Question about recursive client max quota

[Greg Choules]

Hello Pedro.
Firstly, which version of BIND are you running?
Generally, though, increasing `recursive-clients` on a box with a decent amount of power and RAM is not an issue: 50k, or even bigger, should be fine. But please test it first. We have discussed raising the default but we’re not quite ready to make that change in a major release just yet.

Be aware, though, that if the resolver can’t get answers, it will probably SERVFAIL clients and the larger the backlog of clients the longer it will take to get around to responding to them, by which time they are likely to have timed out and be retrying anyway.

I hope that helps.
Greg

> On 8 Nov 2024, at 10:20, Pedro García Segura <pedrogs at gmail.com> wrote:
> 
> Hello,
> 
> Recently we had a Internet outage that lasted for a few hours and quickly filled the recursive clients quota (set at 1000) since most internet-bound recursive queries timed out, and our network is huge.
> 
> This also affected recursive queries to internal authoritative domains, thus interrupting access to critical internal resources which don't have any Internet/SaaS dependencies.
> 
> I'm having a hard time understanding the default recursive max quota being set at 100 by default, since most modern servers now have RAM to spare, and it's a bit scary to think that another Internet outage may happen again and internal critical services may not be able to resolve internal authoritative zones.
> 
> Can anyone give some insight into this issue? Can I just configure a huge number of maximum recursive clientes (say 50k) to "absorb" the intetnet-bound queries that are timing out and be able to respond to client requests for internal authoritative zones?
> 
> I'm probably missing something, so thanks a lot for your understanding!
> 
> Cheers!
> Pedro
> -- 
> Visit https://lists.isc.org/mailman/listinfo/bind-users to unsubscribe from this list
> 
> ISC funds the development of this software with paid support subscriptions. Contact us at https://www.isc.org/contact/ for more information.
> 
> 
> bind-users mailing list
> bind-users at lists.isc.org
> https://lists.isc.org/mailman/listinfo/bind-users