Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

Using a LAN with Linux boxes.

The responses from the ISP are slower and slower. There is no special reason for that locally, all machines experience the delays. The router did not change / neither the traffic.

I'm thinking of installing a machine with bind named to cache the DNS responses. All other boxes would resolve from that local server.

Three questions

  • Should I try to use the local DNS server to send requests directly to the root servers?
  • Or should I simply use the forwarders (to ISP NS servers)?
  • Any better idea, maybe, than installing a local bind server?

edit

Thanks for your inputs - don't we have privacy implications when using an external name server? This is also true for my local ISP, but the scale is much smaller.
For instance, Google knows already a lot - using their DNS would tell them all the sites visited...
Or am I becoming paranoid ;-)

share|improve this question
add comment

6 Answers

up vote 6 down vote accepted

I would recommend trying a different nameserver. You can find out which one is best for you using namebench. This runs tests against various public nameservers to find which one is ideal for your location/connection.

Or you can just try google at 8.8.8.8 and 8.8.4.4.

share|improve this answer
    
In this case, installing locally a bind to cache the new name servers responses wouldn't hurt? –  ring0 Aug 31 '10 at 15:00
    
Discovered namebench the other day, it's just awesome. –  ThatGraemeGuy Aug 31 '10 at 15:04
    
@ring0: Nope that is not a bad idea. In fact if you are not caching with linux every single query will take an extra 5 seconds to failover to the second server in resolv.conf. –  Kyle Brandt Aug 31 '10 at 15:20
    
And what about privacy concerns (edit of the question)? –  ring0 Sep 1 '10 at 4:32
add comment

Any possibility of falling back to OpenDNS or Google DNS?

When I was in university, my dorm-provided connection had the same issues. I ran TreeWalk for a long time, which was nice. I fell back on OpenDNS later and mostly haven't looked back since.

share|improve this answer
add comment

Bind as caching DNS server is overkill. My favorite is pdnsd.

share|improve this answer
add comment

Personally (since this is actually what I do) I'd go for the local caching resolver option (either BIND or Unbound) without forwarders and enable DNSSEC.

This will:

  1. give you DNSSEC even though your ISP probably doesn't support it (yet), hence:
  2. prevent your ISP from pulling Stupid DNS Tricks on you (e.g. NXDOMAIN rewriting)
share|improve this answer
add comment
  • It's up to you if you use forwarders like the free 4.2.2.2 to 4.2.2.4 or Google's 8.8.8.8.
  • Forwarders may give better performance, but will depend on how you have caching configured and the particular DNS servers involved.
  • It might be simpler to point your computers at a publicly available DNS server like the ones listed above, than to run your own BIND server.
share|improve this answer
add comment

You could also try dnscache. There are examples on the official website for it as well, which might be useful. http://cr.yp.to/djbdns/dnscache.html

share|improve this answer
    
-1 for djbdns - it has security problems out of the box (Check the CVE database) and it doesn't do DNSSEC. –  Mark Johnson Dec 25 '12 at 5:27
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.