Slow DNS after 22.05

rcoleman-netgate

@jax What are you seeing when you go to the Diagnostics->DNS Lookup page?

Jax

First try: about a 9 second wait followed by the correct answer.
Second try: about a 22 second wait followed by the correct answer.

The pfSense display shows that 127.0.0.1 is timing out.
I have no idea why the Netgate device is querying itself.
As soon as it queries the next device upstream it gets an answer.

Name server 	Query time
127.0.0.1	938 msec
192.168.xx.xx	48 msec

Jax

@rcoleman-netgate

Ha! In General Setup -> DNS Resolution Behavior I chose "Use remote DNS servers, ignore local DNS" and things look better now. We'll see if that fixes it.

rcoleman-netgate

@jax Sounds like DNS Resolver is stopped.
Go to the Service->DNS Resolver page and click the "start" icon in the header, of Status->Services and click it there.

FWIW reliance on the ISP DNS servers may result in being handed misleading DNS records. Remember when ISPs would resolve unresolving IPs and pass you to a search page? This helps you avoid that, among other things.

Jax

@rcoleman-netgate Okay, I restarted the DNS Resolver and have set the DNS Resolution Behavior back to use local DNS with fallback to remote. We'll see how this goes.

Cool_Corona

Do you run Suricata by any chance??

Jax

@cool_corona No, I don't.

Jax

@rcoleman-netgate Goes back to lousy performance. I've set it back to using remote DNS.

Cool_Corona

@jax Do you have any DNS specified in general settings??

Jax

@cool_corona No, no specified DNS servers. It's just using the default, the upstream WAN DHCP-assigned server.

Cool_Corona

@jax Can you pls. uncheck it

No DNS server overrides and test again.

rcoleman-netgate

@cool_corona What package(s) are installed?

Jax

@cool_corona Trying it unchecked with local + fallback.

Jax

@rcoleman-netgate no packages installed, just the default Netgate installation

Jax

@cool_corona Testing with no dns server overrides as you suggested seems to give me the same good performance that was only achieved previously by bypassing the pfSense resolver.

Can you explain this a little bit, please?

Cool_Corona

@jax It overrides the WAN DHCP DNS provided by your ISP provider and that can take some speed out of the equation.

You dont have to handshake and verify the DNS by the ISP and oes directly to the 13 root DNS servers.

Jax

Hmm, there still seems to be weird intermittent slowness in name resolution.
I dunno. This may be beyond my personal ability to debug.

Jax

The slowness seems to be mostly focused on cdn services.

Jax

This is really quite frustrating, I'm not getting anywhere debugging this slowness problem.

bmeeks

@jax said in Slow DNS after 22.05:

This is really quite frustrating, I'm not getting anywhere debugging this slowness problem.

The first step in troubleshooting is to isolate the problem. Since you've tried a number of things on pfSense itself, why not take pfSense's DNS completely out of the picture?

Do this -- in the SYSTEM > GENERAL SETUP page, down in the DNS Settings area, put 8.8.8.8 (the Google DNS server IP) in the DNS Servers box. Save that change.
Next, go to SERVICES > DHCP SERVER and in Servers in the DNS Servers box also put 8.8.8.8. This will tell the DHCP server to give your LAN clients the Google DNS server for name resolution.

Now pfSense is out of the picture unless you have created any DNS related firewall rules previously. See how things behave with this test setup. If things are good, then you can assume you are having issues with unbound on your box when using the default settings. Those default settings configure the DNS Resolver to "resolver mode" and hand out the address of the pfSense box as the DNS server for your DHCP clients.

If things are still poor, then pfSense it likely not at fault here (assuming you don't have a firewall rule in the way), and you need to look elsewhere for the problem.

If you have any DNS related firewall rules, make sure you are allowing both UDP and TCP for port 53 as some DNS lookups will need to use TCP.