From 86ae10d9635dd1eb322a8b96f7af1f8aee3bf811 Mon Sep 17 00:00:00 2001 From: Graham McIntire Date: Sun, 7 Jun 2026 16:43:33 -0500 Subject: [PATCH] resolvers: tune unbound for performance and reliability MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit - so-reuseport: yes — kernel hashes UDP across the per-thread sockets instead of waking all threads, balancing load and improving headroom - edns-buffer-size: 1232 — DNS Flag Day 2020 default, avoids IP fragmentation (retransmits/TCP fallback) - serve-expired (RFC 8767) with 1800ms client timeout and 86400s stale ttl — fast answers from stale cache during upstream slowness/outages --- .../roles/resolvers/templates/unbound.conf.j2 | 19 ++++++++++++++++--- 1 file changed, 16 insertions(+), 3 deletions(-) diff --git a/ansible/roles/resolvers/templates/unbound.conf.j2 b/ansible/roles/resolvers/templates/unbound.conf.j2 index fc701d0..f58f245 100644 --- a/ansible/roles/resolvers/templates/unbound.conf.j2 +++ b/ansible/roles/resolvers/templates/unbound.conf.j2 @@ -142,7 +142,9 @@ server: # use SO_REUSEPORT to distribute queries over threads. # at extreme load it could be better to turn it off to distribute even. - # so-reuseport: yes + # Enabled: lets the kernel hash UDP across per-thread sockets instead of + # waking all threads, balancing load and improving spike headroom. + so-reuseport: yes # use IP_TRANSPARENT so the interface: addresses can be non-local # and you can config non-existing IPs that are going to work later on @@ -161,8 +163,10 @@ server: # EDNS reassembly buffer to advertise to UDP peers (the actual buffer # is set with msg-buffer-size). - # edns-buffer-size: 1232 - edns-buffer-size: 1472 + # 1232 is the DNS Flag Day 2020 default: it avoids IP fragmentation + # (fragmented UDP causes retransmits/TCP fallback and frag-based issues) + # at the cost of a marginally higher TCP-fallback rate. + edns-buffer-size: 1232 # Maximum UDP response size (not applied to TCP response). # Suggested values are 512 to 4096. Default is 1232. 65536 disables it. @@ -746,6 +750,15 @@ server: # A recommended value is 1800. # serve-expired-client-timeout: 0 + # Serve-stale (RFC 8767): on a cache miss for an expired record, try to + # resolve fresh for up to client-timeout ms, then answer immediately with + # the stale record while refreshing in the background. Gives clients fast + # answers during upstream slowness/outages. serve-expired-ttl caps how long + # (seconds) stale data may be served after expiry. + serve-expired: yes + serve-expired-ttl: 86400 + serve-expired-client-timeout: 1800 + # Return the original TTL as received from the upstream name server rather # than the decrementing TTL as stored in the cache. Enabling this feature # does not impact cache expiry, it only changes the TTL Unbound embeds in