DNS TTL migration planner
Build a DNS change timeline from positive and negative TTLs, authority lag and your cache assumptions.
Wait for the old positive and negative cache retention after the last authority publishes the new TTL. Negative TTL is the lesser of SOA TTL and SOA MINIMUM. The supplied resolver floor, stale-answer allowance and safety margin are explicit assumptions. Authority lag applies to each publication. A manually selected earlier change retains the old high-TTL expiry in the retirement calculation. Outages, application caches, delegation changes and unbounded stale answers can exceed the model. This timeline does not guarantee global DNS propagation. Runs locally without uploads. Limit: 500000 combined input characters, 1000 services and 5000 conflicting pairs. Complete JSON and JSON Pointer CSV exports are each capped at 2000000 characters; CSV contains at most 200000 typed values. Preview shows at most 200 rows. Calculations stop after 10 seconds. Downloads retain your source inputs, units, assumptions and complete results. Up to 500,000 characters. Review the settings before running.
Your result
How to use DNS TTL migration planner
- Set the UTC time for publishing the new TTL and enter old and new positive TTLs and SOA values.
- Enter authority lag, any resolver minimum retention, extra stale-answer retention and a safety margin.
- Review the suggested change and retirement times, or supply an earlier change time to inspect remaining cache exposure.
Useful next steps
Wait out records cached under the old TTL
The waiting period begins after the last authority is assumed to publish the new TTL. Old records could have been fetched just before that point. Negative-cache TTL uses the lesser of the SOA TTL and SOA MINIMUM. If you choose an earlier record change, the report retains the old high-TTL expiry in its retirement calculation.
Treat the schedule as a bounded scenario
Authority lag, resolver retention and extra stale-answer time are assumptions you provide. Outages, application caches, delegation changes, DNSSEC and unbounded stale-answer behavior may exceed them. The output is a UTC timeline, not a measurement of global propagation or a guarantee that every client has updated.