General Discussion
  >> General Broadband Chatter


Register (or login) on our website and you will not see this ad.


Pages in this thread: 1 | 2 | [3] | (show all)   Print Thread
Standard User zzing123
(member) Tue 14-Sep-21 02:18:25
Print Post

Re: Learn me DNS over TLS


[re: Oliver341] [link to this post]
 
Technically yes, but practically, no.

The reason being is that the personal DNS server will have a much cleaner cache tailored to your consumption and cache sizes even for the big shared servers don't actually need to be very big. DNS records all have TTL's and have to be expired all the time. Cloudflare for example defaults TTLs to 5 minutes, so any DNS server whether a big shared one or a personal would have to requery the record every 5 minutes - a lot more often than you think.

The cache is useful for a session of a batch of requests such as the 20-100 or so loading a web page, but not really for any long term memory. The thing that differentiates performance of the bigger DNS servers is purely connectivity, as they are connected via a much higher quality connections and via multiple peers, massively reducing latency and also allows them to use anycasting (making 1.1.1.1 and 8.8.8.8 appear to be nearby wherever you are in the world) rather than going through the ISP's cruft then to the Intertubes via god knows who's peerings to the DNS servers.

DNS and DNS servers are smart though. There are 13 root servers geographically dispersed and all using anycasting that mean they're PDQ to get a request back to you, and DNS servers utilize prefetching and a lot of threading to parallelise queries as much as they can.

It's just whether you deal with an authoritative DNS server directly (ie the server with 'master' DNS record) and whether things like DNSSEC and authentication of records also matter to you where the preferential difference is. Most people will use Cloudflare or another cloud DNS provider to host DNS records, and these authoritative servers themselves are anycasted, meaning they'll be pretty fast too. Only in very rare cases where you're dealing with a bonkers sysadmin who insists on running their authoritative DNS server at the end of a 3G line that you'll see a problem... but so will the big shared server.

But you can also use unbound with forwarding to a shared server, and even use DoT with it if you really must and then you can just "cache the cache", which is exactly what dnsmasq that most consumer routers use does. But practically speaking there's no real difference in performance by querying the root servers recursively using DNSSEC and trust the authoritative server only for the actual authenticated DNS record. But having the cache locally on your network is 100% the fastest option - it's just how it's set up to query records upstream that matters.
Standard User smouty
(member) Tue 14-Sep-21 11:28:38
Print Post

Re: Learn me DNS over TLS


[re: zzing123] [link to this post]
 
Yeah. For non-cached lookups on Pihole (with unbound) I see queries in the 70-80ms region which is un-noticeable in use and once cached about 0.1ms.

OPNSense
PiHole
Unifi for Wifi
Pages in this thread: 1 | 2 | [3] | (show all)   Print Thread

Jump to