graham/infra
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

resolvers: tune unbound for performance and reliability

Browse source 
- so-reuseport: yes — kernel hashes UDP across the per-thread sockets
  instead of waking all threads, balancing load and improving headroom
- edns-buffer-size: 1232 — DNS Flag Day 2020 default, avoids IP
  fragmentation (retransmits/TCP fallback)
- serve-expired (RFC 8767) with 1800ms client timeout and 86400s stale
  ttl — fast answers from stale cache during upstream slowness/outages
This commit is contained in:
Graham McIntire 2026-06-07 16:43:33 -05:00
parent 02390adff8
commit 86ae10d963
No known key found for this signature in database
GPG key ID: F4ABF488E6029E59
1 changed files with 16 additions and 3 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

19
ansible/roles/resolvers/templates/unbound.conf.j2
View file

@ -142,7 +142,9 @@ server:
# use SO_REUSEPORT to distribute queries over threads.
# at extreme load it could be better to turn it off to distribute even.
# so-reuseport: yes
# Enabled: lets the kernel hash UDP across per-thread sockets instead of
# waking all threads, balancing load and improving spike headroom.
so-reuseport: yes
# use IP_TRANSPARENT so the interface: addresses can be non-local
# and you can config non-existing IPs that are going to work later on
@ -161,8 +163,10 @@ server:
# EDNS reassembly buffer to advertise to UDP peers (the actual buffer
# is set with msg-buffer-size).
# edns-buffer-size: 1232
edns-buffer-size: 1472
# 1232 is the DNS Flag Day 2020 default: it avoids IP fragmentation
# (fragmented UDP causes retransmits/TCP fallback and frag-based issues)
# at the cost of a marginally higher TCP-fallback rate.
edns-buffer-size: 1232
# Maximum UDP response size (not applied to TCP response).
# Suggested values are 512 to 4096. Default is 1232. 65536 disables it.
@ -746,6 +750,15 @@ server:
# A recommended value is 1800.
# serve-expired-client-timeout: 0
# Serve-stale (RFC 8767): on a cache miss for an expired record, try to
# resolve fresh for up to client-timeout ms, then answer immediately with
# the stale record while refreshing in the background. Gives clients fast
# answers during upstream slowness/outages. serve-expired-ttl caps how long
# (seconds) stale data may be served after expiry.
serve-expired: yes
serve-expired-ttl: 86400
serve-expired-client-timeout: 1800
# Return the original TTL as received from the upstream name server rather
# than the decrementing TTL as stored in the cache. Enabling this feature
# does not impact cache expiry, it only changes the TTL Unbound embeds in