NSEC3 salt change - temporary performance decline

[Cathy Almond]

On 29/01/2020 11:50, Klaus Darilion wrote:
> Hello Niels!
> 
> Thanks for bringing this to attention. I have reported it before [1][2]
> without response.
> 
> We see this regulary. AFAIS it happens actually always, but if the IXFR
> is small, the performance decline is so short that you usually won't
> notice it.
> 
> The bigger the zonechange ie NSEC3 change, full resigning ....* the
> longer is the performance decline and you will notice it more often.
> 
> *we don't resalt or resign completele - but this is what several of our
> TLD customers do.
> 
> I hope it will be fixed soon, we already test other software.
> 
> regards
> Klaus
> 
> 
> [1] https://lists.isc.org/pipermail/bind-users/2018-March/099814.html
> [2] https://lists.isc.org/pipermail/bind-users/2019-March/101579.html

FYI this will be fixed in the June 2020 BIND releases (in 9.11.20,
9.16.4 and 9.17.2):

https://gitlab.isc.org/isc-projects/bind9/-/issues/1834

Cathy