Monitoring Dns Performance: Strategies For Optimal Network Health

Monitoring DNS performance is crucial to understanding the Domain Name System (DNS) resolution process and ensuring a seamless user experience. DNS performance monitoring provides insights into potential issues, such as latency and mapping anomalies, and serves as the first line of defence against cyberattacks. To effectively monitor DNS performance, it is essential to utilise advanced tools that can trace queries through complex server, network, and service hierarchies. Various DNS performance testing tools are available, including network latency tools like ping and traceroute, and DNS-specific tools like dig and DNSPerf. These tools enable IT professionals to identify and address performance bottlenecks, optimise DNS configurations, and enhance the overall user experience.

Using network latency tools

Network latency tools are an important way to monitor DNS performance. These tools help identify issues with network speed and performance that can cause a poor user experience.

Ping

Ping is a free latency testing tool built into the operating system of every computer connected to a network. It works on the Internet Control Message Protocol (ICMP) and is often used by network administrators when diagnosing and troubleshooting internet connectivity issues. Ping is a quick, simple, and effective tool: it doesn’t require any additional software, and it provides a report to the computer from which you run the command.

When you run the command, your computer will send 32 bytes of data to your specified destination, then report the time, in milliseconds, it takes to receive a response signal. This is an example of "round-trip time" (RTT). A ping command will give you the transfer time for both the test and response packets, which can be useful for determining whether the traffic issue is directional.

Ping includes a few useful features. You can ping IP addresses directly; however, you don’t need to know the destination IP address if you are checking the RTT to a website, because ping treats the domain name as an address. Ping sends four test packets by default, but you can customise this on the command should you need a different number of tests.

When you receive the return signal from the ping command, it shows the RTT for each test packet along with a few other data points. These include the number of packets sent, the number of responses received, and how many (if any) were lost. The results will also summarise the minimum, maximum, and average round-trip time for the batch of test packets, allowing you to assess latency fluctuations.

While ping is an excellent way to test a specific network path that seems to be slow or underperforming, it is a very stripped-down tool. Ping will not, for instance, help you fix any latency problems you may identify, nor does it let you check multiple network paths with a single command.

Traceroute

Traceroute is a utility often used in conjunction with ping. While ping records the speed and latency of response packets, traceroute tracks the packet from the source to the destination, reporting back each of the hops the packet makes along the way. This can help you to identify what specific hops might be causing network trouble.

Traceroute does this by sending data packets with a low survival time (called “time to live,” or TTL), which limits the number of hops each packet can take before it’s returned to the source. If a packet times out before reaching the intended destination, then the intermediate node sends the packet back and identifies itself.

Traceroute can help you to identify network congestion, which can cause connections to drop and webpages to load slowly.

Other Tools

There are several other network latency tools available, including:

• NetFlow Traffic Analyzer
• Network Bandwidth Analyzer Pack
• NetFlow Analyzer
• Angry IP Scanner
• Engineer’s Toolset
• PRTG Network Monitor
• VoIP & Network Quality Manager
• NetScanTools
• Flow Tool Bundle

Using DNS performance testing tools

DNS performance testing tools are an important part of monitoring DNS performance. These tools can help identify issues such as latency, mapping anomalies, and other end-user impacting problems. They can also serve as a first line of defence against cyberattacks such as DDoS or man-in-the-middle attacks.

There are several DNS performance testing tools available, each with its own unique features and capabilities. Here are some of the most commonly used tools:

• DNSPerf — a tool that compares the speed and uptime of enterprise and commercial DNS services. It performs an A record lookup for the apex domain name from 200+ locations worldwide.
• GRC's DNS Benchmark — a DNS Resolution testing utility for Windows, Linux, and Wine users that determines the exact performance of the DNS Resolver and the DNS Authoritative chain.
• DNSBlast — an open-source, simple, and lightweight load testing tool for DNS resolvers, useful in lab or commissioning environments.
• Namebench — a tool from Google that encourages users to use its DNS resolvers. It can also be used to test for censorship on your DNS resolvers.
• Dnstop — a libpcap application that displays tables of DNS traffic on your network. While it doesn't measure performance, it's valuable for DNS architectures using open-source DNS software.
• Tpsreport — a DNS performance test tool provided by Akamai that can create a high volume of queries.
• DNSPERF — a tool built by Nominum to evaluate the performance of Authoritative DNS deployments. It is scriptable, allowing for automated tests.
• RESPERF — the companion tool to DNSPERF, used for testing DNS Resolvers. It is also scriptable and ideal for lab testing.
• JMeter — a tool for evaluating DNS Resolution performance, with a user guide written by Andrey Pohilko.
• Knot DNS Benchmark — an open-source Authoritative DNS test script based on NLnet's DISTEL test lab setup.
• QUERYPERF — a DNS server query performance testing tool with several use cases for testing DNS Resolvers.

In addition to these tools, there are web-based tools such as Network Speed.com and DNS Stuff that allow you to test DNS lookup latency. Furthermore, services like DNSPerf provide a way to monitor major DNS Authoritative Cloud and DNS Resolver Cloud Operators.

Troubleshooting slow DNS problems

Firstly, check your TCP/IP settings. Misconfigured DNS server addresses are a common issue. Reset the settings and check if communication is back to normal. Depending on your operating system, the steps will differ.

On Windows, search for "Network Status" in the Start menu and open the tool. From there, select "Properties" under the network connection details, and click the "Edit" button to change the IP settings. If the IP assignment is "Manual", double-check the IP, Preferred, and Alternate DNS addresses. You can change the IP assignment by selecting "Automatic (DHCP) from the dropdown menu. Save the settings and check the connection.

On a Mac, click the connection icon in the top-right corner, open the menu, and select "Wired Settings". Click the gear icon in the connection pane to open the settings, and navigate to the "IPv4" tab. If the address is manually assigned, double-check the Address and DNS IP address list. Select the "Automatic" options for both the address and DNS IP address to reset to normal. Apply the settings and close the window, then check the connection.

Next, you can try flushing the DNS cache. This is a good security measure in general and can help resolve issues.

On Windows, run the following command in an administrative Command Prompt window:

> ipconfig /flushdns

Or, in an administrative PowerShell window, run the following cmdlet:

> Clear-DnsServerCache

On a Mac, open the Terminal and enter the following command:

> dscacheutil -flushcache

On Linux, open the Terminal and enter the following command:

> sudo systemd-resolve --flush-caches

If you are still experiencing issues, you can try releasing and renewing the DHCP server IP. This will help resolve any IP conflicts and refresh old DNS information.

On Windows, run the following commands in the Command Prompt:

> IPCONFIG /RELEASE

> IPCONFIG /RENEW

On Linux, open the Terminal and enter the following command to release the current IP:

> sudo ip release

Then, run the following command to renew the IP:

> sudo dhclient

If the problem persists, you can try changing to public DNS servers. Use public domain addresses such as Google's 8.8.8.8 address as primary and 8.8.4.4 as secondary, or Cloudflare's 1.1.1.1 address as primary and 1.0.0.1 as secondary.

If you are still experiencing slow DNS issues, you may need to check for problems with your DNS server. You can do this by running an nslookup query. Run the following command and check whether the DNS server is reachable from client computers:

> nslookup

If the resolver returns the IP address of the client, the server does not have any problems. If the resolver returns a "Server failure" or "Query refused" response, the zone is probably paused, or the server is overloaded. If the resolver returns a "Request to server timed out" or "No response from server" response, the DNS service is probably not running. Try to restart the DNS Server service.

If the issue occurs when the service is running, the server might not be listening on the IP address that you used in your nslookup query. On the Interfaces tab of the server properties page in the DNS console, administrators can restrict a DNS server to listen on only selected addresses. If the DNS server has been configured to limit service to a specific list of its configured IP addresses, the IP address that you used to contact the DNS server may not be on the list. You can try a different IP address in the list or add the IP address to the list.

In rare cases, the DNS server might have an advanced security or firewall configuration. If the server is located on another network that is reachable only through an intermediate host, the DNS server might use a non-standard port to listen for and receive client requests. By default, nslookup sends queries to DNS servers on UDP port 53, so if the DNS server uses any other port, nslookup queries will fail. If this is the case, check whether an intermediate filter is intentionally used to block traffic on well-known DNS ports. If not, try to modify the packet filters or port rules on the firewall to allow traffic on UDP/TCP port 53.

Best practices for ensuring fast DNS performance

Use a DNS provider with CDN architecture

When selecting a service provider, it is essential to conduct research and create a shortlist of providers that meet your minimum uptime and performance criteria. Depending on the criticality of your application, you may opt for two different providers. If your DNS goes down, all your applications and services will be affected, potentially resulting in significant financial losses. When choosing a DNS provider, consider the following criteria:

• The number of geographically distributed DNS server/resolver nodes
• Availability assurances and the failover mechanism used by the provider
• Service uptime, quality, and latency guarantees from the provider
• Feedback from existing customers

Additionally, you can utilise a third-party monitoring service, such as DNSPerf, to obtain comparative statistics on different service providers.

Consider self-managed DNS

Another option is to deploy and manage your own DNS servers. This approach may be preferable if you possess the necessary technical skills and desire greater control over your service. If you opt for self-managed DNS, consider the following best practices:

• Deploy two or more servers in different geographic regions
• Use self-managed data centres or host your DNS servers on a well-established and highly-rated cloud service provider's infrastructure
• After deployment, use nslookup/dig commands to verify that all your DNS servers are responding with the correct DNS records
• Before going live, employ benchmarking tools to ensure that your DNS servers can handle the expected traffic
• Fine-tune server configurations and adjust specifications based on test results

Increase DNS TTL values

DNS records are configured with Time To Live (TTL) values, which determine how long the records remain in the cache of DNS resolvers. By increasing the TTL values, you can enhance the benefits of caching, resulting in faster DNS responses for end users.

Use CNAME (DNS aliases)

It is a common practice in DNS records to have multiple records pointing to the same address. For example, you may want both "exampleshop.com" and "www.exampleshop.com" to direct users to the same website. This can be achieved by configuring the A record for "exampleshop.com" and defining "www.exampleshop.com" as a CNAME record. However, this approach results in two DNS lookups, doubling the time required to obtain DNS records.

To optimise this process, many DNS applications and providers now support ALIAS records or CNAME "flattening". With this method, when a query is made for "www.exampleshop.com", the DNS server itself performs the A record lookup of the ALIAS and returns the IP address to the client in a single query. This approach offers the benefits of CNAME without the double lookups. However, it is important to note that if the client-side DNS resolvers use older BIND DNS software that does not recognise this type of record, the DNS query for the entire domain may fail.

Use DNS prefetch in website code

Most modern websites are dynamic, pulling content from various sources such as images, videos, and fonts. DNS lookup of each source can delay the loading of the web page. As a website developer, you can add a small code snippet to the HEAD element of the web page to enable DNS prefetch. This feature, supported by major browsers, allows the DNS resolution of all listed external websites to occur before the user opens or views the link, improving the overall website performance and user experience.

Benchmarking DNS servers

Understanding DNS Performance

DNS performance monitoring provides valuable insights into the DNS resolution process, helping to identify issues such as latency and mapping anomalies. It is important to monitor DNS performance as it plays a critical role in the functioning of the internet. Any errors or issues can lead to slower website load times or even render websites inaccessible. Additionally, DNS monitoring can serve as a defence mechanism against cyberattacks such as DDoS or man-in-the-middle attacks.

Factors Affecting DNS Performance

When benchmarking DNS servers, it is essential to consider factors that can impact performance. These include the various components of the DNS resolution process, such as DNS resolvers, name servers, authoritative servers, and zone files. The routing options (anycast and unicast), public resolvers, and multi-DNS configurations also play a role in DNS performance. Understanding the specific DNS architecture used by an organisation is crucial for defining an effective monitoring strategy.

Tools for Benchmarking DNS Servers

Several tools are available to help with benchmarking DNS servers:

• DNSPerf—A tool that performs A record lookup for the apex domain name from 200+ locations worldwide. It helps to debug self-hosted DNS servers and test routing logic.
• GRC's DNS Benchmark—A comprehensive and accurate tool for Windows and Linux/Wine users to determine the exact performance of local and remote DNS nameservers. It offers features like DNSSEC domain signing verification, automatic nameserver assignment, and extensive logging and charting.
• DNSBlast—An open-source and simple load testing tool for DNS resolvers, useful in lab or commissioning environments.
• Namebench—A Google tool that encourages users to utilise Google's 8.8.8.8 DNS resolvers.
• Dnstop—A libpcap application similar to tcpdump, useful for DNS architectures using open-source DNS software.
• Tpsreport—A DNS performance test tool provided by Akamai, capable of generating a large number of queries.
• DNSPERF and RSEPERF—Tools built by Nominum to evaluate the performance of Authoritative DNS deployments and test DNS Resolvers, respectively.
• JMeter—A tool to evaluate DNS Resolution performance.
• Knot DNS Benchmark—An Authoritative DNS test script built by the Knot DNS Team, based on NLnet's DISTEL test lab setup.
• QUERYPERF—A DNS server query performance testing tool, particularly useful for testing DNS Resolvers.
• Dareboost—A website testing tool that includes the impact of DNS on website speed.
• Neustar's DNS Speed Test—A tool for testing domain and website performance.
• DNS Check—A tool for operators to test their EDNS0 Client Subnet settings, useful for CDN deployments.

Frequently asked questions