<html><head><meta http-equiv="Content-Type" content="text/html charset=us-ascii"></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;" class="">Pieter,<div class=""><br class=""></div><div class="">Thanks a lot for the great explanation and all possibilities. </div><div class=""><br class=""></div><div class=""><blockquote type="cite" class="">Do the BIND logs indicate a NOTIFY was received (you might need to bump verbosity)?</blockquote></div><div class="">I will double check again if the BIND slaves acknowledged or received the NOTIFY messages. </div><div class=""><br class=""></div><div class="">I came across this post and was concerned if the high number of NOTIFY/AXFR overloaded PowerDNS, given that we have ~6,000 zones and ~100 BIND slaves. Do you know if there is a built-in limit on the AXFR volume? </div><div class=""><br class=""></div><div class=""><a href="https://mailman.powerdns.com/pipermail/pdns-users/2007-May/016527.html" class="">https://mailman.powerdns.com/pipermail/pdns-users/2007-May/016527.html</a></div><div class=""><br class=""></div><div class=""><blockquote type="cite" class="">If replication-lag is an issue for you and you want to use PowerDNS as<br class="">the non-hidden nameservers, it would make sense to use NATIVE zones[1].</blockquote>make sense and I agree. it is definitely the path we are going forward. It is an intermediate state with AXFR instead of native replication. </div><div class=""><br class=""></div><div class="">Thanks,</div><div class="">Steve</div><div class=""><br class=""><div><blockquote type="cite" class=""><div class="">On Jan 17, 2018, at 10:23 AM, Pieter Lexis <<a href="mailto:pieter.lexis@powerdns.com" class="">pieter.lexis@powerdns.com</a>> wrote:</div><br class="Apple-interchange-newline"><div class=""><div class="">Hi Steve,<br class=""><br class="">On Mon, 15 Jan 2018 14:41:51 +0100<br class="">Steve Zeng <<a href="mailto:steve.zeng@booking.com" class="">steve.zeng@booking.com</a>> wrote:<br class=""><br class=""><blockquote type="cite" class="">we are migrating our DNS master from BIND to PowerDNS. The approach we take is to put PowerDNS in the middle of an current replication chain as below:<br class=""><br class="">BIND DNS master -> PowerDNS -> BIND DNS slaves<br class=""><br class="">It works most of the time. However, from time to time we experienced long delay when making a DNS change. further investigation shows that the delay seems on PowerDNS. we see lots of errors <br class=""><br class="">2018-01-10T18:13:24.728722+01:00 pdns_server1 pdns_server[2250]: Jan 10 18:13:24 Notification for <a href="http://example.com" class="">example.com</a> to ip1:53 failed after retries<br class="">2018-01-10T18:13:24.728848+01:00 pdns_server1 pdns_server[2250]: Jan 10 18:13:24 Notification for <a href="http://example.com" class="">example.com</a> to ip2:53 failed after retries<br class="">2018-01-10T18:13:24.728975+01:00 pdns_server1 pdns_server[2250]: Jan 10 18:13:24 Notification for <a href="http://example.com" class="">example.com</a> to ip3:53 failed after retries<br class=""><br class="">ip1,ip2,ip3 are BIND slaves.<br class=""><br class="">no other errors found with regard to the root cause. it happens occasionally. Questions are:<br class=""></blockquote><br class="">It looks like that, for whatever reason, the BIND-slaves do not<br class="">acknoledge the NOTIFY message multiple times. Or perhaps they are not<br class="">received at all. Do the BIND logs indicate a NOTIFY was received (you<br class="">might need to bump verbosity)?<br class=""><br class="">If they are not received, _something_ on the networkpath between the<br class="">servers loses these messages. If the are received (and acted upon by<br class="">BIND), check if the acknoledgements reach the PowerDNS server.<br class=""><br class=""><blockquote type="cite" class="">1. Is there any rate limit as far as PowerDNS is concerned? before PowerDNS is put in the middle, there is no such delay<br class=""></blockquote><br class="">There is no rate-limiting in PowerDNS.<br class=""><br class=""><blockquote type="cite" class="">2. Is it configurable to set how many retries?<br class=""></blockquote><br class="">This is not configurable.<br class=""><br class=""><blockquote type="cite" class="">Should PowerDNS should ensure the notifications going through rather than drop after a certain times of retry?<br class=""></blockquote><br class="">A lost NOTIFY can mean anything, e.g. server is no longer a nameserver,<br class="">network is broken, server is overloaded. Re-trying (and keeping this<br class="">data indefinetely) would take up too much resources. Slaves will also<br class="">check the SOA serial the master at some point and notice they are out of<br class="">date and initiate an AXFR.<br class=""><br class="">If replication-lag is an issue for you and you want to use PowerDNS as<br class="">the non-hidden nameservers, it would make sense to use NATIVE zones[1].<br class="">These rely on database-replication instead of DNS-based replication of<br class="">the data.<br class=""><br class="">Best regards,<br class=""><br class="">Pieter<br class=""><br class="">1 - <a href="https://doc.powerdns.com/authoritative/modes-of-operation.html#native-replication" class="">https://doc.powerdns.com/authoritative/modes-of-operation.html#native-replication</a><br class=""><br class="">-- <br class="">Pieter Lexis<br class=""><a href="http://PowerDNS.COM" class="">PowerDNS.COM</a> BV -- <a href="https://www.powerdns.com" class="">https://www.powerdns.com</a><br class="">_______________________________________________<br class="">Pdns-users mailing list<br class=""><a href="mailto:Pdns-users@mailman.powerdns.com" class="">Pdns-users@mailman.powerdns.com</a><br class="">https://mailman.powerdns.com/mailman/listinfo/pdns-users<br class=""></div></div></blockquote></div><br class=""></div></body></html>