23 Říj
2026
23 Říj
'26
7:06
Note that policy.signing-threads applies to dnssec-validation as well (you must configure
and assign a dnssec-policy),
so it should help you!
However, this doesn't explain your issue, as it hasn't changed.
Can you focus on the server shutdown? I suspect Knot might get stuck during shutdown.
Daniel
On 10/23/26 03:41, SUN Guonian via knot-dns-users wrote:
Daniel,
Since it does not sign the zone, it's a slave of the signature server, I didn't
modify the policy.signing-threads (and adjust-threads).
I notice that the top CPU usage of the knotd process is no more than 100% in this period,
it seems that the validation worker is only one.
Thank you!
Best Regards,
SUN Guonian
在 2026/10/22 21:14, Daniel Salzman via knot-dns-users 写道:
I don't see any regression between 3.6.0 and
3.6.1.
Do you always use the same configuration (especially policy.signing-threads)?
Do you build Knots the same way?
Daniel
On 10/22/26 13:52, Daniel Salzman via knot-dns-users wrote:
> Hello!
>
> Thank you for the report. We will investigate the cause.
>
> Daniel
>
> On 10/22/26 12:31, SUN Guonian via knot-dns-users wrote:
>> Hello,
>>
>> Recently, my hidden master has had two upgrades: one from 3.6.0 to 3.6.1, and
another from 3.6.1 to 3.6.2.
>>
>> I found that the time between "Knot DNS 3.X.Y starting" and
"server started answering" has increased significantly for versions 3.6.1 and
3.6.2.
>>
>> I have a large DNSSEC-signed zone with about 2,700,000 records, and I have set
|dnssec-validation|to |on|. For versions 3.5.8 and 3.6.0, it took about 4 minutes to
restart; after 3.6.1, it took 47–48 minutes.
>>
>> Best Regards,
>>
>> SUN Guonian
>>
--