I just noticed that in our first zone, every record has a TTL of 900. All three nameservers in our system are handing out the same incorrect TTLs (easily visible via AXFR, and expected since two are slaves). Operations > Customers > Customer > Domains > domain shows every record in this zone has a TTL of 42300. The DNS resource's Activation Parameters and zone's SOA are set as follows: Refresh 43200 Retry 600 Expire 2419200 Min TTL 900 Default TTL 43200 (for the resource; not editable for the zone) PPA seems to be silently using the Min TTL to override the zone records that it shows with the desired TTL on screen. Changing the Min TTL in the SOA for a zone changes the TTL of all records. This zone has both template-generated and manual records.