diff --git a/scripts/prepare-zones.sh b/scripts/prepare-zones.sh
index ddb2b62..7860871 100755
--- a/scripts/prepare-zones.sh
+++ b/scripts/prepare-zones.sh
@@ -76,10 +76,14 @@ for src in "$SRC_DIR"/*.zone; do
     echo "\$TTL 3600"
     echo "@ 3600 IN SOA ns1.he.net. ${ADMIN_EMAIL}.${zone}. ("
     echo "    ${SERIAL}  ; serial — bump per change (SERIAL=YYYYMMDDNN make prep)"
-    echo "    3600        ; refresh (1 hour)"
-    echo "    1800        ; retry   (30 minutes)"
+    echo "    300         ; refresh (5 min) — slaves poll us this often;"
+    echo "                ;   tightened from 3600 to nudge HE's internal"
+    echo "                ;   puller→anycast replication"
+    echo "    120         ; retry   (2 min) — kept < refresh per RFC 1912"
     echo "    604800      ; expire  (1 week)"
-    echo "    300         ; minimum (5 minutes)"
+    echo "    60          ; minimum (1 min) — negative-cache TTL on public"
+    echo "                ;   resolvers; shrinks the window when an old"
+    echo "                ;   NXDOMAIN keeps showing after we add a name"
     echo "    )"
     echo ""
     # Inject HE nameservers as the authoritative NS set.