Bind9 extremely slow upstream resolving

Question

I have a bind9 docker container serving DNS for my home lab. It provides a .lan domain for local devices, and a private domain name for my internal services. However, resolving any external DNS entry is extremely slow for some reason (even on the same device). 1.2 seconds for DNS resolving is ridiculous. I've attached a screenshot of DNS benchmark as well as my config. I've tried various other upstream resolvers apart from google and all yield similar results. My internal domains all resolve super fast, and cached responses from DNS are also fast. Does anyone have any ideas?

named.conf

options {
    directory "/var/cache/bind";
    allow-query {any;};
    recursion yes;
    dnssec-validation no;
    allow-transfer { none; };
    forwarders {
        8.8.8.8;
        8.8.4.4;
    };
};

zone "my_internal_domain_hidden" IN {
    type master;
    file "/etc/bind/my_internal_domain_hidden.db";
};

zone "lan" IN {
    type master;
    file "/etc/bind/lan.db";
};

logging {
    category default { null; };
};

my_internal_domain_hidden.db

$TTL 1h;

$ORIGIN my_internal_domain_hidden.

@                   IN      SOA     ns.my_internal_domain_hidden. info.my_internal_domain_hidden. (
                                    18092023 ; serial
                                    12h      ; refresh
                                    15m      ; retry
                                    3w       ; expire
                                    2h       ; minimum ttl
                                    )
    
                    IN      NS      ns.my_internal_domain_hidden.
    
ns                  IN      A       my_dns_ip

; dns records

some_service        IN      A       some_ipv4_add3

lan.db

$TTL 1h;

$ORIGIN lan.

@                   IN      SOA     ns.lan. info.lan. (
                                    18092023 ; serial
                                    12h      ; refresh
                                    15m      ; retry
                                    3w       ; expire
                                    2h       ; minimum ttl
                                    )

                    IN      NS      ns.lan.

ns                  IN      A       my_dns_ip

; dns records

some_device         IN      A       some_lan_ipv4

Answer 1

The Most common issue for this kind of setup is, that

    forwarders {
        8.8.8.8;
        8.8.4.4;
    };

will be suggested on a lot of Tutorials, instead of using bind native resolution. Forwarding all your queries is not a good way to behave.

Remove these Nameservers and let Bind9 do its job, to fix this, remove them.

• Resolve hostnames to IPs by using TLD-(root)nameserver

The Wikipedia has a really good explanation about: https://en.wikipedia.org/wiki/Domain_Name_System

Address resolution mechanism Domain name resolvers determine the domain name servers responsible for the domain name in question by a sequence of queries starting with the right-most (top-level) domain label.

A DNS resolver that implements the iterative approach mandated by RFC 1034; in this case, the resolver consults three name servers to resolve the fully qualified domain name "www.wikipedia.org". For proper operation of its domain name resolver, a network host is configured with an initial cache (hints) of the known addresses of the root name servers. The hints are updated periodically by an administrator by retrieving a dataset from a reliable source.

Assuming the resolver has no cached records to accelerate the process, the resolution process starts with a query to one of the root servers. In typical operation, the root servers do not answer directly, but respond with a referral to more authoritative servers, e.g., a query for "www.wikipedia.org" is referred to the org servers. The resolver now queries the servers referred to, and iteratively repeats this process until it receives an authoritative answer. The diagram illustrates this process for the host that is named by the fully qualified domain name "www.wikipedia.org".

This mechanism would place a large traffic burden on the root servers, if every resolution on the Internet required starting at the root. In practice caching is used in DNS servers to off-load the root servers, and as a result, root name servers actually are involved in only a relatively small fraction of all requests.