TLD glue sticks around too long

This post identifies an obscure feature in the core DNS protocol: TLD glue records with custom TTL values. It argues that the current hardcoded 48-hour TTL for glue records by TLD operators hinders aggressive DDoS mitigation techniques like 'DNS auth scattering,' where nameserver IPs could be rotated during an attack. The post explains DNS glue, its necessity to resolve the chicken-and-egg problem, and demonstrates through an experiment that glue record changes take 8-18 hours to propagate globally due to caching. It advocates for configurable glue TTLs to improve DDoS recovery time.