Cloudflare One, Gateway - Control Cloudflare Gateway DNS caching with a maximum TTL setting

<p>You can now set a maximum time-to-live (TTL) for DNS responses returned by Gateway. When an upstream DNS record has a TTL that exceeds the configured maximum, Gateway caps it to your specified value. This ensures that DNS policy changes - such as blocking a newly identified malicious domain - take effect faster across all clients.</p> <img src="https://developers.cloudflare.com/cdn-cgi/image/onerror=redirect,width=2170,height=294,format=webp/_astro/gateway-max-ttl-traffic-settings.BRF3NUMp.png" alt="The maximum DNS TTL setting in Traffic policies > Traffic settings, showing a numeric input field that accepts values between 60 and 36,000 seconds" loading="lazy" decoding="async" width="2170" height="294"> <p>The setting is available at two levels:</p> <ul> <li><strong>Account level</strong> - In <strong>Traffic Policies</strong> &gt; <strong>Traffic Settings</strong>, under <strong>Proxy and inspection</strong>. This sets the default cap for all DNS locations.</li> <li><strong>Per-location</strong> - Each <a href="https://developers.cloudflare.com/cloudflare-one/traffic-controls/resolver-endpoints/">DNS location</a> can inherit the account setting, disable the cap, or override it with a custom value.</li> </ul> <p>Two new fields are also available in DNS logs: <code>upstream_record_ttls</code> (the original TTL from the upstream response) and <code>applied_max_ttl</code> (the cap Gateway applied). These appear in the DNS logs column picker and in Logpush datasets.</p> <p>For more information, refer to <a href="https://developers.cloudflare.com/cloudflare-one/traffic-controls/dns-policies/maximum-dns-ttl/">Maximum DNS TTL</a>.</p>