23 Říj
2026
23 Říj
'26
11:14
Hello,
thank you for the info. However, we were still not able to see such
issue. Could you please clarify more?
ad 1) in fact, I haven't seen a setup where "incremental validation"
takes place at server startup, before "server started answering". Are
you sure?
4) could you please provide some log snippet from the server starting,
highlighting the affected zone?
5) could you also provide the zone-relevant configuration, such as
zonefile-load, zonefile-sync, journal-content ?
6) if we don't succeed to replicate your setup and your issue, would you
be willing to self-investigate the validation speed, using some profiler?
Thank you,
Libor
On 23. 10. 26 3:28, SUN Guonian via knot-dns-users wrote:
Hello,
The answers are:
1) incremental validation.
2) NSEC3, ecdsap256sha256 (algorithm 13).
3) It does not sign zones, just validate zones. It's a slave of the
signature server. For this large zone, I enlarge the
|journal-max-usage| to |8G|.
Thank you!
Best Regards,
SUN Guonian
在 2026/10/22 20:35, Libor Peltan via knot-dns-users 写道:
Hello,
on first sight, the issue doesn't seem so obvious. Could you please
share more information?
1) does incremental validation take place in your case, or full zone
validation? You can see this in the log file, either there is
"DNSSEC, incremental validation successful, checked RRSIGs XY" or the
word "incremental" is missing
2) does the zone use NSEC, NSEC3 or NSEC3 with opt-out? Which DNSSEC
algorithm?
3) any other particular specifics
Thank you!
Libor
On 22. 10. 26 13:52, Daniel Salzman via knot-dns-users wrote:
Hello!
Thank you for the report. We will investigate the cause.
Daniel
On 10/22/26 12:31, SUN Guonian via knot-dns-users wrote:
-- Hello,
Recently, my hidden master has had two upgrades: one from 3.6.0 to
3.6.1, and another from 3.6.1 to 3.6.2.
I found that the time between "Knot DNS 3.X.Y starting" and "server
started answering" has increased significantly for versions 3.6.1
and 3.6.2.
I have a large DNSSEC-signed zone with about 2,700,000 records, and
I have set |dnssec-validation|to |on|. For versions 3.5.8 and
3.6.0, it took about 4 minutes to restart; after 3.6.1, it took
47–48 minutes.
Best Regards,
SUN Guonian
--
--