nsd icon indicating copy to clipboard operation
nsd copied to clipboard

No graceful recovery for expired zones

Open anandb-ripencc opened this issue 2 years ago • 0 comments

Our NSD servers are configured as secondary for 75.139.in-addr.arpa. At one point its serial was 2021122001. Then the operator messed up, and lowered the serial to 2021102901. As expected, NSD kept rejecting XFRs with this error:

info: xfrd: zone 75.139.in-addr.arpa. ignoring old serial (2021122001/2021102901) from XXX

Eventually, the zone expired:

error: xfrd: zone 75.139.in-addr.arpa. has expired

Now, NSD isn't serving this zone. However, it is holding on to the last known copy of the zone, and still ignoring the XFRs for it. The nsd-xfr-PID directory contains a file xfr.NNNN, and this file isn't being removed or processed. I know I can fix this manually with nsd-control force_transfer 75.139.in-addr.arpa.

However, IMHO, this is a situation that NSD should rectify itself. When a zone expires, it should discard the zone, and AXFR it in. Other name servers do exactly this, and allow for graceful recovery, whereas with NSD, it requires manual intervention.

anandb-ripencc avatar Apr 06 '22 11:04 anandb-ripencc