NSEC3 salt change - temporary performance decline

[Niels Haarbo]

Hello BIND users

Our DNSSEC signer changes NSEC3 salt every 30 days. The signer resigns all the relevant records and the zone is transferred using IXFR to the authoritative servers (6 nodes).

Two of the 6 authoritative servers (BIND 9.11.13 and 9.11.14) are affected by a performance decline shortly after the change of salt. This has happened after the last 3 changes of salt and the period of performance decline is within 30 - 90 minutes. Most queries are dropped by the affected nodes during the period. The normal rate is between 1.000 and 1.500 queries/second.

Other nodes running NSD and Knot are not affected.

What could be the reason for the performance decline?

Best regards

Niels Haarbo
DK Hostmaster A/S
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.isc.org/pipermail/bind-users/attachments/20200121/3b7237d0/attachment.htm>