Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Using a LAN with Linux boxes.

The responses from the ISP are slower and slower. There is no special reason for that locally, all machines experience the delays. The router did not change / neither the traffic.

I'm thinking of installing a machine with bind named to cache the DNS responses. All other boxes would resolve from that local server.

Three questions

  • Should I try to use the local DNS server to send requests directly to the root servers?
  • Or should I simply use the forwarders (to ISP NS servers)?
  • Any better idea, maybe, than installing a local bind server?


Thanks for your inputs - don't we have privacy implications when using an external name server? This is also true for my local ISP, but the scale is much smaller.
For instance, Google knows already a lot - using their DNS would tell them all the sites visited...
Or am I becoming paranoid ;-)

share|improve this question
up vote 6 down vote accepted

I would recommend trying a different nameserver. You can find out which one is best for you using namebench. This runs tests against various public nameservers to find which one is ideal for your location/connection.

Or you can just try google at and

share|improve this answer
In this case, installing locally a bind to cache the new name servers responses wouldn't hurt? – ringø Aug 31 '10 at 15:00
Discovered namebench the other day, it's just awesome. – ThatGraemeGuy Aug 31 '10 at 15:04
@ring0: Nope that is not a bad idea. In fact if you are not caching with linux every single query will take an extra 5 seconds to failover to the second server in resolv.conf. – Kyle Brandt Aug 31 '10 at 15:20
And what about privacy concerns (edit of the question)? – ringø Sep 1 '10 at 4:32

Any possibility of falling back to OpenDNS or Google DNS?

When I was in university, my dorm-provided connection had the same issues. I ran TreeWalk for a long time, which was nice. I fell back on OpenDNS later and mostly haven't looked back since.

share|improve this answer

Bind as caching DNS server is overkill. My favorite is pdnsd.

share|improve this answer

Personally (since this is actually what I do) I'd go for the local caching resolver option (either BIND or Unbound) without forwarders and enable DNSSEC.

This will:

  1. give you DNSSEC even though your ISP probably doesn't support it (yet), hence:
  2. prevent your ISP from pulling Stupid DNS Tricks on you (e.g. NXDOMAIN rewriting)
share|improve this answer
  • It's up to you if you use forwarders like the free to or Google's
  • Forwarders may give better performance, but will depend on how you have caching configured and the particular DNS servers involved.
  • It might be simpler to point your computers at a publicly available DNS server like the ones listed above, than to run your own BIND server.
share|improve this answer

You could also try dnscache. There are examples on the official website for it as well, which might be useful.

share|improve this answer
-1 for djbdns - it has security problems out of the box (Check the CVE database) and it doesn't do DNSSEC. – Mark Johnson Dec 25 '12 at 5:27

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.