<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1">
<style type="text/css" style="display:none;"> P {margin-top:0;margin-bottom:0;} </style>
</head>
<body dir="ltr">
<div class="elementToProof" style="font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 11pt; color: rgb(0, 0, 0);">
Hi all,</div>
<div class="elementToProof" style="font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 11pt; color: rgb(0, 0, 0);">
<br>
</div>
<div class="elementToProof" style="font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 11pt; color: rgb(0, 0, 0);">
We are having issues with the way that QNAME minimization works and would like to know if there is a way to improve our process to resolve the issue.</div>
<div class="elementToProof" style="font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 11pt; color: rgb(0, 0, 0);">
<br>
</div>
<div class="elementToProof" style="font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 11pt; color: rgb(0, 0, 0);">
Backend: postgresql DB</div>
<div class="elementToProof" style="font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 11pt; color: rgb(0, 0, 0);">
Frontend: authoritative server</div>
<div class="elementToProof" style="font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 11pt; color: rgb(0, 0, 0);">
DNSSEC Enabled with NSEC3 Narrow (1 0 50 -)</div>
<div class="elementToProof" style="font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 11pt; color: rgb(0, 0, 0);">
<br>
</div>
<div class="elementToProof" style="font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 11pt; color: rgb(0, 0, 0);">
Zone file contains 60k TXT records in the form (zone replaced with the.domain.com):<br>
<br>
a.b.c.the.domain.com TXT "a.b.c text record"<br>
b.b.c.the.domain.com TXT "b.b.c text record"<br>
c.b.c.the.domain.com TXT "c.b.c text record"</div>
<div class="elementToProof" style="font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 11pt; color: rgb(0, 0, 0);">
d.e.f.the.domain.com TXT "d.e.f text record"<br>
...<br>
<br>
We use pdnsutil to upload the zone file, increase serial and rectify:<br>
<br>
pdnsutil load-zone the.domain.com the.domain.com.zone<br>
pdnsutil increase-serial the.domain.com<br>
pdnsutil rectify-zone the.domain.com<br>
<br>
Because of the large number of records, this process can take about 10 minutes from beginning to end.<br>
<br>
With QNAME minimization, we are going to ask for the A record for c.the.domain.com as part of the chain of queries from the resolver. Starting at 1 minute after the load-zone command we start getting a NXDOMAIN rather than a NOERROR as expected. We have a
60 second cache so this seems likely to start the moment the zone file is loaded. The NXDOMAIN continues until about 1 minute after rectify-zone is completed and then clears until the zone is loaded again.<br>
<br>
Is there any way to improve the way this process is managed to prevent the NXDOMAIN responses completely? It seems like even in the case of a smaller zone with less records the potential to get a NXDOMAIN for a non-cached entry could occur between the load-zone
and rectify-zone (although obviously the window would be smaller).</div>
<div class="elementToProof" style="font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 11pt; color: rgb(0, 0, 0);">
<br>
</div>
<div class="elementToProof" style="font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 11pt; color: rgb(0, 0, 0);">
Thanks for your input!</div>
<div class="elementToProof" style="font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 11pt; color: rgb(0, 0, 0);">
<br>
</div>
<div class="elementToProof" style="font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 11pt; color: rgb(0, 0, 0);">
Jason Tremblett</div>
</body>
</html>