From b97004be30ecf69cc4e26bd72212f6259e05f4c8 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Ond=C5=99ej=20Sur=C3=BD?= Date: Mon, 28 Oct 2019 15:04:38 -0500 Subject: [PATCH] Disable NSEC Aggressive Cache (synth-from-dnssec) by default It was found that NSEC Aggressive Caching has a significant performance impact on BIND 9 when used as recursor. This commit disables the synth-from-dnssec configuration option by default to provide immediate remedy for people running BIND 9.12+. The NSEC Aggressive Cache will be enabled again after a proper fix will be prepared. (cherry picked from commit a20c42dca68737ca341bd24fff403cf5c7940aa1) --- bin/named/config.c | 2 +- doc/arm/Bv9ARM-book.xml | 4 +++- 2 files changed, 4 insertions(+), 2 deletions(-) diff --git a/bin/named/config.c b/bin/named/config.c index 706d4181d8..55b1e2dded 100644 --- a/bin/named/config.c +++ b/bin/named/config.c @@ -197,7 +197,7 @@ options {\n\ # sortlist \n\ stale-answer-enable false;\n\ stale-answer-ttl 1; /* 1 second */\n\ - synth-from-dnssec yes;\n\ + synth-from-dnssec no;\n\ # topology \n\ transfer-format many-answers;\n\ v6-bias 50;\n\ diff --git a/doc/arm/Bv9ARM-book.xml b/doc/arm/Bv9ARM-book.xml index 1009d20354..46b96ad4b7 100644 --- a/doc/arm/Bv9ARM-book.xml +++ b/doc/arm/Bv9ARM-book.xml @@ -6812,7 +6812,9 @@ options { Synthesize answers from cached NSEC, NSEC3 and other RRsets that have been proved to be correct - using DNSSEC. The default is yes. + using DNSSEC. The default is no, + but it will become yes again + in the future releases. Note: