DNS resolver much slower in 2.5.0

pfnow

I have noticed that since upgrading to 2.5.0 DNS resolution is slower on all LAN clients compared to 2.4.5. It is very noticeable when browsing, it takes a second or two when opening a new site that was not cached.

I tried to use resolver with and without DNS sec as well as using it as forwarder with and without SSL, but it still lag. I might have to revert back to 2.4.5 if I don't find a solution as this is impacting user experience.

johnpoz

There have been many posts about unbound restarting.. Is yours doing that - if unbound is restarting a lot - that can present itself as slow dns.

pfnow

@johnpoz yes, I checked that and it doesn't look like Unbound is restarting. I just did a fresh install and restore and it still exhibits this behavior. DNS resolution works, but browsing feels so sluggish now.

johnpoz

Not seeing this at all... And one of my fav protocols is dns - I pay specific attention to how its working..

Do a simple test.. Restart unbound - that will clear the cache.. Now lets see how long something specific takes to resolve. Look in your status resolver.. You seeing timeouts, look at your infrastructure cache down at the bottom

Look at your recursion time numbers.

[21.02-RELEASE][admin@sg4860.local.lan]/root: unbound-control -c /var/unbound/unbound.conf stats_noreset | grep recursion
thread0.recursion.time.avg=0.547539
thread0.recursion.time.median=0.0664338
thread1.recursion.time.avg=0.090990
thread1.recursion.time.median=0.0453827
thread2.recursion.time.avg=0.348912
thread2.recursion.time.median=0.0495323
thread3.recursion.time.avg=0.394142
thread3.recursion.time.median=0.0511331
total.recursion.time.avg=0.298547
total.recursion.time.median=0.0531204

This is the avg or median time to do a full recursive lookup.. Ie not cached response time..

If you want grab the grc dns benchmark... Just put in your pfsense IP that unbound is on.. And run a benchmark.. What do the numbers look like

example..

If you think 2.4.5p1 was faster?? Then do a test with 2.4.5p1 and compare... I think I have some numbers from 2.4.5p1 posted around here somewhere... Let me see if I can find that thread..

edit:
I know I had posted something like this not that long ago - but can not seem to find it currently

pfnow

@johnpoz said in DNS resolver much slower in 2.5.0:

unbound-control -c /var/unbound/unbound.conf stats_noreset | grep recursion

Thanks for the detailed reply. The issue seems to be resolved now. I ended up with a clean install and reset the pfBlocker settings as I realized I had some misconfigurations (present even in 2.4.5). So I'm not totally sure what the cause or the fix was.

Although my results are not as good as yours, browsing feels snappy again:

johnpoz

Well numbers of time of recursion could vary for sure - depending on your location and what your looking up.. I don't know exactly what say for example that grc dns tool is using for its testing.. Its clearly a list of xyz.. Which for would could be different times to resolve depending on where your located and how well your isp peers, etc. to where you have to go look those up from the authoritative..

But as long as your not seeing some crazy times for avg and median your all good..