Re: Sporadic but noticable SERVFAILs in specific nodes of an anycast resolving farm running BIND

2014-03-08 Thread Kostas Zorbadelos
Hello, an update with the findings so far: - IPv6 config on the servers was an issue so we removed it and will test further later. There is a hint pointed from various people about a Linux kernel issue and setting (net.ipv6.route.max_size), see https://lists.dns-oarc.net/pipermail/dns-ope

Re: Sporadic but noticable SERVFAILs in specific nodes of an anycast resolving farm running BIND

2014-03-08 Thread LuKreme
On 08 Mar 2014, at 12:52 , Kostas Zorbadelos wrote: > One mitigation approach is to blackhole the domains using local zones. That’s not much of a mitigation. Not having open resolvers would be mitigation. -- Eyes the shady night has shut/Cannot see the record cut And silence sounds no worse t

Re: Sporadic but noticable SERVFAILs in specific nodes of an anycast resolving farm running BIND

2014-03-08 Thread sthaug
> > One mitigation approach is to blackhole the domains using local zones. > > That?s not much of a mitigation. Not having open resolvers would be > mitigation. Not having open resolvers is good - but unfortunately doesn't help against misbehaving clients (e.g. small home routers with DNS proxie