers can’t update their caches resulting in a downage of the internet for all.

I wish I knew what the hell these key servers are called or remember how many. I’m sure you could shine some light.

You still do have to worry about it though, because some DNS servers do not honor the TTL from the source server, and cache the result anyway for days or even weeks.

Also, once you change the address, you should set the TTL back to a longer value, not just leave it short, because then you would be causing undue burden on your DNS server. The whole point of TTL and caching is to reduce the number of hits to your DNS server, so setting it short permanently will diminish the success of that goal.

At the bottom: you were referring to the TTL right? Because I was going to suggest you change that instead and then you wouldn’t have to worry at all.

So it looks like your good from here and I’d assume you’d be good for the other 98% of your visitors. Good job.