Sorry to chime in late, a day after this comment was added. If you set a long DNS TTL, then you will not be able to move your IP addresses quick enough. In the

Sorry to chime in late, a day after this comment was added. If you set a long DNS TTL, then you will not be able to move your IP addresses quick enough. In the DDoS world, you may need to nullroute an HTTP server IP. If you do that, you assume you can point the DNS to another, not-nulled IP. For this reason, keeping the DNS TTL to low values will make you more resilient. Multiple DNS providers is probably a good advice, although hard to do in practice. The api's of different vendors don't always match. (cname flattening? geo-routing?). Also a real big attack will just likely take down all your providers. Using multiple providers may well _decrease_ the stability of the internet at large. DDoS against DNS is not trivial problem. As sad as it may be, I'd say we must just assume DNS infrastructure in the world works. If it stops, then, many users will be affected.