What is Time to Live (TTL)?

“Time to live” appears in two common places. On IP packets, TTL is a hop counter: each router decrements it and drops the packet at zero to stop routing loops. In DNS, TTL is a cache lifetime in seconds: resolvers reuse a record until TTL expires, then query upstream again. Marketing and ops teams usually meet DNS TTL when changing hosting or CDNs; engineers use IP TTL with traceroute.

IP TTL on the wire

Each forwarded IPv4 packet decrements TTL (IPv6 uses Hop Limit). When TTL hits zero, the router discards the packet and may send ICMP time exceeded. Diagnostic tools raise TTL stepwise to map hops. TTL is not a wall-clock timer; it counts routers, though typical paths keep total RTT bounded.

DNS TTL and caching

Authoritative servers return records with a TTL. Recursive resolvers and stub caches honor it to cut load and latency. High TTL (for example 24 hours) reduces queries but slows cutovers. Low TTL (minutes) speeds migrations yet increases query volume. Plan ahead: lower TTL before a change so stale caches expire before you switch IPs.

Recursive resolvers may clamp very low TTLs. Changes never flush the world instantly because each cache expires on its own schedule.

TTL in the world of click fraud and campaigns

DNS TTL affects how fast landing-page or tracking hostname changes propagate. It does not stop click fraud, but bot operators also use DNS for infrastructure that rotates IPs. Short TTLs on malicious domains can outpace static blocklists, which is one reason vendors emphasize behavior and detection pipelines rather than DNS alone.

IP TTL helps explain tools that measure path length, sometimes correlating with unexpected geography versus claimed user location. Combined with ISP and resolver data, it adds context to suspicious clicks and suspicious behavior. Broader abuse categories include ad fraud and bots.