3 ms·

That's great and all, but you still need to pick an upstream DNS server. The conventional advice is to use one of these public services, or your ISP's resolver

That's great and all, but you still need to pick an upstream DNS server. The conventional advice is to use one of these public services, or your ISP's resolvers, to avoid hitting the root servers constantly. A lot of services these days have very short TTLs, so running your own recursive resolver still causes a lot of requests to get forwarded. Also, as counterintuitive as it might seem, when I use namebench ( https://code.google.com/archive/p/namebench/ https://code.google.com/archive/p/namebench/ ) it still says cloudflare and google are faster than my local resolver. (not by a lot though)

deleted 8y ago
[deleted]
ingenium 8y ago
You actually don't have to. The TTLs on NS records are generally pretty long, especially the root servers (6 days for root, 2 days for both .com and my domain's NS). You will hit the .com for example the first time you go to a domain, but so does Google. In my experience, Google's DNS has so many servers that even on subsequent requests, you hit a different server and it has to do the full lookup again (likely querying a root unless it's a popular domain). It's not really decreasing the load on the root servers that much, if at all. It might actually increase the load. One trick you can do to speed up your local recursive resolver is allowing it to serve expired records. Unbound in pfsense allows for this. If the record has been previously retrieved but is expired, it returns the record with a 0 TTL (to force the client to look it up again next time). This includes internally using expired NS records, for example to lookup a different subdomain. Meanwhile, in the background, it looks up all the records used to refresh the TTL, and serves/uses this next time. Generally speaking, expired records still work fine. I noticed that Cloudflare DNS does this as well, and regularly serves 0 TTL records. I've found that this consistently makes my local resolver faster than any public DNS server, except sometimes the very first time it looks up a domain. The slowest DNS queries are records which use lots of nested CNAMES on different domains with short TTLs, such as www.microsoft.com / most sites using akamai, which takes 500ms for the first lookup. There was a domain I saw the other day which had 4 or 5 layers of CNAMES which took 1-1.5 seconds to resolve initially.
- acranox 8y ago
  I know all that. IMHO in that configuration the root servers are your upstream servers. That’s what I was trying to convey. And serving expired records does generally work, but is not suggested practice.
  - icedchai 8y ago
    Technically, you don't have upstream DNS servers in that configuration. The root servers are not recursive resolvers like an upstream. But this isn't a problem... DNS caching works very well. I've been running my own nameservers for over two decades.
    - acranox 8y ago
      potato potato
blattimwind 8y ago
> That's great and all, but you still need to pick an upstream DNS server. No, you don't, that's the whole point of a recursive resolver. I've been running against the root servers and neither query statistics nor observed performance match frequent issues due to short TTLs, or excessive number of external queries.
- deleted 8y ago
  [deleted]
- acranox 8y ago
  In that case you are using the root servers as your upstream. That’s the point I was trying to make, but I guess I didn’t explain it well. :/

deleted 8y ago

[deleted]

ingenium 8y ago

You actually don't have to. The TTLs on NS records are generally pretty long, especially the root servers (6 days for root, 2 days for both .com and my domain's NS). You will hit the .com for example the first time you go to a domain, but so does Google. In my experience, Google's DNS has so many servers that even on subsequent requests, you hit a different server and it has to do the full lookup again (likely querying a root unless it's a popular domain). It's not really decreasing the load on the root servers that much, if at all. It might actually increase the load. One trick you can do to speed up your local recursive resolver is allowing it to serve expired records. Unbound in pfsense allows for this. If the record has been previously retrieved but is expired, it returns the record with a 0 TTL (to force the client to look it up again next time). This includes internally using expired NS records, for example to lookup a different subdomain. Meanwhile, in the background, it looks up all the records used to refresh the TTL, and serves/uses this next time. Generally speaking, expired records still work fine. I noticed that Cloudflare DNS does this as well, and regularly serves 0 TTL records. I've found that this consistently makes my local resolver faster than any public DNS server, except sometimes the very first time it looks up a domain. The slowest DNS queries are records which use lots of nested CNAMES on different domains with short TTLs, such as www.microsoft.com / most sites using akamai, which takes 500ms for the first lookup. There was a domain I saw the other day which had 4 or 5 layers of CNAMES which took 1-1.5 seconds to resolve initially.

acranox 8y ago
I know all that. IMHO in that configuration the root servers are your upstream servers. That’s what I was trying to convey. And serving expired records does generally work, but is not suggested practice.
- icedchai 8y ago
  Technically, you don't have upstream DNS servers in that configuration. The root servers are not recursive resolvers like an upstream. But this isn't a problem... DNS caching works very well. I've been running my own nameservers for over two decades.
  - acranox 8y ago
    potato potato

blattimwind 8y ago

> That's great and all, but you still need to pick an upstream DNS server. No, you don't, that's the whole point of a recursive resolver. I've been running against the root servers and neither query statistics nor observed performance match frequent issues due to short TTLs, or excessive number of external queries.

deleted 8y ago
[deleted]
acranox 8y ago
In that case you are using the root servers as your upstream. That’s the point I was trying to make, but I guess I didn’t explain it well. :/