22 Říj
2026
22 Říj
'26
14:35
Hello,
on first sight, the issue doesn't seem so obvious. Could you please
share more information?
1) does incremental validation take place in your case, or full zone
validation? You can see this in the log file, either there is "DNSSEC,
incremental validation successful, checked RRSIGs XY" or the word
"incremental" is missing
2) does the zone use NSEC, NSEC3 or NSEC3 with opt-out? Which DNSSEC
algorithm?
3) any other particular specifics
Thank you!
Libor
On 22. 10. 26 13:52, Daniel Salzman via knot-dns-users wrote:
Hello!
Thank you for the report. We will investigate the cause.
Daniel
On 10/22/26 12:31, SUN Guonian via knot-dns-users wrote:
Hello,
Recently, my hidden master has had two upgrades: one from 3.6.0 to
3.6.1, and another from 3.6.1 to 3.6.2.
I found that the time between "Knot DNS 3.X.Y starting" and "server
started answering" has increased significantly for versions 3.6.1 and
3.6.2.
I have a large DNSSEC-signed zone with about 2,700,000 records, and I
have set |dnssec-validation|to |on|. For versions 3.5.8 and 3.6.0, it
took about 4 minutes to restart; after 3.6.1, it took 47–48 minutes.
Best Regards,
SUN Guonian
--
--