Why is the TTL value of DNS packets sometimes changed to 30 seconds?

• PA-Series Next-Generation Firewall
• PAN-OS 10.2
• DNS Security

1. If the device has a DNS security license and the Anti-Spyware profile is applied to DNS traffic, DNS signature lookup processing is performed to the Cloud.
2. If there is no response (or timeout) from the Cloud, the  TTL of that DNS packet  is changed to 30 seconds.
3. This value 30 seconds cannot be adjusted.
4. The change of this timeout value is the following setting.

Device > Setup > Content-ID > Realtime Signature Lookup > DNS Signature Lookup Timeout (ms)

5. The exclusion of this DNS signature lookup process is the following setting.

Objects > Anti-Spyware > [Profile] > DNS Exceptions > DNS Domain/FQDN Allow list

6. The global counter "ctd_dns_modify_ttl" is counted when a TTL change occurs.