Loading
Upcoming Mandatory Changes to Public Key Infrastructure (PKI)Read More
Salesforce Enforces New Security Requirements in Summer 2026Read More

DNS TTL Best Practice Before Salesforce Maintenance or Site Switch

Publish Date: Jun 2, 2026
Description

Here's what you need to know:
If a customers network or IT group controls the DNS timeout values, then they may need to refresh the DNS cache and restart any integrations following the maintenance. We do recommend a shorter TTL (Time To Live) value, so that when the new instance comes online, the network will have the latest DNS information to ensure it can find the new location quickly.

⚠ Important: This DNS TTL setting is not configurable within Salesforce. It is managed by your IT or Networking team on your local DNS infrastructure and upstream caching servers. Contact your network administrator to verify and update this setting at least 48 hours before any scheduled Salesforce maintenance window or Site Switch — this ensures the lower TTL has fully propagated through your DNS infrastructure before the switch occurs.


Time to Live values are always represented in seconds. Most DNS setup configuration services provide you a preset list of values to set your records to.
300 seconds = 5 minutes = “Very Short”
3600 seconds = 1 hour = “Short”
86400 seconds = 24 hours = “Long”
604800 seconds = 7 days = “Very long”

What Value Should You Set?

Salesforce recommends lowering your DNS TTL value on your caching servers to the lowest value your DNS infrastructure supports — well in advance of any scheduled maintenance window or Site Switch. As documented in Site Switching Overview and FAQ (000387541), setting your DNS timeout to the lowest operationally supportable value is the recommended best practice before any planned Salesforce infrastructure change.

Why Use a Shorter DNS TTL Before Salesforce Infrastructure Maintenance?

The answer is rooted in how DNS propagation works — and the impact it has on your users, integrations, and connected applications during a Salesforce maintenance window.

When Salesforce performs an Instance Refresh (moving your org to a new server instance) or a Site Switch (changing the IP routing for your org), the IP address that your DNS resolves to will change. What happens next depends entirely on your DNS TTL setting:

With a long TTL (e.g., 86400 seconds / 24 hours)
Your network may continue pointing to the old IP address for up to 24 hours after the switch completes. During this window:
  • Users cannot connect to Salesforce — "This site can't be reached"
  • API calls and integrations time out or return connection errors
  • Middleware and connected apps fail silently or enter error states
Resolution
The recommended resolution is to set the DNS TTL to shorter duration as per to what your DNS resolver supports on all DNS resource records that point to Salesforce infrastructure. This is the key step to ensuring that:
  1. During Instance Refresh or Site Switch, the network resolves the new Salesforce instance IP quickly without waiting for a long cache expiry.
  2. Integrations and users experience minimal disruption — the maintenance is essentially seamless.
  3. Compliance with Salesforce infrastructure best practices, which include:
    • Not restricting Salesforce IP ranges
    • Allowlisting the full Salesforce IP range (if IP blocklisting is in use)
    • Setting DNS TTL to 300 seconds on your caching server 

 

If Your DNS Infrastructure Cannot Support a Shorter TTL
If your IT team has set a longer TTL (for example, 86400 seconds / 24 hours) and your DNS infrastructure cannot be changed before the maintenance window, the following alternatives can help minimize connectivity disruption:

Recommended Actions Before Maintenance

  • Lower the TTL to the shortest value your infrastructure supports before the maintenance window — even reducing from 86400 seconds to 3600 seconds (1 hour) is significantly better than no change at all
  • Flush and refresh your DNS cache immediately after maintenance completes — do not wait for the TTL to expire naturally
  • Restart any integrations, middleware, and connected apps that may have cached the old DNS entry
Knowledge Article Number

000382920

 
Loading
Salesforce Help | Article