Here's our standard EXOS time config (must set DNS if using hostname for SNTP server). Also, if you have a firewall that's providing GeoIP filtering, keep the time servers limited to the geographies you trust. In my example, we're only using US-based time sources:
config timezone name EST -300 autodst
config dns-client add name-server 8.8.8.8 vr VR-Default
config dns-client add name-server 8.8.4.4 vr VR-Default
config sntp-client primary us.pool.ntp.org vr VR-Default
enable sntp-client