23 Říj
2026
23 Říj
'26
3:28
Hello,
The answers are:
1) incremental validation.
2) NSEC3, ecdsap256sha256 (algorithm 13).
3) It does not sign zones, just validate zones. It's a slave of the
signature server. For this large zone, I enlarge the |journal-max-usage|
to |8G|.
Thank you!
Best Regards,
SUN Guonian
在 2026/10/22 20:35, Libor Peltan via knot-dns-users 写道:
Hello,
on first sight, the issue doesn't seem so obvious. Could you please
share more information?
1) does incremental validation take place in your case, or full zone
validation? You can see this in the log file, either there is "DNSSEC,
incremental validation successful, checked RRSIGs XY" or the word
"incremental" is missing
2) does the zone use NSEC, NSEC3 or NSEC3 with opt-out? Which DNSSEC
algorithm?
3) any other particular specifics
Thank you!
Libor
On 22. 10. 26 13:52, Daniel Salzman via knot-dns-users wrote:
--
运维部 孙国念（电话：13501330206 QQ/微信：17355924）
===================================================
互联网域名系统北京市工程研究中心有限公司（ZDNS.CN）
北京市朝阳区望京东园四区7号楼绿地中心B座21层
【使命】让网络根基更安全、更高效、更智能
【愿景】成为互联网关键基础资源服务领域的全球领先者
===================================================
Hello!
Thank you for the report. We will investigate the cause.
Daniel
On 10/22/26 12:31, SUN Guonian via knot-dns-users wrote:
-- Hello,
Recently, my hidden master has had two upgrades: one from 3.6.0 to
3.6.1, and another from 3.6.1 to 3.6.2.
I found that the time between "Knot DNS 3.X.Y starting" and "server
started answering" has increased significantly for versions 3.6.1
and 3.6.2.
I have a large DNSSEC-signed zone with about 2,700,000 records, and
I have set |dnssec-validation|to |on|. For versions 3.5.8 and 3.6.0,
it took about 4 minutes to restart; after 3.6.1, it took 47–48 minutes.
Best Regards,
SUN Guonian
--
--