1

When setting up and testing DNS forwarders I am finding that if the primary is unreachable 2008 will still try it for every query before trying the secondary.

The default timeout before querying the secondary was 3 seconds so now every dns request will have a 3 second delay. This is a very noticeable delay for users. I have not found a solution for this online.

Is there a way to configure 2008 so that it will simply query the secondary until the primary is responding again?

Edit: Alright there appears to be no solution. If you're using forwarders and the primary is unreachable network performance will suffer. Even for Microsoft this is surprising.

3
  • I'm not aware of any configurable options here. May 29, 2014 at 22:29
  • Why not use more reliable forwarders or use the root hints instead of forwarders?
    – joeqwerty
    May 29, 2014 at 23:04
  • @SimonCatlin Please put this as an answer and I'll accept it.
    – jjames
    Jun 1, 2014 at 22:19

2 Answers 2

1

For the moment, just swap the dns servers in your config. We had a similar situation a few months ago and it worked fine.

0

In "Configure a DNS Server to Use Forwarders", Microsoft offers this little nugget of wisdom:

You can prevent common problems that are associated with forwarders by configuring your DNS servers to avoid overusing your forwarders.

While that's primarily advice in the context of conditional forwarders, it applies generally as well. Forwarders cannot magically determine a DNS server is unavailable: it has to try asking. Sure, they could so some sort of UDP 53 portscan, but that just adds complexity, latency, and a chance of triggering some overzealous IPS. Instead of all that, it simply performs a DNS query, which only takes a few seconds. If you wish to immediately alleviate this issue, you could set a much more aggressive timeout (say, 1 second) and perhaps add a few forwarders. However, this runs clear risks that you won't get any responses at all.

You may want to consider configuring your DNS to point to 2 or more "Edge DNS" servers, which themselves recurse to root hints (recursion to root hints is not some grand evil; it really doesn't take that long. Generally, that's going to be shorter than the 3 seconds you're facing now.) Or, perhaps you may want to consider recursing to root hints directly and not using forwarders at all.

I assume your concern here is external resources for which you are not an authority. In that case, the above are two starting paths to consider; there are others as well of course. If the case is an authoritative or internal zone, then consider a zone design which takes advantage of better features than a server-level forwarder to achieve the answer, such as Stub Zones.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .