Best way to set up DNS caching?

Question

In order to speed up DNS lookups, I want to install a DNS cache or proxy.

I can see at least three programs I think will do the job: bind9, pdnsd, or dnsmasq.

I would like to make sure that if I install one of I do not leave it poorly configured from a performance or security point of view. So, what would people recommend, and are there any configuration changes I should immediately make after installing?

Yes, this is to speed up individual workstations, not for a LAN. — , Jan 25 '11 at 21:32

score 16 · Accepted Answer · edited May 02 '17 at 16:13

16

Install bind9
Point resolv.conf to 127.0.0.1

To do this follow this steps:

To Install Bind9

Open "Ubuntu Software Center" (Applications->Ubuntu Software Center)
Search for bind9
Check to display "Technical Items"
Mark bind9 and install it

Update /etc/resolv.conf

Open Network Manager (System->Preferences->Network Manager)
Find your connection and edit it (wired or wireless)
Toggle "IPV4 configuration" tab
On "DNS Servers" field write 127.0.0.1

It's done!

To test

Open gnome-terminal (Applications > Accessories > Terminal ) and type

dig ubuntu.com

(if you don't have it, install dnsutils package as explained to bind9)

Check the last answers, as an example:

My first query at ubuntu.com

;; Query time: **209 msec**
;; SERVER: 127.0.0.1#53(127.0.0.1)
;; WHEN: Sat Jan 22 12:20:12 2011
;; MSG SIZE  rcvd: 196

My second query:

;; Query time: **0 msec**
;; SERVER: 127.0.0.1#53(127.0.0.1)
;; WHEN: Sat Jan 22 12:18:23 2011
;; MSG SIZE  rcvd: 156

The server 127.0.0.1 means that you're resolving locally. Take a look in query time (surrounded by **) , the second one is cached.

edited May 02 '17 at 16:13

B. Shea

1,120
13
16

answered Jan 22 '11 at 14:22

Lin

230
2
7

Thanks, Igor. I tried this approach and it works well for name lookups, but it does not seem to cache reverse IP address lookups. How would I do this using bind9? – Jan 25 '11 at 21:35
This didn't do anything on my setup. Query time is still ~100ms – Ashfame Apr 21 '11 at 06:48
Both of you: if it doesn't seem to work, check what server dig says it got the answer from. If it doesn't say 127.0.0.1, then you haven't set it up properly. Note: The instructions for setting resolv.conf may be different for different versions of Ubuntu. – thomasrutter Dec 10 '12 at 00:17
So you are running a caching nameserver on gui box? Yes, it's possible of course.. More than likely most ppl reading this will have a server install - and the GUI is optional. A simple `sudo apt install bind9` and `sudo nano /etc/resolv.conf` should be added to your answer as alternatives. – B. Shea May 02 '17 at 16:16
I did everything but the setup is not working. I did `resolv.conf` to 127.0.0.1 at last. Can this fail it? `dig ubunut.com` says "connection timed out; no servers could be reached" – Satya Prakash Aug 10 '17 at 17:51
`$ gksudo gedit /etc/default/bind9` I changed RESOLVCONF=no to yes. and `$/etc/init.d/bind9 restart` Above two lines made it work. – Satya Prakash Aug 10 '17 at 18:17
Now `dig` is working but please show me where is those local DNS entry for each host? For my satisfaction. Seeing is believing. I Google failed. – Satya Prakash Aug 10 '17 at 18:36

score 9 · Answer 2 · answered Jan 22 '11 at 13:58

9

I would recommend dnsmasq,

See a nice tutorial here; http://embraceubuntu.com/2006/08/02/local-dns-cache-for-faster-browsing/

You may want to read a comparison here;

http://en.wikipedia.org/wiki/Comparison_of_DNS_server_software

answered Jan 22 '11 at 13:58

dblang

1,486
2
15
16

I use dnsmasq for DNS caching. Also supplied local mappings from /etc/hosts and DHCP (optionally using /etc/ethers.) – BillThor Jan 22 '11 at 22:52
I tried dnsmasq and it works as well as bind9 for caching name lookups, but it also does not seem to cache IP address lookups. Is this possible using dnsmasq? – Jan 25 '11 at 22:44
1

Beware Network Manager overwriting your resolv.conf each time it starts. – daithib8 Jun 06 '11 at 10:55

score 6 · Answer 3 · answered Jan 22 '11 at 15:55

6

"In order to speed up DNS lookups, I want to install a DNS cache or proxy."

Ok. But there's an easier way, too. Using OpenDNS and/or Google name servers will be faster than your own local cache for names that already exist in the OpenDNS/Google caches. Using 208.67.222.222, 208.67.220.220, and/or 8.8.8.8 as name serves will be faster almost all of the time. You can test this with time nslookup www.google.com 208.67.222.222 to test speed on one of the OpenDNS name servers, time nslookup www.google.com 8.8.8.8 for Google, or time nslookup www.google.com 127.0.0.1 on your local cache. When I say faster, I mean technically faster and not so much faster that a person could easily notice a difference.

"I can see at least three programs I think will do the job: bind9, pdnsd, or dnsmasq."

Are you open to the dnscache portion of djbdns? Instructions below. Though, it does not save the cache without a patch...

sudo apt-get remove bind9 dnsmasq-base
sudo apt-get install djbdns dnscache-run
sudo killall -9 dnsmasq
sudo update-rc.d -f bind9 remove

Then we'll need to tell the system to use our cache.

sudo gedit /etc/resolv.conf

Edit the file to look like this example. This file defines which name servers to use, the default domain, and the search suffix. The search suffix makes it possible to run queries using only the hostname portion of a fully-qualified domain name. For exmaple, 'nslookup www' automagically becomes 'nslookup www.example.com' when example.com is the value of the "search" parameter.

nameserver 127.0.0.1      # Use the local resolver first.
nameserver 208.67.222.222 # OpenDNS
nameserver 8.8.8.8        # Google
domain example.com
search example.com

This is a little fancy, but we need to get the lastest root name servers.

sudo dnsip $(dnsqr ns . | sed -e '/answer/!d;s/\(.*\)NS \(.*\)/\2/') | sudo tee /etc/dnscache/root/servers/@

I think the resolv.conf file is overwritten when we use DHCP. I choose to give myself a static IP address and remove the software that squashes it, editing the interfaces file to set up the static IP address. But you could try to work with Network Manager if you are so inclined.

sudo apt-get purge network-manager network-manager-gnome
sudo gedit /etc/network/interfaces

My interfaces file looks as follows, but modify yours to your configuration.

# Loopback
#
auto lo
iface lo inet loopback

# First network card (attached to NAT router, attached to cable internet)
#
auto eth0
iface eth0 inet static
address 192.168.1.254
netmask 255.255.255.0
network 192.168.1.0
broadcast 192.168.1.255
gateway 192.168.1.1

Now let's just restart.

sudo reboot

Now you are using a local resolver and the latest root servers. But you'll notice if you try that OpenDNS and Google are in fact answering faster (for names that are in their caches, which is all of the most popular domains). There is no additional configuration that could cause the software to become any more secure that it already is.

answered Jan 22 '11 at 15:55

Thanks Christopher. Can you explain why Google DNS is faster than my local cache? I believe its fast, but how could it be faster to go all the way to their server than to go my local cache? – Eric Johnson Apr 27 '11 at 07:16
Because chances are very good that it already has the answer without having to look it up again. – Jul 15 '11 at 19:34
@Christopher: But once your local cache has it, the lookups are instant. If you use Google DNS you have to wait 80 ms every single time you do a query. – Zan Lynx Dec 09 '11 at 00:59
@Zan Lynx Yeah.. so make your local cache ask Google. Woo-hoo! – Dec 09 '11 at 01:49
@Christopher I don't understand, seems to have missed the point. If you say Google DNS will be faster than our local cache, then why setup any of this at the first place? Just using Google DNS should be fine, no? Although my belief is local cached entries will be faster than Google DNS or any other. – Ashfame Apr 28 '12 at 08:18
@Ashfame I was basically just answering the question while noting that there are already great caches available (Google or OpenDNS). Google or OpenDNS will be faster almost all of the time on the first query (the query not already in a local cache); queries that have already been cached locally will always be faster. But, the local speed difference is only measurable, and not perceptible to users. So, yes, the very easy way to provide name resolution locally is to just use Google or OpenDNS. Their answers are almost always already cached. – Apr 28 '12 at 13:52
@Christopher, the other Google DNS is 8.8.4.4, not 4.4.4.4 (unless it has changed at some stage?) – thomasrutter Dec 13 '12 at 00:06
@neon_overload Oh, wow! Maybe so, but it was a typo to start! Thank you. Fixed thanks to you. – Dec 13 '12 at 01:35
6

Although @user8290 has a point, I wouldn't say using GoogleDNS is *faster* than a local one. Yeah, google has the results cached, but come on - if your international speed sucks, it doesn't matter even if Google had all the DNS results in the world. Local networks usually have 100mbps+ so asking the your local network dns server for an answer will be at least 10 times faster than asking 8.8.8.8/8.8.4.4 (depending on your international speed). Of course this is in terms you have the result cached on your DNS server. – tftd Jun 04 '13 at 02:10
Or, get the benefits of both worlds by simply adding to your bind9 options clause: `forwarders { 8.8.8.8; 8.8.4.4; }; forward only;` – Geoffrey Mar 12 '14 at 07:45
Downvoted. A non-local cache will never be as fast as a local one, notwithstanding the amount of records each cache stores. Of course, using BOTH a local and a remote cache will improve lookup performance. – ata Mar 27 '14 at 16:59
An alternative that you should look at is cloudflares opendns. https://1.1.1.1/dns/ Cloudflare already serves like 50% of the worlds DNS. So there opens dns servers will be even faster. – nelaaro Jul 03 '19 at 11:31

score 3 · Answer 4 · answered Jun 09 '11 at 15:22

I'm using "dnscache" (package "dnscache-run") and it's very simply. No need to configure anything.
It captures the DNS petitions (port 53) and it caches the responses, the next time that Linux ask for that domain, dnscache returns the IP immediately.
Although there are two parameters that can be changed to improve this program:

echo 16000000 > /etc/sv/dnscache/env/CACHESIZE
echo 16777216 > /etc/sv/dnscache/env/DATALIMIT

score 0 · Answer 5 · answered Jan 22 '11 at 22:59

Whichever tool you use, ensure that port 53 is not enabled incoming on your firewall. You may want to allow only the host with the cache outbound access.

DNSMasq is easy to setup, and well documented. If you install it on a firewall, specify the interfaces to bind to excluding the Internet interface.

Bind is more difficult to configure and may be overkill for as a cache for a small network. I believe the default configuration is caching only. You may want to add an ACL to restrict which addresses can use your server.

score 0 · Answer 6 · answered Jul 02 '15 at 22:30

The dnscache-run package has had the least conflicts with other packages, like libvirt, which use bridge networking and dnsmasq.

sudo apt-get install dnscache-run

This package removes resolvconf (/etc/resolv.conf), and you will need to use /etc/network/interfaces or network manager to view your configuration.

Best way to set up DNS caching?

6 Answers6

Linked

Related