We're with Digital Ocean (DO), but I suppose this question applies to anyone hosting anywhere. In the Dnsperf rankings, DO is quite high, but in UltraDNS DNS speed tests, my domains hosted with DO come up much slower than others hosted with GoDaddy. The difference is to the tune of 90ms on DO compared to 2ms on GoDaddy.

Question: do these tests tell me anything about DNS speed, or are they always relative to wherever the test server (from UltraDNS in this case) may be? We're trying to speed up our DNS and have tried the likes of DNSMasq on our 'droplet' VPS server, but the DNS speed tests results remain the same.

Are we over-engineering? Would love to hear any guidance on how to make our DNS work at the best possible speed. Thanks.


You are over thinking things.

DNS is intended to be a distributed service that works off of cached information.

Don't change DNS records often, and use longer-lived TTLs to allow ISPs and other networks to properly cache your DNS info after an initial request for a host name is made. This way, almost all requests should be handled by a almost-local-to-the-client server, not your actual DNS servers.

If DNS is slow on your LAN, set up a caching-only DNS server (trivial) and reference that with your internal clients.

  • Thank you. Very clear and informative. Couple of follow up qustions based on what you say: First: for unchanging, stable domains is there a downside to setting really high TTLs like 1 month? Why do websites recommend 1 day etc? Second: can we disable dnsmasq etc if things are cached by ISPs anyway?
    – Khom Nazid
    Jul 14 '19 at 16:42
  • 2
    @KhomNazid The downside would be that when you need to make changes you must be aware and act on it at least 1 month in advance (eg lower TTL in preparation for the actual change), which may not be practical. I think something like a day or a few days is generally considered reasonable for seldom changing data. However, in practice many caching nameservers cap overly long TTLs anyway (examples of defaults: BIND: 1 week, Unbound: 1 day, PowerDNS Recursor: 1 day, Knot Resolver: 6 days), which reduces the point of picking higher values even if you think a different tradeoff is ideal for you. Jul 14 '19 at 18:15
  • Thank you @HåkanLindqvist. Makes sense. Now it "get it" :)
    – Khom Nazid
    Jul 14 '19 at 18:23

Regarding those tests/benchmarks specifically, the resulting response times will largely be a measure of network latency between their benchmark host(s) and your authoritative nameserver(s).

This may not be particularly relevant, for several reasons:

  • The response time from your authoritative server essentially matters for the cold cache scenario. This should hopefully be an edge case, not the norm (unless low traffic and/or very short TTL).

  • They measure from some arbitrary selected network(s), not the networks hosting the recursing nameservers that your actual clients use. It may still give some guidance, of course, but results can vary wildly depending on who peers with whom, etc.

You're probably over-engineering; taking caching into account, this is likely a minimal issue.

However, to optimize the latency to any given client, you can look into anycast DNS services with nodes in many well-connected networks. That should also be a good pick in terms of reliability (especially if you can combine multiple independent service providers), which is probably more important all things considered.

  • Thank you @HakanLindqvist that helps a lot. Yes, I always wondered what these "speed tests" actually offer. Not much, I guess.
    – Khom Nazid
    Jul 14 '19 at 19:31

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.