[knot-dns-users] Re: AXFR sender FINs 10% of the way through transfer

i had debug logging enabled. and that was one of the clues on the trail. but it was many steps from that to learning that the default is a magic tunable that defaults to a value which is not viable on the real internet. while i appreciate the vuln, and appreciate that it is tunable, a default which does not work on the intertubes and no prominent warning is, imiho, not reasonable. to quote one of the old dns dogs who was one of the victims of this little adventure defaulting to 500ms" and apply it to both outgoing zone transfers and all other "normal" queries carried over TCP for a non-hidden publishing primary name server distributing non-trivial-sized zone files to secondaries which are geographically widely distributed seems like a recipe for disaster. randy