On the flip side, it’s the longer you can survive an outage by relying on enough clients having the cached records. So can go both ways a bit.

.com (used for Facebook authoritative DNS) and .net (used for WhatsApp) servers serve glue records with a 2 day TTL, and domain holders don't get to choose TTL. (the root servers serve glue records for the TLDs with a 2 day TTL as well).

So, two days is the TTL you get for your NS records. Of course, it takes way more than two days for people to stop querying your old records. I gave up after 30-45 days.

Heh. I remember the day when a TTL of a week was pretty standard.

Anyway, the since the NS records for a domain come from the next level up, i.e. in this case the .com nameserver which are also the root nameservers, if they had a short TTL then those root nameservers would get hit pretty hard. Also, it isn't your choice what the TTL on your NS records is, it's admins of your top-level domains.

"Why on earth would any system need a TTL beyond 1 hour?"

Load. Lower TTLs mean shorter term caches and more traffic.

This is a big deal, especially for root servers -- which is why the TTL is not customizable.

Shorter TTL increases poisoning risk. Anyway attacker can set arbitrary TTL if they succeed poisoning so longer TTL won't increase risk.

Could something with a normal 1 hour TTL be poisoned by a cache entry with a 30 day TTL?