Intermittent DNS timeouts, independent of DNS provider

Question

This is a problem that has plagued my office for a few months now. It has bounced between our ISP (Comcast), our IT contractor, and even our VOIP contractor, each of which has "fixed" it at least once.

Originally, the problem was significantly worse than it is now, with sites constantly timing out of half their assets: Loading the DOM but only some of the images, or timing out on the CSS. That problem has become much rarer, but still, many times over the course of a day, a domain will simply fail to resolve after a wait.

Suspecting Comcast's DNS, I tried switching my workstation to Google DNS, and then OpenDNS, neither of which changed things: Now I'll just get the OpenDNS page telling me it can't resolve google.com.

And that's the part that perplexes me -- how can this problem transcend DNS providers?

Answer 1

Do you have a firewall between your PCs and the internet that is doing some application (DNS) filtering? You might not even know it is doing it if it exists. It's possible the firewall is examining DNS requests and blocking stuff it thinks might be a security risk but isn't doing a great job of it. I've not personally seen this issue with DNS but it is a fairly common problem with, for instance, Cisco PIX interfering with SMTP when it thinks it is securing things but is really just getting in the way of normal communication (Cisco is awesome but the application filtering built into their firewalls is usually not so great).

Answer 2

Are you sure the problem is exclusive to DNS? It sounds to me like packets might be getting dropped irrespective of their content. If so, then you have a problem with your upstream provider (Comcast). Another question worth asking: If DNS times out, does it always time out on the same thing, or do multiple attempts at lookups eventually succeed?

As others have asked, what does your network look like? Network hardware, etc.