Per the FDCPA, they have an unlimited time to respond to the DV. But they cannot collect during that period. Some of the DV letters in here are legally incorrect, but they serve the purpose in intimidating a CA to either validate or delete. There's a second DV letter floating in here (often called the 15 day or DV#2) that seems more menacing and some have reported success after sending that around 30 days after the first. Again, disagree with the content, but if it works.....