<html><head>
<meta content="text/html; charset=UTF-8" http-equiv="Content-Type">
</head><body bgcolor="#FFFFFF" text="#000000"><br>
<br>
<blockquote style="border: 0px none;"
cite="mid:9A859FE3-5660-453A-8985-FA8AA3318BD3@conundrum.com"
type="cite">
<div style="margin:30px 25px 10px 25px;" class="__pbConvHr"><div
style="display:table;width:100%;border-top:1px solid
#EDEEF0;padding-top:5px"> <div
style="display:table-cell;vertical-align:middle;padding-right:6px;"><img
photoaddress="matt@conundrum.com" photoname="Matthew Pounsett"
src="cid:part1.08020105.05080305@redbarn.org"
name="compose-unknown-contact.jpg" height="25px" width="25px"></div> <div
style="display:table-cell;white-space:nowrap;vertical-align:middle;width:100%">
<a moz-do-not-send="true" href="mailto:matt@conundrum.com"
style="color:#737F92
!important;padding-right:6px;font-weight:bold;text-decoration:none
!important;">Matthew Pounsett</a></div> <div
style="display:table-cell;white-space:nowrap;vertical-align:middle;">
<font color="#9FA2A5"><span style="padding-left:6px">Tuesday, February
10, 2015 6:26 AM</span></font></div></div></div>
<div style="color:#888888;margin-left:24px;margin-right:24px;"
__pbrmquotes="true" class="__pbConvBody"><div><!----><br>This is
Response Rate Limiting in action… they’re not explicitly limiting
NXDOMAIN responses; they’re limiting identical responses. If Bert’s
server was asking for the same A record over and over that would get
truncated and forced over to TCP as well. It’s probably not only F,
although I don’t think I’ve seen a comprehensive list of which root
instances are running RRL.<br>
</div></div>
</blockquote>
<br>
nxdomain's are grouped together by DNS RRL according to SOA, so, for all
unrecognized TLD's, there's one DNS RRL bucket for nxdomains for each
IPv4 /24 and each IPv6 /48.<br>
<br>
as i wrote up-thread, i think 25/sec would be a better threshold for
nxdomains on a root server running DNS RRL.<br>
<br>
to all: this is not a bug; see <a class="moz-txt-link-freetext" href="http://www.redbarn.org/dns/ratelimits">http://www.redbarn.org/dns/ratelimits</a>,
and stop worrying about whether this "bug" means you should search for a
way to add root zone content to your RDNS as a way to avoid rate
limiting. rather, please throw your support behind query minimization,
in which case, nonexistent TLD's would be cacheable in each RDNS (in
negative form) and would prevent you from needing to forward other
queries under those nonexistent TLD's to a root name server (the
oft-called "random subdomain attack").<br>
<br>
there are good reasons to add autonomous local root name servers to your
host or network. but this is not one of those reasons. again, this is
not a bug, just a tuning matter.<br>
<br>
<div class="moz-signature">-- <br>Paul Vixie<br>
</div>
</body></html>