Avoiding outages during (large) zone reload [was: Re: gTLD server losses]

[Simon Leinen <simon@limmat.switch.ch>]

>>>>> "ts" == Tim Seaver <tas@bellsouth.net> writes:
> [...] However, this loss was due to the servers being unresponsive
> for two 30 minute periods per day during zone reloads rather than
> being overloaded. With the move of g on April 4, it no longer shows
> that behavior, and Matt tells me that c will be moving to a new
> configuration shortly to avoid the reload outages. That's good news,
> since it should remove some 20% of the server retries I see.

How do people solve this problem of authoritative name servers being
unresponsive while they reload big zones (such as TLDs etc.)? I can
think of a few possibilities:

* Have a dual/cluster setup, and while one box is reloading its
  zone(s), the IP address is routed to the other one.  This seems easy
  enough and improves robustness in other areas as well.

* Move to dynamic updates (should also make slaves happier if they can
  use IXFR).  This would be nice because it would also permit
  near-real-time update service for registries, provided IXFR works
  well and all slaves support it.

* Implement authoritative servers as front-ends to the registry
  database.  Seems challenging to implement well with traditional
  slave servers.  And moving to non-traditional slaves (e.g. multiple
  front-ends to (mirrored versions of) a single database) doesn't
  sound trivial either.

* Someone has implemented zone reload in a way such that queries to
  the zone that is being reloaded can still be handled, preferably in
  a consistent manner (i.e. using only old zone contents).
-- 
Simon.