Yes, it was auth server, which in my case is managed by IPA and that uses TTL for zone - which I wrongly assumed was a "default" for all the records, but no, it's not the case and record's TTL must exists or another "default" is used. thanks, L.