Seventeen Seconds Left

The authoritative zone publishes the CNAME with a TTL of 300 and the target A record with a TTL of 60. Querying a large recursive resolver right now returns:

$ dig +noall +answer app.example.com

app.example.com.      42   IN  CNAME  app-lb.example.net.
app-lb.example.net.   17   IN  A      203.0.113.9

You change the A record at the authority to a new address. For how much longer can this resolver still hand out 203.0.113.9?

A

Up to 60 seconds, the authoritative A TTL, measured from the moment you make the change

B

About 17 seconds, the remaining TTL on the cached A record

C

About 42 seconds, because the CNAME's remaining TTL governs the whole chain

D

Up to 300 seconds, the authoritative CNAME TTL