NSEC3 salt change - temporary performance decline
Cathy Almond
cathya at isc.org
Tue Jun 9 12:29:30 UTC 2020
On 29/01/2020 11:50, Klaus Darilion wrote:
> Hello Niels!
>
> Thanks for bringing this to attention. I have reported it before [1][2]
> without response.
>
> We see this regulary. AFAIS it happens actually always, but if the IXFR
> is small, the performance decline is so short that you usually won't
> notice it.
>
> The bigger the zonechange ie NSEC3 change, full resigning ....* the
> longer is the performance decline and you will notice it more often.
>
> *we don't resalt or resign completele - but this is what several of our
> TLD customers do.
>
> I hope it will be fixed soon, we already test other software.
>
> regards
> Klaus
>
>
> [1] https://lists.isc.org/pipermail/bind-users/2018-March/099814.html
> [2] https://lists.isc.org/pipermail/bind-users/2019-March/101579.html
FYI this will be fixed in the June 2020 BIND releases (in 9.11.20,
9.16.4 and 9.17.2):
https://gitlab.isc.org/isc-projects/bind9/-/issues/1834
Cathy
More information about the bind-users
mailing list