I'm currently reading about [resource record](https://en.wikipedia.org/wiki/Domain_Name_System#Resource_records) in the [Domain Name System (DNS)](https://en.wikipedia.org/wiki/Domain_Name_System), in particular about the [Time to live (TTL)](https://en.wikipedia.org/wiki/Time_to_live#DNS_records) aspect of [start of authority records (SOA)](https://en.wikipedia.org/wiki/SOA_record) records. It seems to me that the TTL was firstly defined in [RFC 1034](https://www.rfc-editor.org/rfc/rfc1034.txt) and later redefined in [RFC 2308](https://www.rfc-editor.org/rfc/rfc2308.txt).

A DNS configuration scan using [dnsinspect.com](https://www.dnsinspect.com/stackexchange.com/10621254) on the domain stackexchange.com states the following:

> 
> **SOA Minimum TTL.** OK. Minimum TTL value is **86400**. Recommended values [3600 .. 86400] (1 hour ... 1 day). Minimum TTL was redefined in RFC 2308, now it defines the period of time used by slaves to cache negative responses.
> 
> 
> 

This made me wonder if the TTL value has any influence on information security. The only thing related to information security that I could think of is [disaster recovery (DR)](https://en.wikipedia.org/wiki/Disaster_recovery) in the sense of **availability** ([CIA triad](https://en.wikipedia.org/wiki/Information_security#Key_concepts)). From the [Time to live (TTL) Wikipedia article](https://en.wikipedia.org/wiki/Time_to_live#DNS_records):

> 
> Newer DNS methods that are part of a **disaster recovery (DR)** system may have some records deliberately set extremely low on TTL. For example, a 300-second TTL would help key records expire in 5 minutes to help ensure these records are flushed quickly worldwide. This gives administrators the ability to edit and update records in a timely manner. TTL values are "per record" and setting this value on specific records is sometimes honored automatically by all standard DNS systems worldwide. However, a problem persists in that some caching DNS nameservers set their own TTLs regardless of the authoritative records, thus it cannot be guaranteed that all downstream DNS servers have the new records after the TTL has expired.
> 
> 
> 

In short: Does the Time-To-Live (TTL) value of DNS records (or SOA records in particular) have any security implications? What is safer having a value being too high or too low and what are the pros and cons of that security wise?

Related interesting article: [Short DNS record TTL and centralization are serious risks for the internet](https://techblog.bozho.net/short-dns-ttl-and-centralization-are-serious-risks-for-the-internet/)