diff --git a/CHANGES b/CHANGES index da22e43c64..d281aaa4e2 100644 --- a/CHANGES +++ b/CHANGES @@ -1,3 +1,6 @@ +5541. [func] Adjust the "max-recursion-queries" default from 75 to + 100. [GL #2305] + 5540. [port] Fix building with native PKCS#11 support for AEP Keyper. [GL #2315] diff --git a/bin/named/config.c b/bin/named/config.c index bec90ab2f2..18710ab538 100644 --- a/bin/named/config.c +++ b/bin/named/config.c @@ -185,7 +185,7 @@ options {\n\ max-clients-per-query 100;\n\ max-ncache-ttl 10800; /* 3 hours */\n\ max-recursion-depth 7;\n\ - max-recursion-queries 75;\n\ + max-recursion-queries 100;\n\ message-compression yes;\n\ # min-roots ;\n\ minimal-any false;\n\ diff --git a/doc/arm/Bv9ARM-book.xml b/doc/arm/Bv9ARM-book.xml index c3156ca88b..466a529506 100644 --- a/doc/arm/Bv9ARM-book.xml +++ b/doc/arm/Bv9ARM-book.xml @@ -9299,7 +9299,7 @@ avoid-v6-udp-ports { 40000; range 50000 60000; }; This sets the maximum number of iterative queries that may be sent while servicing a recursive query. If more queries are sent, the recursive query - is terminated and returns SERVFAIL. The default is 75. + is terminated and returns SERVFAIL. The default is 100. diff --git a/doc/arm/Bv9ARM.ch06.html b/doc/arm/Bv9ARM.ch06.html index 35b5c9ddc6..005f5a5c7e 100644 --- a/doc/arm/Bv9ARM.ch06.html +++ b/doc/arm/Bv9ARM.ch06.html @@ -7115,7 +7115,7 @@ avoid-v6-udp-ports { 40000; range 50000 60000; }; This sets the maximum number of iterative queries that may be sent while servicing a recursive query. If more queries are sent, the recursive query - is terminated and returns SERVFAIL. The default is 75. + is terminated and returns SERVFAIL. The default is 100.

notify-delay
diff --git a/doc/arm/notes-9.11.26.xml b/doc/arm/notes-9.11.26.xml index 6e5c7facfd..1499fc2a17 100644 --- a/doc/arm/notes-9.11.26.xml +++ b/doc/arm/notes-9.11.26.xml @@ -55,7 +55,14 @@ - None. + Adjust the max-recursion-queries default + from 75 to 100. Since the queries sent towards root and + TLD servers are now included in the count (as a result + of the fix for CVE-2020-8616), + max-recursion-queries has a higher + chance of being exceeded by non-attack queries, which is + the main reason for increasing its default value. [GL + #2305] diff --git a/lib/dns/resolver.c b/lib/dns/resolver.c index 320fc69341..8175f7918b 100644 --- a/lib/dns/resolver.c +++ b/lib/dns/resolver.c @@ -169,8 +169,8 @@ /* The default maximum number of iterative queries to allow before giving up. */ #ifndef DEFAULT_MAX_QUERIES -#define DEFAULT_MAX_QUERIES 75 -#endif +#define DEFAULT_MAX_QUERIES 100 +#endif /* ifndef DEFAULT_MAX_QUERIES */ /* * After NS_FAIL_LIMIT attempts to fetch a name server address,