On Jun 9, 2012, at 4:21 AM, John Payne wrote: > However, doesn't DNSSEC require all ttls for a label to be the same, or am I misremembering? The DNS (not DNSSEC) requires all {name,type,class} tuples to have the same TTL (see RFC 2181, section 5.2). Regards, -drc