DNS problems

B

brons2

Limp Gawd
Joined
Jul 16, 2008
Messages
503
I have a problem where recursive DNS lookups are taking a long time. My setup is, Windows/Active Directory DNS on the internal network, and BIND forwarders on the DMZ. The Windows hosts resolve internal queries themselves, and for things not on the local network (DMZ or Internet) they do recursive lookups against the BIND servers in the DMZ. The BIND servers look to the Root Hints if they don't have answer.

It seems that lately when recursively looking up a site that doesn't exist in cache, will take a long time to resolve. If you do an nslookup from the command line, often the first attempt will fail, but then if you immediately try again, it works. Here's an example:

C:\Documents and Settings\user>nslookup www.airliners.net
Server: (mywindowsDNSserver).(mydomain).local
Address: (private IP address)

DNS request timed out.
timeout was 2 seconds.
*** Request to thecb-dwpad1.thecb.local timed-out

C:\Documents and Settings\user>nslookup www.airliners.net
Server: (mywindowsDNSserver).(mydomain).local
Address: (private IP address)

Non-authoritative answer:
Name: www.airliners.net
Address: 69.64.153.151

I'm just having a hard time figuring out where the problem is. I have poured over all the settings many times and everything looks correct. One think I did do was lower the forwarding timeout from 5 seconds to 2 seconds, but that didn't help.

I ran Steve Gibson's DNS performance benchmarking tool, located at the following site: http://www.grc.com/dns/benchmark.htm

This confirmed my seat-of-the-pants impression of DNS. Cached and uncached local lookups were in the hundredths of a second, but dot com lookups were over 5 seconds. In fact all of the public DNS servers were faster on dotcom lookups than my own DNS server sitting 20 feet away.

I really don't want to pull out the recursive lookups because this setup has worked great for me for many years. I need to have multiple zones on the DMZ based servers because it will give different addresses for internal and external lookups of our websites on the DMZ (due to NATting...) and BIND is great for that. But I am about at my wit's end on this problem.

Any ideas?
 
Are your hosts in the DMZ experiencing the same problems?

What kind of firewall is in between your DMZ and trusted network?
 
Deads0uls said:
Are your hosts in the DMZ experiencing the same problems?

What kind of firewall is in between your DMZ and trusted network?
Click to expand...

It appears the problem must be in BIND as when I do nslookups directly against the BIND servers there are significant delays or timeouts.

Firewall is an ASA.
 
But that's what I *don't* want it to do, is add any sort of suffix for sites that are not on the local domain.
 
Deads0uls said:
You can set a primary DNS suffix in the properties of your network adapter.
Click to expand...

this is a red herring. The DNS suffixes added at the NIC level get appended when lookups fail, and then the lookup is reissued. You are seeing appended lookups because the external looksups are taking too long and the lookup is failing, and being reissued with the additional items appended. Adding additional suffixes to a NIC would just increase this without affecting your problem at all.

From the BIND server, do a lookup for some external address, say www.microsoft.com.

It sounds like in your case, it would take significant time if this was a new lookup and not already cached. Do a whois, and identify the DNS server responsible for the lookup you just performed.

Set that as the server in for resolution in nslookup from the server hosting BIND. Or use a publicly accessible DNS server like 8.8.8.8 or an OpenDNS server and perform the same lookup.

Was it faster, or did it take the same amount of time? If it responded much more quickly, its time to dig deeper into what BIND is doing. If it takes the same amount of time, you need to look at your outbound network connectivity and verify that the outbound connectivity of the server hosting BIND doesn't have an issue.
 
I've narrowed the problem down to the BIND secondaries, for sure. Unfortunately, I don't have access to those servers because they are run by an outsourced service provider. The service provider does not know what to do and is sort of throwing up his hands.

I think we are going to bring up another resource locally to do recursive lookups for now. We have some spare MikroTik router boxes that have 5 interfaces and can run some sort of DNS server. We're gonna try that first.
 
You must log in or register to reply here.
Back
Top