Chaining in recursor

[karelbilek]

I am trying to understand the concept of "chaining" in pdns recursor.

I cannot find much about it in the docs. What does it mean exactly? How does it work?

I can find some references here

https://doc.powerdns.com/recursor/yamlsettings.html#recursor-max-chain-length

and in stats here

https://doc.powerdns.com/recursor/metrics.html#gathered-information

but that's not much! (I cannot help with the docs, yet, as I don't understand it that much so far)

[rgacogne]

Hi Karel,

When an incoming query received from a client triggers an outgoing query to an authoritative server, the recursor checks if the same outgoing query isn't already pending, triggered by a different incoming query, to prevent duplicating outgoing queries and improve performance. If there is indeed one, the new query is "chained" to the existing one and the incoming response from the authoritative server will be used for all "chained" queries.

[karelbilek]

Thanks, this makes sense.

I had some errors "Hit a chain limit resolving ..." even with 0 chain limits, so I wondered what that is.

[omoerbeek]

There is also a chain limit not dependent on recursor.max_chain_length that is always enforced: if a chain is "old" (> 2/3 of the auth timeout value), a new outgoing query is also not attached to it. This is a heuristic to avoid chaining too many queries to a chain that will likely time out. In that case a new auth IP is selected (if available) which might have better luck.

The chain limits exist to avoid extreme bursts when the answer from an auth comes in or a timeout occurs: if we would not limit the chain size, the burst of outgoing traffic to clients would be huge and could be used by a malicious clients to create a DoS.