Maximum DNS TTL

1. In Zero Trust , go to Traffic Policies > Traffic Settings.
2. Under Proxy and inspection, find the Configure time-to-live for DNS resolution section.
3. Enter a value in seconds (between 60 and 36,000).
4. Select Save.

curl --request PUT \
  https://api.cloudflare.com/client/v4/accounts/{account_id}/gateway/configuration \
  --header "Authorization: Bearer {api_token}" \
  --header "Content-Type: application/json" \
  --data '{
    "settings": {
      "max_ttl_secs": 3600
    }
  }'

To remove the account-level cap (allow upstream TTLs to pass through), omit the max_ttl_secs field or set it to null.

1. In Zero Trust , go to Networks > Resolvers & Proxies > DNS locations.
2. Select a location, or create a new one.
3. In the DNS Endpoints tab, find the Configure time-to-live for this location section.
4. Choose one of:
   • Respect account-level setting - inherits the account-level TTL cap.
   • Do not set max value - disables the TTL cap for this location.
   • Custom - enter a TTL value in seconds.
5. Select Save.

# Inherit account-level setting (default)
curl --request PUT \
  https://api.cloudflare.com/client/v4/accounts/{account_id}/gateway/locations/{location_id} \
  --header "Authorization: Bearer {api_token}" \
  --header "Content-Type: application/json" \
  --data '{
    "max_ttl": {
      "mode": "inherit"
    }
  }'

# Disable max TTL for this location
curl --request PUT \
  https://api.cloudflare.com/client/v4/accounts/{account_id}/gateway/locations/{location_id} \
  --header "Authorization: Bearer {api_token}" \
  --header "Content-Type: application/json" \
  --data '{
    "max_ttl": {
      "mode": "disabled"
    }
  }'

# Override with a custom value
curl --request PUT \
  https://api.cloudflare.com/client/v4/accounts/{account_id}/gateway/locations/{location_id} \
  --header "Authorization: Bearer {api_token}" \
  --header "Content-Type: application/json" \
  --data '{
    "max_ttl": {
      "mode": "override",
      "ttl_secs": 3600
    }
  }'