DNS Query time is very high

Tarikc · 07-04-2016, 06:34 AM

Hello,

I have this weird behavior on my recursive DNS Server, and I need some explanation if possible.

Querying Google DNS gives a time of 2 msec, while querying my DNS gives a time of 4K.

Code:

$ dig gulfup.com

; <<>> DiG 9.8.3-P1 <<>> gulfup.com
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: SERVFAIL, id: 48826
;; flags: qr rd ra; QUERY: 1, ANSWER: 0, AUTHORITY: 0, ADDITIONAL: 0

;; QUESTION SECTION:
;gulfup.com.			IN	A

;; Query time: 2 msec
;; SERVER: 8.8.8.8#53(8.8.8.8)
;; WHEN: Mon Jul  4 14:29:34 2016
;; MSG SIZE  rcvd: 28

$ dig gulfup.com @127.0.0.1

; <<>> DiG 9.8.3-P1 <<>> gulfup.com @127.0.0.1
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: SERVFAIL, id: 13723
;; flags: qr rd ra; QUERY: 1, ANSWER: 0, AUTHORITY: 0, ADDITIONAL: 0

;; QUESTION SECTION:
;gulfup.com.			IN	A

;; Query time: 4532 msec
;; SERVER: 127.0.0.1#53(127.0.0.1)
;; WHEN: Mon Jul  4 14:29:44 2016
;; MSG SIZE  rcvd: 28

I need any kind of assistance please, what parameters should be added to named to have it answering much faster?

Looking forward to your reply.

All the best,

wpeckham · 07-04-2016, 06:53 AM

Make sure that your DNS server is caching.

Any time you make a new query that is not in your local tables, your DNS server will check cache. If the address is there, it will respond quickly. If not, it must query a forward server. If each level takes 2 MS, then at least 4 should be expected. (Actually, that is really VERY fast!) If it is caching, then you should see the SECOND request for the same address come back much faster than any external query.

That said, I have never seen results like yours (2 vs 4xxx ms) under any circumstances. But then, testing directly ON the server has never been something I would consider.
I suggest that you run the same tests on a client machine set to use your DNS server for name resolution. Remember to do TWO tests resolving the same (new) FQDN so you can compare the initial and subsequent (cached) times. THOSE will be your client resolution times that you should expect.

Tarikc · 07-04-2016, 06:57 AM

Thank you for your fast reply, but the thing is that the domain I'm digging have issues with it's NSes as I'm getting SERVFAIL as you see.

I know my DNS is caching, but I don't know why it is keep getting the same reply time every time I'm querying the same domain in question "gulfup.com"

Google answers me in 2msec, while I'm getting weirdly 4xxx msec.

Does named have any parameter to make things shorter?

Many thanks!

bathory · 07-04-2016, 08:35 AM

Quote:

Google answers me in 2msec, while I'm getting weirdly 4xxx msec.
Does named have any parameter to make things shorter?

Nah, I'm getting 70ms from google and 4ms from my 127.0.0.1!!!
By the way here is your problem:

Code:

dig gulfup.com +trace
<snip>
couldn't get address for 'ns1.gulfup.com': not found
couldn't get address for 'ns2.gulfup.com': not found
dig: couldn't get address for 'ns1.gulfup.com': no more

wpeckham · 07-04-2016, 10:29 AM

FYI: I did a few time trials with DIG against the google DNS servers. I am impressed.
The times were as fast as my internal caching DNS server on second query, and FAR faster than my ISP nameservers in ALL cases! They must have some insane horsepower and bandwidth allocations.

Tarikc · 07-04-2016, 10:53 AM

Indeed!, they are insane for that, they might have their own specific DNS software, anycasting it all over the world.

I think I'm getting the problem more clear here for me, I've setup a new DNS, same config, asking that new one gives back a reply with 2 ~ 200 msec, still the old one gives 4K :|

So I guess the old one is getting congested? although it is not running out of resources, though it is a VM, this might have some effect? no?

I think I should get it out alone to a physical one and check the results there.

Thank you guys for your time!

Really appreciated.

biosboy4 · 07-04-2016, 11:14 AM

There was a time in the past when vms performed poorly, but not anymore.

If a vm is performing poorly you might want to check the configuration and also the nics.