diff --git a/terraform/0rng.one.tf b/terraform/0rng.one.tf
index 9d2ae95..6fd660e 100644
--- a/terraform/0rng.one.tf
+++ b/terraform/0rng.one.tf
@@ -7,7 +7,7 @@ resource "desec_rrset" "orngone_apex" {
   subname = ""
   type    = "A"
   records = desec_rrset.sys_domain_walker.records
-  ttl     = 3600
+  ttl     = local.dns_ttl_default
 }
 
 resource "desec_rrset" "orngone_apex_v6" {
@@ -15,7 +15,7 @@ resource "desec_rrset" "orngone_apex_v6" {
   subname = ""
   type    = "AAAA"
   records = desec_rrset.sys_domain_walker_v6.records
-  ttl     = 3600
+  ttl     = local.dns_ttl_default
 }
 
 resource "desec_rrset" "orngone_caa" {
@@ -23,7 +23,7 @@ resource "desec_rrset" "orngone_caa" {
   subname = ""
   type    = "CAA"
   records = ["0 issue \"letsencrypt.org\""]
-  ttl     = 3600
+  ttl     = local.dns_ttl_default
 }
 
 resource "desec_rrset" "orngone_who" {
@@ -31,5 +31,5 @@ resource "desec_rrset" "orngone_who" {
   subname = "who"
   type    = "CNAME"
   records = ["${desec_rrset.sys_domain_pve.subname}.${desec_rrset.sys_domain_pve.domain}."]
-  ttl     = 3600
-}
\ No newline at end of file
+  ttl     = local.dns_ttl_default
+}
diff --git a/terraform/jakehoward.tech.tf b/terraform/jakehoward.tech.tf
index 2153eb3..f9af508 100644
--- a/terraform/jakehoward.tech.tf
+++ b/terraform/jakehoward.tech.tf
@@ -6,7 +6,7 @@ resource "desec_rrset" "jakehowardtech_mx" {
   domain  = desec_domain.jakehowardtech.name
   subname = ""
   type    = "MX"
-  ttl     = 3600
+  ttl     = local.dns_ttl_default
   records = [
     "10 in1-smtp.messagingengine.com.",
     "20 in2-smtp.messagingengine.com.",
@@ -17,7 +17,7 @@ resource "desec_rrset" "jakehowardtech_dkim_fm1" {
   domain  = desec_domain.jakehowardtech.name
   subname = "fm1._domainkey"
   type    = "CNAME"
-  ttl     = 3600
+  ttl     = local.dns_ttl_default
   records = [
     "fm1.jakehoward.tech.dkim.fmhosted.com."
   ]
@@ -27,7 +27,7 @@ resource "desec_rrset" "jakehowardtech_dkim_fm2" {
   domain  = desec_domain.jakehowardtech.name
   subname = "fm2._domainkey"
   type    = "CNAME"
-  ttl     = 3600
+  ttl     = local.dns_ttl_default
   records = [
     "fm2.jakehoward.tech.dkim.fmhosted.com."
   ]
@@ -37,7 +37,7 @@ resource "desec_rrset" "jakehowardtech_dkim_fm3" {
   domain  = desec_domain.jakehowardtech.name
   subname = "fm3._domainkey"
   type    = "CNAME"
-  ttl     = 3600
+  ttl     = local.dns_ttl_default
   records = [
     "fm3.jakehoward.tech.dkim.fmhosted.com."
   ]
@@ -47,7 +47,7 @@ resource "desec_rrset" "jakehowardtech_dmarc" {
   domain  = desec_domain.jakehowardtech.name
   subname = "_dmarc"
   type    = "TXT"
-  ttl     = 3600
+  ttl     = local.dns_ttl_default
   records = [
     "\"v=DMARC1; p=quarantine; ruf=mailto:dmarc-report@jakehoward.tech;\""
   ]
@@ -57,7 +57,7 @@ resource "desec_rrset" "jakehowardtech_txt" {
   domain  = desec_domain.jakehowardtech.name
   subname = ""
   type    = "TXT"
-  ttl     = 3600
+  ttl     = local.dns_ttl_default
   records = [
     "\"v=spf1 include:spf.messagingengine.com -all\""
   ]
@@ -67,7 +67,7 @@ resource "desec_rrset" "jakehowardtech_speed" {
   domain  = desec_domain.jakehowardtech.name
   subname = "speed"
   type    = "CNAME"
-  ttl     = 3600
+  ttl     = local.dns_ttl_default
   records = [
     "${desec_rrset.sys_domain_pve.subname}.${desec_rrset.sys_domain_pve.domain}."
   ]
@@ -77,7 +77,7 @@ resource "desec_rrset" "jakehowardtech_media" {
   domain  = desec_domain.jakehowardtech.name
   subname = "media"
   type    = "CNAME"
-  ttl     = 3600
+  ttl     = local.dns_ttl_default
   records = [
     "${desec_rrset.sys_domain_pve.subname}.${desec_rrset.sys_domain_pve.domain}."
   ]
@@ -87,7 +87,7 @@ resource "desec_rrset" "jakehowardtech_matrix" {
   domain  = desec_domain.jakehowardtech.name
   subname = "matrix"
   type    = "CNAME"
-  ttl     = 3600
+  ttl     = local.dns_ttl_default
   records = [
     "${desec_rrset.sys_domain_pve.subname}.${desec_rrset.sys_domain_pve.domain}."
   ]
@@ -97,7 +97,7 @@ resource "desec_rrset" "jakehowardtech_intersect" {
   domain  = desec_domain.jakehowardtech.name
   subname = "intersect"
   type    = "CNAME"
-  ttl     = 3600
+  ttl     = local.dns_ttl_default
   records = [
     "${desec_rrset.sys_domain_pve.subname}.${desec_rrset.sys_domain_pve.domain}."
   ]
@@ -107,7 +107,7 @@ resource "desec_rrset" "jakehowardtech_calibre" {
   domain  = desec_domain.jakehowardtech.name
   subname = "calibre"
   type    = "CNAME"
-  ttl     = 3600
+  ttl     = local.dns_ttl_default
   records = [
     "${desec_rrset.sys_domain_pve.subname}.${desec_rrset.sys_domain_pve.domain}."
   ]
@@ -117,7 +117,7 @@ resource "desec_rrset" "jakehowardtech_homeassistant" {
   domain  = desec_domain.jakehowardtech.name
   subname = "homeassistant"
   type    = "CNAME"
-  ttl     = 3600
+  ttl     = local.dns_ttl_default
   records = [
     "${desec_rrset.sys_domain_pve_private.subname}.${desec_rrset.sys_domain_pve_private.domain}."
   ]
@@ -127,7 +127,7 @@ resource "desec_rrset" "jakehowardtech_grafana" {
   domain  = desec_domain.jakehowardtech.name
   subname = "grafana"
   type    = "CNAME"
-  ttl     = 3600
+  ttl     = local.dns_ttl_default
   records = [
     "${desec_rrset.sys_domain_pve.subname}.${desec_rrset.sys_domain_pve.domain}."
   ]
@@ -137,7 +137,7 @@ resource "desec_rrset" "jakehowardtech_vaultwarden" {
   domain  = desec_domain.jakehowardtech.name
   subname = "vaultwarden"
   type    = "CNAME"
-  ttl     = 3600
+  ttl     = local.dns_ttl_default
   records = [
     "${desec_rrset.sys_domain_pve_private.subname}.${desec_rrset.sys_domain_pve_private.domain}."
   ]
@@ -147,7 +147,7 @@ resource "desec_rrset" "jakehowardtech_recipes" {
   domain  = desec_domain.jakehowardtech.name
   subname = "recipes"
   type    = "CNAME"
-  ttl     = 3600
+  ttl     = local.dns_ttl_default
   records = [
     "${desec_rrset.sys_domain_pve.subname}.${desec_rrset.sys_domain_pve.domain}."
   ]
@@ -157,7 +157,7 @@ resource "desec_rrset" "jakehowardtech_mailgun_spf" {
   domain  = desec_domain.jakehowardtech.name
   subname = "mg"
   type    = "TXT"
-  ttl     = 3600
+  ttl     = local.dns_ttl_default
   records = [
     "\"v=spf1 include:mailgun.org -all\""
   ]
@@ -167,7 +167,7 @@ resource "desec_rrset" "jakehowardtech_mailgun_dkim" {
   domain  = desec_domain.jakehowardtech.name
   subname = "s1._domainkey.mg"
   type    = "TXT"
-  ttl     = 3600
+  ttl     = local.dns_ttl_default
   records = [
     "\"k=rsa; p=MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA4E4cv86U+sFUjgLys26ZLccTghzGfHiFpitWdFg68lGXG63aoG2/+9bgKVT0ZBG7bjPvj6Kyj4N3TIe4oCJo2saVvtsNK1pvZ\" \"kOadaBPgjzKeRvBaw48ZatUGKoV7q1NCa0kXAfiJleF7bMvbt8rYDmBljr/BG6TtZYPt6XgoZyh8HHXjv/1L6WT3JBVQ8q5UtqVRVujXNHf57FmJTOJpvs0bKn/6TUaXYZmt5z3jpDhc/HfmkzVV22\" \"AwRf9jn7kgKkgaKpkvfSL8gtYNn5oyfS0Y9W9x9ntqb4g72RCbynMppQb1uwxbIuWRVOp0un0koQDm3C8ZzhOOYAwe58BYQIDAQAB\""
   ]
@@ -177,7 +177,7 @@ resource "desec_rrset" "jakehowardtech_mailgun_dmarc" {
   domain  = desec_domain.jakehowardtech.name
   subname = "_dmarc.mg"
   type    = "TXT"
-  ttl     = 3600
+  ttl     = local.dns_ttl_default
   records = [
     "\"v=DMARC1; p=quarantine; ruf=mailto:dmarc-report@jakehoward.tech;\""
   ]
@@ -187,7 +187,7 @@ resource "desec_rrset" "jakehowardtech_synapse_admin" {
   domain  = desec_domain.jakehowardtech.name
   subname = "synapse-admin"
   type    = "CNAME"
-  ttl     = 3600
+  ttl     = local.dns_ttl_default
   records = [
     "${desec_rrset.sys_domain_pve.subname}.${desec_rrset.sys_domain_pve.domain}."
   ]
@@ -197,7 +197,7 @@ resource "desec_rrset" "jakehowardtech_apex" {
   domain  = desec_domain.jakehowardtech.name
   subname = ""
   type    = "A"
-  ttl     = 3600
+  ttl     = local.dns_ttl_default
   records = desec_rrset.sys_domain_walker.records
 }
 
@@ -205,7 +205,7 @@ resource "desec_rrset" "jakehowardtech_apex_v6" {
   domain  = desec_domain.jakehowardtech.name
   subname = ""
   type    = "AAAA"
-  ttl     = 3600
+  ttl     = local.dns_ttl_default
   records = desec_rrset.sys_domain_walker_v6.records
 }
 
@@ -213,7 +213,7 @@ resource "desec_rrset" "jakehowardtech_collabora" {
   domain  = desec_domain.jakehowardtech.name
   subname = "collabora"
   type    = "CNAME"
-  ttl     = 3600
+  ttl     = local.dns_ttl_default
   records = [
     "${desec_rrset.sys_domain_pve.subname}.${desec_rrset.sys_domain_pve.domain}."
   ]
@@ -223,7 +223,7 @@ resource "desec_rrset" "jakehowardtech_tasks" {
   domain  = desec_domain.jakehowardtech.name
   subname = "tasks"
   type    = "CNAME"
-  ttl     = 3600
+  ttl     = local.dns_ttl_default
   records = [
     "${desec_rrset.sys_domain_pve.subname}.${desec_rrset.sys_domain_pve.domain}."
   ]
@@ -233,7 +233,7 @@ resource "desec_rrset" "jakehowardtech_auth" {
   domain  = desec_domain.jakehowardtech.name
   subname = "auth"
   type    = "CNAME"
-  ttl     = 3600
+  ttl     = local.dns_ttl_default
   records = [
     "${desec_rrset.sys_domain_pve.subname}.${desec_rrset.sys_domain_pve.domain}."
   ]
@@ -243,7 +243,7 @@ resource "desec_rrset" "jakehowardtech_ntfy" {
   domain  = desec_domain.jakehowardtech.name
   subname = "ntfy"
   type    = "CNAME"
-  ttl     = 3600
+  ttl     = local.dns_ttl_default
   records = [
     "${desec_rrset.sys_domain_pve.subname}.${desec_rrset.sys_domain_pve.domain}."
   ]
@@ -253,7 +253,7 @@ resource "desec_rrset" "jakehowardtech_headscale" {
   domain  = desec_domain.jakehowardtech.name
   subname = "headscale"
   type    = "CNAME"
-  ttl     = 3600
+  ttl     = local.dns_ttl_default
   records = [
     "${desec_rrset.sys_domain_casey.subname}.${desec_rrset.sys_domain_casey.domain}."
   ]
@@ -263,7 +263,7 @@ resource "desec_rrset" "jakehowardtech_slides" {
   domain  = desec_domain.jakehowardtech.name
   subname = "slides"
   type    = "CNAME"
-  ttl     = 3600
+  ttl     = local.dns_ttl_default
   records = [
     "${desec_rrset.sys_domain_walker.subname}.${desec_rrset.sys_domain_walker.domain}."
   ]
@@ -273,7 +273,7 @@ resource "desec_rrset" "jakehowardtech_uptime" {
   domain  = desec_domain.jakehowardtech.name
   subname = "uptime"
   type    = "CNAME"
-  ttl     = 3600
+  ttl     = local.dns_ttl_default
   records = [
     "${desec_rrset.sys_domain_pve.subname}.${desec_rrset.sys_domain_pve.domain}."
   ]
@@ -283,7 +283,7 @@ resource "desec_rrset" "jakehowardtech_baby-buddy" {
   domain  = desec_domain.jakehowardtech.name
   subname = "baby-buddy"
   type    = "CNAME"
-  ttl     = 3600
+  ttl     = local.dns_ttl_default
   records = [
     "${desec_rrset.sys_domain_pve_private.subname}.${desec_rrset.sys_domain_pve_private.domain}."
   ]
@@ -293,7 +293,7 @@ resource "desec_rrset" "jakehowardtech_immich" {
   domain  = desec_domain.jakehowardtech.name
   subname = "immich"
   type    = "CNAME"
-  ttl     = 3600
+  ttl     = local.dns_ttl_default
   records = [
     "${desec_rrset.sys_domain_pve_private.subname}.${desec_rrset.sys_domain_pve_private.domain}."
   ]
@@ -303,7 +303,7 @@ resource "desec_rrset" "jakehowardtech_photos" {
   domain  = desec_domain.jakehowardtech.name
   subname = "photos"
   type    = "CNAME"
-  ttl     = 3600
+  ttl     = local.dns_ttl_default
   records = [
     "${desec_rrset.sys_domain_pve.subname}.${desec_rrset.sys_domain_pve.domain}."
   ]
@@ -313,7 +313,7 @@ resource "desec_rrset" "jakehowardtech_freshrss" {
   domain  = desec_domain.jakehowardtech.name
   subname = "freshrss"
   type    = "CNAME"
-  ttl     = 3600
+  ttl     = local.dns_ttl_default
   records = [
     "${desec_rrset.sys_domain_pve_private.subname}.${desec_rrset.sys_domain_pve_private.domain}."
   ]
@@ -323,7 +323,7 @@ resource "desec_rrset" "jakehowardtech_atuin" {
   domain  = desec_domain.jakehowardtech.name
   subname = "atuin"
   type    = "CNAME"
-  ttl     = 3600
+  ttl     = local.dns_ttl_default
   records = [
     "${desec_rrset.sys_domain_pve_private.subname}.${desec_rrset.sys_domain_pve_private.domain}."
   ]
@@ -333,7 +333,7 @@ resource "desec_rrset" "jakehowardtech_karakeep" {
   domain  = desec_domain.jakehowardtech.name
   subname = "karakeep"
   type    = "CNAME"
-  ttl     = 3600
+  ttl     = local.dns_ttl_default
   records = [
     "${desec_rrset.sys_domain_pve_private.subname}.${desec_rrset.sys_domain_pve_private.domain}."
   ]
@@ -343,7 +343,7 @@ resource "desec_rrset" "jakehowardtech_caa" {
   domain  = desec_domain.jakehowardtech.name
   subname = ""
   type    = "CAA"
-  ttl     = 3600
+  ttl     = local.dns_ttl_default
   records = [
     "0 issue \"letsencrypt.org\"",
     "0 wildissue \"letsencrypt.org\"",
diff --git a/terraform/sys_domains.tf b/terraform/sys_domains.tf
index eabc7c2..140767d 100644
--- a/terraform/sys_domains.tf
+++ b/terraform/sys_domains.tf
@@ -2,7 +2,7 @@ resource "desec_rrset" "sys_domain_casey" {
   domain  = desec_domain.theorangeonenet.name
   subname = "casey.sys"
   type    = "A"
-  ttl     = 3600
+  ttl     = local.dns_ttl_default
   records = [
     linode_instance.casey.ip_address
   ]
@@ -12,7 +12,7 @@ resource "desec_rrset" "sys_domain_casey_v6" {
   domain  = desec_domain.theorangeonenet.name
   subname = "casey.sys"
   type    = "AAAA"
-  ttl     = 3600
+  ttl     = local.dns_ttl_default
   records = [
     split("/", linode_instance.casey.ipv6)[0]
   ]
@@ -22,7 +22,7 @@ resource "desec_rrset" "sys_domain_walker" {
   domain  = desec_domain.theorangeonenet.name
   subname = "walker.sys"
   type    = "A"
-  ttl     = 3600
+  ttl     = local.dns_ttl_default
   records = [
     hcloud_server.walker.ipv4_address
   ]
@@ -32,7 +32,7 @@ resource "desec_rrset" "sys_domain_walker_v6" {
   domain  = desec_domain.theorangeonenet.name
   subname = "walker.sys"
   type    = "AAAA"
-  ttl     = 3600
+  ttl     = local.dns_ttl_default
   records = [
     hcloud_server.walker.ipv6_address
   ]
@@ -42,7 +42,7 @@ resource "desec_rrset" "sys_domain_pve" {
   domain  = desec_domain.theorangeonenet.name
   subname = "pve.sys"
   type    = "A"
-  ttl     = 3600
+  ttl     = local.dns_ttl_default
   records = [
     linode_instance.casey.ip_address
   ]
@@ -52,7 +52,7 @@ resource "desec_rrset" "sys_domain_pve_private" {
   domain  = desec_domain.theorangeonenet.name
   subname = "pve-private.sys"
   type    = "AAAA"
-  ttl     = 3600
+  ttl     = local.dns_ttl_default
   records = [
     local.private_ipv6_marker
   ]
@@ -62,7 +62,7 @@ resource "desec_rrset" "sys_domain_grimes" {
   domain  = desec_domain.theorangeonenet.name
   subname = "grimes.sys"
   type    = "A"
-  ttl     = 3600
+  ttl     = local.dns_ttl_default
   records = [
     hcloud_server.grimes.ipv4_address
   ]
@@ -72,8 +72,8 @@ resource "desec_rrset" "sys_domain_grimes_v6" {
   domain  = desec_domain.theorangeonenet.name
   subname = "grimes.sys"
   type    = "AAAA"
-  ttl     = 3600
+  ttl     = local.dns_ttl_default
   records = [
     hcloud_server.grimes.ipv6_address
   ]
-}
\ No newline at end of file
+}
diff --git a/terraform/theorangeone.net.tf b/terraform/theorangeone.net.tf
index 6e6f967..10a7d0c 100644
--- a/terraform/theorangeone.net.tf
+++ b/terraform/theorangeone.net.tf
@@ -6,7 +6,7 @@ resource "desec_rrset" "theorangeonenet_git" {
   domain  = desec_domain.theorangeonenet.name
   subname = "git"
   type    = "CNAME"
-  ttl     = 3600
+  ttl     = local.dns_ttl_default
   records = [
     "${desec_rrset.sys_domain_pve.subname}.${desec_rrset.sys_domain_pve.domain}."
   ]
@@ -16,7 +16,7 @@ resource "desec_rrset" "theorangeonenet_whoami" {
   domain  = desec_domain.theorangeonenet.name
   subname = "whoami"
   type    = "CNAME"
-  ttl     = 3600
+  ttl     = local.dns_ttl_default
   records = [
     "${desec_rrset.sys_domain_pve.subname}.${desec_rrset.sys_domain_pve.domain}."
   ]
@@ -26,7 +26,7 @@ resource "desec_rrset" "theorangeonenet_mx" {
   domain  = desec_domain.theorangeonenet.name
   subname = ""
   type    = "MX"
-  ttl     = 3600
+  ttl     = local.dns_ttl_default
   records = [
     "10 in1-smtp.messagingengine.com.",
     "20 in2-smtp.messagingengine.com.",
@@ -37,7 +37,7 @@ resource "desec_rrset" "theorangeonenet_dkim_fm1" {
   domain  = desec_domain.theorangeonenet.name
   subname = "fm1._domainkey"
   type    = "CNAME"
-  ttl     = 3600
+  ttl     = local.dns_ttl_default
   records = [
     "fm1.theorangeone.net.dkim.fmhosted.com."
   ]
@@ -47,7 +47,7 @@ resource "desec_rrset" "theorangeonenet_dkim_fm2" {
   domain  = desec_domain.theorangeonenet.name
   subname = "fm2._domainkey"
   type    = "CNAME"
-  ttl     = 3600
+  ttl     = local.dns_ttl_default
   records = [
     "fm2.theorangeone.net.dkim.fmhosted.com."
   ]
@@ -57,7 +57,7 @@ resource "desec_rrset" "theorangeonenet_dkim_fm3" {
   domain  = desec_domain.theorangeonenet.name
   subname = "fm3._domainkey"
   type    = "CNAME"
-  ttl     = 3600
+  ttl     = local.dns_ttl_default
   records = [
     "fm3.theorangeone.net.dkim.fmhosted.com."
   ]
@@ -67,7 +67,7 @@ resource "desec_rrset" "theorangeonenet_dmarc" {
   domain  = desec_domain.theorangeonenet.name
   subname = "_dmarc"
   type    = "TXT"
-  ttl     = 3600
+  ttl     = local.dns_ttl_default
   records = [
     "\"v=DMARC1; p=quarantine; ruf=mailto:dmarc-report@jakehoward.tech;\""
   ]
@@ -84,7 +84,7 @@ resource "desec_rrset" "theorangeonenet_dmarc_report" {
   domain  = desec_domain.theorangeonenet.name
   subname = "${each.value}._report._dmarc"
   type    = "TXT"
-  ttl     = 3600
+  ttl     = local.dns_ttl_default
   records = [
     "\"v=DMARC1\""
   ]
@@ -94,7 +94,7 @@ resource "desec_rrset" "theorangeonenet_txt" {
   domain  = desec_domain.theorangeonenet.name
   subname = ""
   type    = "TXT"
-  ttl     = 3600
+  ttl     = local.dns_ttl_default
   records = [
     "\"google-site-verification=IXY4iSBN_vOcM3cp_f-BgVvEI_shz1GzXuY_8dqY61o\"",
     "\"v=spf1 include:spf.messagingengine.com -all\""
@@ -105,7 +105,7 @@ resource "desec_rrset" "theorangeonenet_apex" {
   domain  = desec_domain.theorangeonenet.name
   subname = ""
   type    = "A"
-  ttl     = 3600
+  ttl     = local.dns_ttl_default
   records = desec_rrset.sys_domain_walker.records
 }
 
@@ -113,7 +113,7 @@ resource "desec_rrset" "theorangeonenet_apex_v6" {
   domain  = desec_domain.theorangeonenet.name
   subname = ""
   type    = "AAAA"
-  ttl     = 3600
+  ttl     = local.dns_ttl_default
   records = desec_rrset.sys_domain_walker_v6.records
 }
 
@@ -121,7 +121,7 @@ resource "desec_rrset" "theorangeonenet_srv_matrix" {
   domain  = desec_domain.theorangeonenet.name
   subname = "_matrix._tcp"
   type    = "SRV"
-  ttl     = 3600
+  ttl     = local.dns_ttl_default
   records = [
     "10 0 8448 ${desec_rrset.theorangeonenet_matrix.subname}.${desec_rrset.theorangeonenet_matrix.domain}."
   ]
@@ -131,7 +131,7 @@ resource "desec_rrset" "theorangeonenet_matrix" {
   domain  = desec_domain.theorangeonenet.name
   subname = "matrix"
   type    = "CNAME"
-  ttl     = 3600
+  ttl     = local.dns_ttl_default
   records = [
     "${desec_rrset.sys_domain_pve.subname}.${desec_rrset.sys_domain_pve.domain}."
   ]
@@ -141,7 +141,7 @@ resource "desec_rrset" "theorangeonenet_plausible" {
   domain  = desec_domain.theorangeonenet.name
   subname = "plausible"
   type    = "CNAME"
-  ttl     = 3600
+  ttl     = local.dns_ttl_default
   records = [
     "${desec_rrset.sys_domain_walker.subname}.${desec_rrset.sys_domain_walker.domain}."
   ]
@@ -151,7 +151,7 @@ resource "desec_rrset" "theorangeonenet_plausible_bare" {
   domain  = desec_domain.theorangeonenet.name
   subname = "elbisualp"
   type    = "CNAME"
-  ttl     = 3600
+  ttl     = local.dns_ttl_default
   records = [
     "${desec_rrset.sys_domain_walker.subname}.${desec_rrset.sys_domain_walker.domain}."
   ]
@@ -161,7 +161,7 @@ resource "desec_rrset" "theorangeonenet_notes" {
   domain  = desec_domain.theorangeonenet.name
   subname = "notes"
   type    = "CNAME"
-  ttl     = 3600
+  ttl     = local.dns_ttl_default
   records = [
     "realorangeone.github.io."
   ]
@@ -171,7 +171,7 @@ resource "desec_rrset" "theorangeonenet_bin" {
   domain  = desec_domain.theorangeonenet.name
   subname = "bin"
   type    = "CNAME"
-  ttl     = 3600
+  ttl     = local.dns_ttl_default
   records = [
     "${desec_rrset.sys_domain_pve.subname}.${desec_rrset.sys_domain_pve.domain}."
   ]
@@ -181,7 +181,7 @@ resource "desec_rrset" "theorangeonenet_mailgun_spf" {
   domain  = desec_domain.theorangeonenet.name
   subname = "mg"
   type    = "TXT"
-  ttl     = 3600
+  ttl     = local.dns_ttl_default
   records = [
     "\"v=spf1 include:mailgun.org -all\""
   ]
@@ -191,7 +191,7 @@ resource "desec_rrset" "theorangeonenet_mailgun_dkim" {
   domain  = desec_domain.theorangeonenet.name
   subname = "mta._domainkey.mg"
   type    = "TXT"
-  ttl     = 3600
+  ttl     = local.dns_ttl_default
   records = [
     "\"k=rsa; p=MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA1Z/MHEzpbWm5EgMkyWb+Xkz44Xrzr4SA5i2u8M2H5yZ1PSb4DpGk3IAX+I05UWax02+WBW3CBb5wU9rH9flgxezBoCf/hiMS1\" \"Wjb9hKGIBa2jMCzpF+wa5fyqLkLoAJZF4bc/BJKyi/ET2c7+DAA/2KlWv/nv4MEjcUR4hNGLPEC9+6PhUp8z2PnUQLzPRWHpKc1oLrnROWaX3XxdDekCzwyOw7ygzZdThVevE+0CqXVOt5SUSUCnd2\" \"tjVbvblGi6DBiQY5Tl6+xLqkQHCRqks9187+EN4FdJXkjQodkFzzyiBH5cXVGiZLOhal4koEvxGirr596qM97bIXiJWArdQIDAQAB\""
   ]
@@ -201,7 +201,7 @@ resource "desec_rrset" "theorangeonenet_mailgun_dmarc" {
   domain  = desec_domain.theorangeonenet.name
   subname = "_dmarc.mg"
   type    = "TXT"
-  ttl     = 3600
+  ttl     = local.dns_ttl_default
   records = [
     "\"v=DMARC1; p=quarantine; ruf=mailto:dmarc-report@jakehoward.tech;\""
   ]
@@ -211,7 +211,7 @@ resource "desec_rrset" "theorangeonenet_mastodon" {
   domain  = desec_domain.theorangeonenet.name
   subname = "mastodon"
   type    = "CNAME"
-  ttl     = 3600
+  ttl     = local.dns_ttl_default
   records = [
     "${desec_rrset.sys_domain_grimes.subname}.${desec_rrset.sys_domain_grimes.domain}."
   ]
@@ -221,7 +221,7 @@ resource "desec_rrset" "theorangeonenet_comentario" {
   domain  = desec_domain.theorangeonenet.name
   subname = "comentario"
   type    = "CNAME"
-  ttl     = 3600
+  ttl     = local.dns_ttl_default
   records = [
     "${desec_rrset.sys_domain_walker.subname}.${desec_rrset.sys_domain_walker.domain}."
   ]
@@ -231,7 +231,7 @@ resource "desec_rrset" "theorangeonenet_bsky" {
   domain  = desec_domain.theorangeonenet.name
   subname = "bsky"
   type    = "CNAME"
-  ttl     = 3600
+  ttl     = local.dns_ttl_default
   records = [
     "${desec_rrset.sys_domain_grimes.subname}.${desec_rrset.sys_domain_grimes.domain}."
   ]
@@ -241,7 +241,7 @@ resource "desec_rrset" "theorangeonenet_atproto" {
   domain  = desec_domain.theorangeonenet.name
   subname = "_atproto"
   type    = "TXT"
-  ttl     = 3600
+  ttl     = local.dns_ttl_default
   records = [
     "\"did=did:plc:pgyg4ih7zsqkwdon34jqkbuz\""
   ]
@@ -251,7 +251,7 @@ resource "desec_rrset" "theorangeonenet_caa" {
   domain  = desec_domain.theorangeonenet.name
   subname = ""
   type    = "CAA"
-  ttl     = 3600
+  ttl     = local.dns_ttl_default
   records = [
     "0 issue \"letsencrypt.org\"",
     "0 wildissue \"letsencrypt.org\"",
diff --git a/terraform/variables.tf b/terraform/variables.tf
index 4c3df98..545aa22 100644
--- a/terraform/variables.tf
+++ b/terraform/variables.tf
@@ -1,3 +1,7 @@
+locals {
+  dns_ttl_default = 60 * 60
+}
+
 variable "linode_personal_access_token" {
   sensitive = true
 }