diff --git a/pulsar-common/src/main/java/org/apache/pulsar/common/util/netty/DnsResolverUtil.java b/pulsar-common/src/main/java/org/apache/pulsar/common/util/netty/DnsResolverUtil.java
index f49a6453c72b33..bcff83acd949f2 100644
--- a/pulsar-common/src/main/java/org/apache/pulsar/common/util/netty/DnsResolverUtil.java
+++ b/pulsar-common/src/main/java/org/apache/pulsar/common/util/netty/DnsResolverUtil.java
@@ -19,12 +19,20 @@
 package org.apache.pulsar.common.util.netty;
 
 import io.netty.resolver.dns.DnsNameResolverBuilder;
-import java.lang.reflect.InvocationTargetException;
-import java.lang.reflect.Method;
+import java.security.Security;
+import java.util.Optional;
 import lombok.extern.slf4j.Slf4j;
 
 @Slf4j
 public class DnsResolverUtil {
+
+    private static final String CACHE_POLICY_PROP = "networkaddress.cache.ttl";
+    private static final String CACHE_POLICY_PROP_FALLBACK = "sun.net.inetaddr.ttl";
+    private static final String NEGATIVE_CACHE_POLICY_PROP = "networkaddress.cache.negative.ttl";
+    private static final String NEGATIVE_CACHE_POLICY_PROP_FALLBACK = "sun.net.inetaddr.negative.ttl";
+    /* default ttl value from sun.net.InetAddressCachePolicy.DEFAULT_POSITIVE， which is used when no security manager
+     is used */
+    private static final int JDK_DEFAULT_TTL = 30;
     private static final int MIN_TTL = 0;
     private static final int TTL;
     private static final int NEGATIVE_TTL;
@@ -39,19 +47,35 @@ public class DnsResolverUtil {
         int ttl = DEFAULT_TTL;
         int negativeTtl = DEFAULT_NEGATIVE_TTL;
         try {
-            // use reflection to call sun.net.InetAddressCachePolicy's get and getNegative methods for getting
-            // effective JDK settings for DNS caching
-            Class<?> inetAddressCachePolicyClass = Class.forName("sun.net.InetAddressCachePolicy");
-            Method getTTLMethod = inetAddressCachePolicyClass.getMethod("get");
-            ttl = (Integer) getTTLMethod.invoke(null);
-            Method getNegativeTTLMethod = inetAddressCachePolicyClass.getMethod("getNegative");
-            negativeTtl = (Integer) getNegativeTTLMethod.invoke(null);
-        } catch (NoSuchMethodException | ClassNotFoundException | InvocationTargetException
-                 | IllegalAccessException e) {
-            log.warn("Cannot get DNS TTL settings from sun.net.InetAddressCachePolicy class", e);
+            String ttlStr = Security.getProperty(CACHE_POLICY_PROP);
+            if (ttlStr == null) {
+                // Compatible with sun.net.inetaddr.ttl settings
+                ttlStr = System.getProperty(CACHE_POLICY_PROP_FALLBACK);
+            }
+            String negativeTtlStr = Security.getProperty(NEGATIVE_CACHE_POLICY_PROP);
+            if (negativeTtlStr == null) {
+                // Compatible with sun.net.inetaddr.negative.ttl settings
+                negativeTtlStr = System.getProperty(NEGATIVE_CACHE_POLICY_PROP_FALLBACK);
+            }
+            ttl = Optional.ofNullable(ttlStr)
+                    .map(Integer::decode)
+                    .filter(i -> i > 0)
+                    .orElseGet(() -> {
+                        if (System.getSecurityManager() == null) {
+                            return JDK_DEFAULT_TTL;
+                        }
+                        return DEFAULT_TTL;
+                    });
+
+            negativeTtl = Optional.ofNullable(negativeTtlStr)
+                    .map(Integer::decode)
+                    .filter(i -> i >= 0)
+                    .orElse(DEFAULT_NEGATIVE_TTL);
+        } catch (NumberFormatException e) {
+            log.warn("Cannot get DNS TTL settings", e);
         }
-        TTL = ttl <= 0 ? DEFAULT_TTL : ttl;
-        NEGATIVE_TTL = negativeTtl < 0 ? DEFAULT_NEGATIVE_TTL : negativeTtl;
+        TTL = ttl;
+        NEGATIVE_TTL = negativeTtl;
     }
 
     private DnsResolverUtil() {
diff --git a/pulsar-common/src/test/java/org/apache/pulsar/common/util/netty/DnsResolverTest.java b/pulsar-common/src/test/java/org/apache/pulsar/common/util/netty/DnsResolverTest.java
index 0ccb960e798877..46599cc45a0904 100644
--- a/pulsar-common/src/test/java/org/apache/pulsar/common/util/netty/DnsResolverTest.java
+++ b/pulsar-common/src/test/java/org/apache/pulsar/common/util/netty/DnsResolverTest.java
@@ -18,13 +18,57 @@
  */
 package org.apache.pulsar.common.util.netty;
 
+import static org.mockito.Mockito.mock;
+import static org.mockito.Mockito.verify;
+import static org.testng.Assert.assertEquals;
 import io.netty.channel.EventLoop;
 import io.netty.resolver.dns.DnsNameResolverBuilder;
+import java.security.Security;
+import org.mockito.ArgumentCaptor;
 import org.mockito.Mockito;
 import org.testng.Assert;
+import org.testng.annotations.AfterClass;
+import org.testng.annotations.BeforeClass;
 import org.testng.annotations.Test;
 
 public class DnsResolverTest {
+    private static final int MIN_TTL = 0;
+    private static final int TTL = 101;
+    private static final int NEGATIVE_TTL = 121;
+    private static final String CACHE_POLICY_PROP = "networkaddress.cache.ttl";
+    private static final String NEGATIVE_CACHE_POLICY_PROP = "networkaddress.cache.negative.ttl";
+
+    private String originalCachePolicy;
+    private String originalNegativeCachePolicy;
+
+    @BeforeClass(alwaysRun = true)
+    public void beforeClass() {
+        originalCachePolicy = Security.getProperty(CACHE_POLICY_PROP);
+        originalNegativeCachePolicy = Security.getProperty(NEGATIVE_CACHE_POLICY_PROP);
+        Security.setProperty(CACHE_POLICY_PROP, Integer.toString(TTL));
+        Security.setProperty(NEGATIVE_CACHE_POLICY_PROP, Integer.toString(NEGATIVE_TTL));
+    }
+
+    @AfterClass(alwaysRun = true)
+    public void afterClass() {
+        Security.setProperty(CACHE_POLICY_PROP, originalCachePolicy != null ? originalCachePolicy : "-1");
+        Security.setProperty(NEGATIVE_CACHE_POLICY_PROP,
+                originalNegativeCachePolicy != null ? originalNegativeCachePolicy : "0");
+    }
+
+    @Test
+    public void testTTl() {
+        final DnsNameResolverBuilder builder = mock(DnsNameResolverBuilder.class);
+        ArgumentCaptor<Integer> minTtlCaptor = ArgumentCaptor.forClass(Integer.class);
+        ArgumentCaptor<Integer> maxTtlCaptor = ArgumentCaptor.forClass(Integer.class);
+        ArgumentCaptor<Integer> negativeTtlCaptor = ArgumentCaptor.forClass(Integer.class);
+        DnsResolverUtil.applyJdkDnsCacheSettings(builder);
+        verify(builder).ttl(minTtlCaptor.capture(), maxTtlCaptor.capture());
+        verify(builder).negativeTtl(negativeTtlCaptor.capture());
+        assertEquals(minTtlCaptor.getValue(), MIN_TTL);
+        assertEquals(maxTtlCaptor.getValue(), TTL);
+        assertEquals(negativeTtlCaptor.getValue(), NEGATIVE_TTL);
+    }
 
     @Test
     public void testMaxTtl() {