Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

feat: lazy query A/AAAA of NSes when iterating on authorities #477

Merged
merged 2 commits into from
Nov 20, 2024

Conversation

developStorm
Copy link
Member

No description provided.

@developStorm developStorm self-assigned this Nov 19, 2024
@developStorm developStorm marked this pull request as ready for review November 19, 2024 08:52
@developStorm developStorm requested a review from a team as a code owner November 19, 2024 08:52
Copy link
Contributor

@phillip-stephens phillip-stephens left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Few suggestions, otherwise looks good to me.

Since we're changing the lookup behavior for all lookups, can you add a TODO to the main DNSSEC PR to do A/B tests with DNSSEC disabled to be sure our error rate/timeout rate/success rate/runtime are all similar or better with that branch than main ZDNS? Want to check for regressions.

src/zdns/lookup.go Outdated Show resolved Hide resolved
src/zdns/lookup.go Show resolved Hide resolved
@developStorm
Copy link
Member Author

Merging this now to the DNSSEC dev branch.

@developStorm developStorm merged commit a7962e5 into feat/basic-dnssec-validation Nov 20, 2024
3 checks passed
@developStorm developStorm deleted the feat/lazy-lookup-auth branch November 20, 2024 00:03
@developStorm
Copy link
Member Author

For A/B testing, current main we have

01h:02m:25s; Scan Complete, no more input. 1000000 domains scanned; 266.98 domains/sec.; 99.0% success rate; NOERROR: 984428, NXDOMAIN: 5321, REFUSED: 5094, TIMEOUT: 3160, ITERATIVE_TIMEOUT: 1075, SERVFAIL: 477, ERROR: 392, FORMERR: 32, AUTHFAIL: 12, NOTAUTH: 7, NOTIMP: 2

With this change (and DNSSEC on, and with Cloudflare DoH):

01h:43m:19s; Scan Complete, no more input. 984002 domains scanned; 158.72 domains/sec.; 99.3% success rate; NOERROR: 971703, SERVFAIL: 5355, NXDOMAIN: 5342, TIMEOUT: 1602

From error rate I think we are good? Current main might get penalized for scanning too fast I assume.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants