6

Recently, one of my ISPs DNS servers got into trouble. To quote the support desk personnel it "wasn't completely down so connections were just infinitely slow". My application was down for a couple of hours, as it couldn't connect to critical services on other machines.

While I have redundant DNS servers in my /etc/resolv.conf file, it appears that this slowness wasn't enough for the DNS client to declare the DNS server is down, and to fallback to a secondary DNS server.

I fear this sort of problem could strike again, so I have been reading up on Ubuntu DNS configuration. There appears to be a timeout option with a default of 5 seconds, but that doesn't seem to have worked here.

Q1: Is there a log file where I can see the DNS attempts and confirm my understanding that the timeouts didn't trigger?

Q2: What do I need to do to implement such timeouts, and protect myself from such DNS issues again?

For the record, my /etc/resolv.conf file (expurgated):

search localhost
nameserver IP.addr.ess.1
nameserver IP.addr.ess.2
nameserver IP.addr.ess.3

I'm running Ubuntu 9.10 (Yeah, yeah, I hope to get a quiet period in December to upgrade.)

1 Answer 1

4

You can try changing your DNS servers with Google's ones. It might be unfeasible if your ISP blocks external DNS queries, though.

I suggest you install a local DNS forwarding/caching nameserver such as pdnsd, which is highly configurable. Then you put nameserver 127.0.0.1 in your /etc/resolv.conf; pdnsd takes care of forwarding requests to other nameservers, or resolves lightning fast from the local cache. You can also configure a timeout after which a nameserver is considered to be non-responsive, so it would seem to fit your needs.

Pdnsd also supports parallel access to multiple DNS servers, so if one is slow the application will not be slowed down. It even supports this with fail-over servers (e.g. contact first two servers in parallel; if they don't respond, contact two more, and listen for responses from all four servers, etc.)

From the aptitude description:

pdnsd can be used with applications that do dns lookups, eg on startup, and can't be 
configured to change that behaviour, to prevent the often minute-long hangs
(or even crashes) that result from stalled dns queries.

Security note: pdnsd is (self-confessed) not safe for outsiders to access: if your machine is out on the Internet, you need to configure a firewall to only allow local machine access.

3
  • Are the Google ones particularly reliable? Will look into pdnsd. Aug 31, 2011 at 13:17
  • @Oddthinking I'm using pdnsd caching directly from the root servers in all my PCs, but my coworkers have been using Google's DNSs without a problem for more than a year now. Before that we all used OpenDNS in the office without problems. You might want check into those, too Aug 31, 2011 at 14:06
  • 2
    A good pdnsd alternative is dnsmasq.
    – jdthood
    Feb 14, 2013 at 18:49

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .