TTL (time to live)
TTL is the number of seconds a DNS record may be cached, or the hop limit on an IP packet that traceroute uses to map a route.
Two meanings of TTL
The abbreviation TTL is used for two unrelated counters, and both come up in network tools.
DNS TTL
Every DNS record carries a time to live in seconds. It tells resolvers how long they may keep the answer before asking the authoritative server again. A record with a TTL of 3600 can be served from cache for an hour; one with a TTL of 60 is re-fetched every minute. Short TTLs make changes propagate quickly at the cost of more queries; long TTLs reduce load and make the name resilient to short outages at the authoritative server.
When you look up a record, the TTL shown is the remaining time at the resolver that answered, which is why the same record shows different values from different resolvers and counts down between queries.
IP packet TTL (hop limit)
Every IP packet also carries a TTL, called the hop limit in IPv6. Each router that forwards the packet decreases it by one, and a router that decrements it to zero discards the packet and sends back an ICMP "time exceeded" message. The purpose is to stop misrouted packets from circling forever. Traceroute exploits it: by sending probes with TTL 1, 2, 3, and so on, it collects a time-exceeded reply from each router along the path and reconstructs the route.
Operating systems use different starting values, commonly 64, 128, or 255. The value that arrives at a server hints at how many hops the packet crossed and, loosely, which operating system sent it.
Why it matters
For DNS, TTL explains why a changed record is still "wrong" from one resolver and already right from another; our DNS propagation checker shows the answer and remaining TTL from resolvers around the world so you can see the change spread. Planning a migration usually means lowering the TTL a day ahead so the switch is quick.
For packets, an unexpected TTL at the server is a known proxy signal. A connection that claims to come from a Windows machine but arrives with a Linux-style starting TTL, reduced by far more hops than the claimed location implies, suggests a relay in between. We do not score this signal on the site, because shared hosting cannot read raw packet headers, but dedicated fraud systems do.
How to check
DNS lookup shows the TTL for every record it returns. DNS propagation compares answers across public resolvers. Traceroute shows the hop-by-hop route built from packet TTLs.