[tialaramex]

> They wouldn't be able to immediately route any TLD anywhere they'd like

It seems to me that this can only be true if it's also impossible for the legitimate owner to change this. If it can be changed, then the 51% attacker can change it.

The actual DNS contains names with hugely long cache lifetimes and very little practical agility, and it also contains "fast flux" names whose RRs change constantly. If this experiment is only interested in the former it should highlight that, as a shortcoming.

[dboreham]

I don't think anyone has a short TTL for a record in the root zone.

[tialaramex]

24 hours seems to be common for the TLDs I looked at. That seems fairly short compared to this idea that a 51% attacker would need sustained capability to do real damage.