<!DOCTYPE html><html><head><title></title></head><body><div>Thanks for the response. I came to this conclusion earlier today, and came to this exact same conclusion. It's now backed off to 30 seconds, and seems to be much better behaved.</div><div><br></div><div>My concern is that this could also be experienced if we were using public resolvers configured as forwarders, such as 1.1.1.1. Especially if you are doing a lot of reverse lookups (this was the main source of issues for us)</div><div><br></div><div>But thank you for the suggestion. It's good to know I was reasoning along the correct lines.</div><div><br></div><div>Kind regards,</div><div>Graeme</div><div><br></div><div><br></div><div>On Tue, Oct 21, 2025, at 8:16 PM, Yorgos Thessalonikefs via Unbound-users wrote:</div><blockquote type="cite" id="qt" style=""><div>Hi Graeme,</div><div><br></div><div>I understand that in this case you forward all Core outbound traffic to </div><div>the Edge Forwarder.</div><div><br></div><div>Since you know your network (between core and edge), there is little </div><div>value for Unbound tracking response behaviour and adopting to the </div><div>network environment.</div><div><br></div><div>You could try bringing 'infra-host-ttl' down from the default 900 </div><div>seconds. Maybe even to a couple of seconds for your case.</div><div><br></div><div>Best regards,</div><div>-- Yorgos</div><div><br></div><div>On 21/10/2025 01:08, Graeme Lee via Unbound-users wrote:</div><div>> I have a weird problem with timeouts blocking upstream forwarders when </div><div>> there are excessive timeouts on lookups.</div><div>> </div><div>> Here's a quick outline of the setup:</div><div>> </div><div>> Core DNS (Unbound) -> Edge Forwarder DNS (Unbound) -> Internet</div><div>> </div><div>> When a request originates from the core to the internet (eg for </div><div>> zone . ), if the destination DNS server is unresponsive for whatever </div><div>> reason, the Core DNS times out BEFORE the edge forwarder. This </div><div>> increases the eto timeout, and eventually, under enough load and </div><div>> unresponsiveness from the offending off-network DNS, the egde forwarder </div><div>> is blocked, even though there is actually no problem with it. And no </div><div>> DNS stops the network.</div><div>> </div><div>> The forwarding zone is . so it will still eventually time out. </div><div>> Adjusting infra-cache-min-rtt and max-rtt seems only to delay the onset </div><div>> of this issue.</div><div>> </div><div>> Any clues to prevent forwarders from ever being blocked (or even moving </div><div>> into 'probing') would be greatly appreciated.</div><div>> </div><div>> Kind regards,</div><div>> Graeme</div><div>> </div><div><br></div></blockquote><div><br></div></body></html>