DNS records point to correct production hosts; DNS managed by reliable provider; TTL set to 300-3600 seconds

A DNS TTL set to 86400 seconds (24 hours) means a misconfigured or failed DNS record takes up to 24 hours to propagate a fix — even after you've corrected it. NIST SC-20 covers secure DNS; ISO 25010 reliability.availability requires timely failover capability. A TTL between 300 and 3600 seconds gives you fast failover when you need to redirect traffic during an outage while keeping query load on DNS servers reasonable. A CNAME pointing to staging instead of production silently serves wrong content to all users.

Verify your DNS records point to production hosts and set TTL to 300–3600 seconds. Log into your DNS provider (Route 53, Cloudflare, Namecheap) and check A and CNAME records.

For Cloudflare via Terraform:

resource "cloudflare_record" "root" {
  zone_id = var.cloudflare_zone_id
  name    = "@"
  value   = "1.2.3.4"    # your production IP
  type    = "A"
  ttl     = 300           # 5 minutes — good for active incident response
  proxied = true
}

Lower TTL to 60 seconds before a planned migration so changes propagate in 1 minute; raise it back to 300–3600 after confirming the new config is stable. Document your DNS provider credentials location and zone ID in DEPLOYMENT.md.