<!DOCTYPE html>
<html>
<head>
<meta charset="utf-8">
<meta http-equiv="Content-Type" content="text/html; charset=utf-8" />
<meta name="viewport" id="viewport" content="width=device-width,minimum-scale=1.0,maximum-scale=10.0,initial-scale=1.0" />
<style>
html { -webkit-text-size-adjust: 100%; -ms-text-size-adjust: 100%; } h1 { font-size: 1.3em; line-height: 1.2; margin: 0; } ul, ol { margin: 0; padding: 0; } ul li, ol li, li li { margin: 0 0 0 36px; } [dir=rtl] li { margin: 0 18px 0 0; } blockquote { border-color: #dfdee1; /* --color--border */ border-style: solid; border-width: 0 0 0 1px; margin: 0; padding: 0 0 0 1em; } [dir=rtl] blockquote, blockquote[dir=rtl] { border-width: 0 1px 0 0; padding: 0 1em 0 0; } pre { font-family: "SFMono-Regular", Consolas, "Liberation Mono", Menlo, Courier, monospace; /* --font-family--mono */ font-size: 0.9em; margin: 0; padding: 1rem; background-color: #f3f1ef; /* --color-bg--surface */ white-space: pre-wrap; word-wrap: break-word; overflow: visible; } .message-content { font-family: -apple-system, BlinkMacSystemFont, Aptos, Roboto, "Segoe UI", Helvetica, Arial, sans-serif, "Apple Color Emoji", "Segoe UI Emoji", "Segoe UI Symbol"; /* --font-family */ line-height: 1.4; } .attachment { display: inline-block; margin: 0; padding: 0; } .attachment__caption { padding: 0; text-align: center; } .attachment__caption a[href] { text-decoration: none; color: #333333; } .attachment--preview { width: 100%; text-align: center; margin: 0.625em 0; } .attachment--preview img { border: 1px solid #dfdee1; /* --color--border */ vertical-align: middle; width: auto; max-width: 100%; max-height: 640px; } .attachment--preview .attachment__caption { color: #716d7b; /* --color-txt--subtle */ font-size: 0.85em; margin-top: 0.625em; } .attachment--file { color: #282138; /* --color-txt */ line-height: 1; margin: 0 2px 2px 0; padding: 0.4em 1em; border: 1px solid #dfdee1; /* --color--border */ border-radius: 5px; } .permalink { color: inherit; } .txt--subtle { color: #716d7b; /* --color-txt--subtle */ } .txt--xx-small { font-size: 14px; } .flush { margin: 0; padding: 0; } .push--bottom { margin-bottom: 8px; } .border--top { border-top: 1px solid #ECE9E6; /* --color-border--solid */ } .btn { padding: 0.2em 0.4em; font-weight: 500; text-decoration: none; border-radius: 3rem; white-space: nowrap; background: #5522FA; /* --color-tertiary */ border-color: #5522FA; color: #ffffff; } .btn--email { display: inline-block; text-align: center; font-weight: 500; font-size: 1em; text-decoration: none; border-radius: 2em; white-space: nowrap; background: #5522FA; /* --color-tertiary */ border-color: #5522FA; color: #ffffff; border-top: 0.3em solid #5522FA; border-left: 1em solid #5522FA; border-bottom: 0.3em solid #5522FA; border-right: 1em solid #5522FA; } .shaded { padding: 1em; border-radius: 4px; background-color: #f6f5f3; /* --color-bg--surface */ border: 1px solid #dfdee1; /* --color--border */ } .shaded--blue { background-color: rgba(80, 162, 255, 0.2); /* --rgb-blue 0.2 */ } .shaded--red { background-color: rgba(255, 120, 120, 0.2); /* --rgb-red 0.2 */ } .strikethrough { text-decoration: line-through; }
</style>
</head>
<body>
<div class="message-content">
<div class="trix-content">
<div>Hey team,<br><br>We run 8 node unbound clusters as recursive resolvers. The setup forwards (using forward-zone) internal queries to a separate PowerDNS authoritative cluster.<br><br>Recently, we've had some connectivity issues to Cloudflare (who provides a lot of external DNS services in our environment). When this has happened, we've seen the requestlist balloon to around 1.5-2k entries as queries repeatedly time out.<br><br>However, the problem is that this affects forward-zones as well. We lose resolution for internal queries when these backup events happen.<br><br>We're looking for suggestions on how to safeguard these internal forwards. We notice stub-zone may be the more appropriate stanza for our use case, but are unsure if that'd bypass this requestlist queuing (?)<br><br>Any thoughts greatly welcome, thank you!<br><br>Our config is fairly simple:<br><br></div><pre>server:
num-threads: 4
# Best performance is a "power of 2 close to the num-threads value"
msg-cache-slabs: 4
rrset-cache-slabs: 4
infra-cache-slabs: 4
key-cache-slabs: 4
# Use 1.125GB of a 4GB node to start, but real usage may be 2.5x this so
# closer to 2.8G/4GB (~70%)
#
msg-cache-size: 384m
# Should be 2x the msg cache
rrset-cache-size: 768m
# We have libevent! Use lots of ports.
outgoing-range: 8192
num-queries-per-thread: 4096
# Use larger socket buffers for busy servers.
so-rcvbuf: 8m
so-sndbuf: 8m
# Turn on port reuse
so-reuseport: yes
# This is needed to forward queries for private PTR records to upstream DNS servers
unblock-lan-zones: yes
forward-zone:
name: "int.domain.tld"
forward-addr: "10.10.5.5"
# No caching in unbound
forward-no-cache: "yes"</pre>
</div>
</div>
</body>
</html>