Bruce Momjian <bruce@momjian.us> writes:
> On Wed, Jun 30, 2021 at 12:53:24PM -0400, Tom Lane wrote:
>> ... I'll try the hack mentioned in the serverfault thread.
> I will also add the bind options mentioned to disable
> dnssec and aaaa records.
I found better practice described at
https://kb.isc.org/docs/aa-00576
to wit you can set "filter-aaaa-on-v4" to "break-dnssec" to just
adjust what is returned to clients, rather than disabling DNSSEC
globally. Also, if you use views to configure your bind setup,
it works to make that an option in the view that serves your
local clients (the ones you don't want to see IPv6 addys).
I have that installed locally now, but it'll take awhile to
determine whether it improves matters.
regards, tom lane