[GH-ISSUE #2601] Recursor: Add limit on total number of queries made #1022

New issue

Open

opened 2026-03-16 01:18:21 +03:00 by kerem · 0 comments

kerem commented

2026-03-16 01:18:21 +03:00

Owner

Originally created by @divergentdave on GitHub (Nov 21, 2024).
Original GitHub issue: https://github.com/hickory-dns/hickory-dns/issues/2601

The recursor should have a separate limit of how many queries it will make while handling one recursive query, in addition to the existing CNAME depth and NS depth limits. This is recommended in RFC 1035:

While local limits on the number of times a resolver will retransmit a particular query to a particular name server address are essential, the resolver should have a global per-request counter to limit work on a single request.

BIND and Unbound each have different approaches to limits. See max-recursion-depth, max-recursion-queries, and max-query-restarts in BIND, and max-sent-count, max-query-restarts, and max-global-quota in Unbound.

Originally created by @divergentdave on GitHub (Nov 21, 2024). Original GitHub issue: https://github.com/hickory-dns/hickory-dns/issues/2601 The recursor should have a separate limit of how many queries it will make while handling one recursive query, in addition to the existing CNAME depth and NS depth limits. This is recommended in RFC 1035: > While local limits on the number of times a resolver will retransmit a particular query to a particular name server address are essential, the resolver should have a global per-request counter to limit work on a single request. BIND and Unbound each have different approaches to limits. See [`max-recursion-depth`](https://bind9.readthedocs.io/en/stable/reference.html#namedconf-statement-max-recursion-depth), [`max-recursion-queries`](https://bind9.readthedocs.io/en/stable/reference.html#namedconf-statement-max-recursion-queries), and [`max-query-restarts`](https://bind9.readthedocs.io/en/stable/reference.html#namedconf-statement-max-query-restarts) in BIND, and `max-sent-count`, `max-query-restarts`, and `max-global-quota` in [Unbound](https://unbound.docs.nlnetlabs.nl/en/latest/manpages/unbound.conf.html). See also previous discussion on https://github.com/hickory-dns/hickory-dns/pull/2522#discussion_r1821299600