[knot-dns-users] Re: Too long validation time for new version

Note that policy.signing-threads applies to dnssec-validation as well (you must configure and assign a dnssec-policy), so it should help you! However, this doesn't explain your issue, as it hasn't changed. Can you focus on the server shutdown? I suspect Knot might get stuck during shutdown. Daniel On 10/23/26 03:41, SUN Guonian via knot-dns-users wrote: > Daniel, > > Since it does not sign the zone, it's a slave of the signature > server, I didn't modify the policy.signing-threads (and adjust-threads). > > I notice that the top CPU usage of the knotd process is no more than > 100% in this period, it seems that the validation worker is only one. > > Thank you! > > > Best Regards, > > SUN Guonian > > 在 2026/10/22 21:14, Daniel Salzman via knot-dns-users 写道: >> I don't see any regression between 3.6.0 and 3.6.1. >> Do you always use the same configuration (especially >> policy.signing-threads)? >> Do you build Knots the same way? >> >> Daniel >> >> On 10/22/26 13:52, Daniel Salzman via knot-dns-users wrote: >>> Hello! >>> >>> Thank you for the report. We will investigate the cause. >>> >>> Daniel >>> >>> On 10/22/26 12:31, SUN Guonian via knot-dns-users wrote: >>>> Hello, >>>> >>>> Recently, my hidden master has had two upgrades: one from 3.6.0 to >>>> 3.6.1, and another from 3.6.1 to 3.6.2. >>>> >>>> I found that the time between "Knot DNS 3.X.Y starting" and >>>> "server started answering" has increased significantly for >>>> versions 3.6.1 and 3.6.2. >>>> >>>> I have a large DNSSEC-signed zone with about 2,700,000 records, >>>> and I have set |dnssec-validation|to |on|. For versions 3.5.8 and >>>> 3.6.0, it took about 4 minutes to restart; after 3.6.1, it took >>>> 47–48 minutes. >>>> >>>> Best Regards, >>>> >>>> SUN Guonian