• Re: NSEC3 salt change - temporary performance decline

    From Cathy Almond@cathya@isc.org to bind-users on Tue Jun 9 13:29:30 2020
    From Newsgroup: comp.protocols.dns.bind

    On 29/01/2020 11:50, Klaus Darilion wrote:
    Hello Niels!

    Thanks for bringing this to attention. I have reported it before [1][2] without response.

    We see this regulary. AFAIS it happens actually always, but if the IXFR
    is small, the performance decline is so short that you usually won't
    notice it.

    The bigger the zonechange ie NSEC3 change, full resigning ....* the
    longer is the performance decline and you will notice it more often.

    *we don't resalt or resign completele - but this is what several of our
    TLD customers do.

    I hope it will be fixed soon, we already test other software.

    regards
    Klaus


    [1] https://lists.isc.org/pipermail/bind-users/2018-March/099814.html
    [2] https://lists.isc.org/pipermail/bind-users/2019-March/101579.html

    FYI this will be fixed in the June 2020 BIND releases (in 9.11.20,
    9.16.4 and 9.17.2):

    https://gitlab.isc.org/isc-projects/bind9/-/issues/1834

    Cathy
    --- Synchronet 3.18a-Linux NewsLink 1.113