> If you set your DNS TTL to a relatively-low 1 minute (as in the POC), that's 31.9 years for an exhaustive search.

Right, but that assumes a new DNS record is created each time. An attacker might simply have records for the entire 127.0.0.0/8 range and would iterate over them.

It would still take a long time to make an exhaustive search, but it will be faster than waiting for a 1 minute TTL between each try.