Required Server For 3 Second DNS Rebinding

I would like to understand the exact requirements and conditions for the MA (Multiple Answers) DNS rebinding strategy to successfully complete a rebinding attack within approximately 3 seconds.

Specifically, what assumptions need to hold (browser caching, TTL behavior, resolver behavior, number of queries, etc.) for the MA strategy to reliably achieve a rebinding window of around 3 seconds?