2

In my DNS server's named.conf I see

    rate-limit {
            responses-per-second 5;
            window 5;
    };

What does this actually mean? And can it cause DNS clients problems? Is this too tight a configuration?

2

This enables limiting the number of identical answers your name server sends in reply to queries from the same network range.

The span of this network range and many other variables can also be set inside the rate-limit section in your named.conf.

RESPONSES-PER-SECOND: This is the maximum number of times that a requestor will be told the same answer within a one-second interval. Note that many possible questions can yield the same answer -- for example, many nonexistent subdomains of an existing zone will all be told NXDOMAIN with a negative proof consisting of that zone's start-of- authority (SOA) record. We therefore apply the rate limit to the answer rather than to the question.

WINDOW: This is the period (in seconds) over which rates are measured and averaged, and during which memory of rate limit excesses is retained. If a given requestor solicits the same answer too often then similar queries will be dropped for WINDOW seconds..

See the source of the above quotes for more detailed answers to your question: http://ss.vix.su/~vixie/isc-tn-2012-1.txt

More info: http://www.redbarn.org/dns/ratelimits

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.