30

In order to speed up DNS lookups, I want to install a DNS cache or proxy.

I can see at least three programs I think will do the job: bind9, pdnsd, or dnsmasq.

I would like to make sure that if I install one of I do not leave it poorly configured from a performance or security point of view. So, what would people recommend, and are there any configuration changes I should immediately make after installing?

2
  • For one workstation, right? Or are we talking LAN/ISP?
    – user8290
    Jan 22, 2011 at 19:48
  • Yes, this is to speed up individual workstations, not for a LAN.
    – user8979
    Jan 25, 2011 at 21:32

6 Answers 6

16
  1. Install bind9
  2. Point resolv.conf to 127.0.0.1

To do this follow this steps:

To Install Bind9

  1. Open "Ubuntu Software Center" (Applications->Ubuntu Software Center)
  2. Search for bind9
  3. Check to display "Technical Items"
  4. Mark bind9 and install it

Update /etc/resolv.conf

  1. Open Network Manager (System->Preferences->Network Manager)
  2. Find your connection and edit it (wired or wireless)
  3. Toggle "IPV4 configuration" tab
  4. On "DNS Servers" field write 127.0.0.1

It's done!

To test

Open gnome-terminal (Applications > Accessories > Terminal ) and type

dig ubuntu.com 

(if you don't have it, install dnsutils package as explained to bind9)

Check the last answers, as an example:

My first query at ubuntu.com

;; Query time: **209 msec**
;; SERVER: 127.0.0.1#53(127.0.0.1)
;; WHEN: Sat Jan 22 12:20:12 2011
;; MSG SIZE  rcvd: 196

My second query:

;; Query time: **0 msec**
;; SERVER: 127.0.0.1#53(127.0.0.1)
;; WHEN: Sat Jan 22 12:18:23 2011
;; MSG SIZE  rcvd: 156

The server 127.0.0.1 means that you're resolving locally. Take a look in query time (surrounded by **) , the second one is cached.

7
  • Thanks, Igor. I tried this approach and it works well for name lookups, but it does not seem to cache reverse IP address lookups. How would I do this using bind9?
    – user8979
    Jan 25, 2011 at 21:35
  • This didn't do anything on my setup. Query time is still ~100ms
    – Ashfame
    Apr 21, 2011 at 6:48
  • Both of you: if it doesn't seem to work, check what server dig says it got the answer from. If it doesn't say 127.0.0.1, then you haven't set it up properly. Note: The instructions for setting resolv.conf may be different for different versions of Ubuntu. Dec 10, 2012 at 0:17
  • So you are running a caching nameserver on gui box? Yes, it's possible of course.. More than likely most ppl reading this will have a server install - and the GUI is optional. A simple sudo apt install bind9 and sudo nano /etc/resolv.conf should be added to your answer as alternatives.
    – B. Shea
    May 2, 2017 at 16:16
  • I did everything but the setup is not working. I did resolv.conf to 127.0.0.1 at last. Can this fail it? dig ubunut.com says "connection timed out; no servers could be reached" Aug 10, 2017 at 17:51
9

I would recommend dnsmasq,

See a nice tutorial here; http://embraceubuntu.com/2006/08/02/local-dns-cache-for-faster-browsing/

You may want to read a comparison here;

http://en.wikipedia.org/wiki/Comparison_of_DNS_server_software

3
  • I use dnsmasq for DNS caching. Also supplied local mappings from /etc/hosts and DHCP (optionally using /etc/ethers.)
    – BillThor
    Jan 22, 2011 at 22:52
  • I tried dnsmasq and it works as well as bind9 for caching name lookups, but it also does not seem to cache IP address lookups. Is this possible using dnsmasq?
    – user8979
    Jan 25, 2011 at 22:44
  • 1
    Beware Network Manager overwriting your resolv.conf each time it starts.
    – daithib8
    Jun 6, 2011 at 10:55
6

"In order to speed up DNS lookups, I want to install a DNS cache or proxy."

Ok. But there's an easier way, too. Using OpenDNS and/or Google name servers will be faster than your own local cache for names that already exist in the OpenDNS/Google caches. Using 208.67.222.222, 208.67.220.220, and/or 8.8.8.8 as name serves will be faster almost all of the time. You can test this with time nslookup www.google.com 208.67.222.222 to test speed on one of the OpenDNS name servers, time nslookup www.google.com 8.8.8.8 for Google, or time nslookup www.google.com 127.0.0.1 on your local cache. When I say faster, I mean technically faster and not so much faster that a person could easily notice a difference.

"I can see at least three programs I think will do the job: bind9, pdnsd, or dnsmasq."

Are you open to the dnscache portion of djbdns? Instructions below. Though, it does not save the cache without a patch...

sudo apt-get remove bind9 dnsmasq-base
sudo apt-get install djbdns dnscache-run
sudo killall -9 dnsmasq
sudo update-rc.d -f bind9 remove

Then we'll need to tell the system to use our cache.

sudo gedit /etc/resolv.conf

Edit the file to look like this example. This file defines which name servers to use, the default domain, and the search suffix. The search suffix makes it possible to run queries using only the hostname portion of a fully-qualified domain name. For exmaple, 'nslookup www' automagically becomes 'nslookup www.example.com' when example.com is the value of the "search" parameter.

nameserver 127.0.0.1      # Use the local resolver first.
nameserver 208.67.222.222 # OpenDNS
nameserver 8.8.8.8        # Google
domain example.com
search example.com

This is a little fancy, but we need to get the lastest root name servers.

sudo dnsip $(dnsqr ns . | sed -e '/answer/!d;s/\(.*\)NS \(.*\)/\2/') | sudo tee /etc/dnscache/root/servers/@

I think the resolv.conf file is overwritten when we use DHCP. I choose to give myself a static IP address and remove the software that squashes it, editing the interfaces file to set up the static IP address. But you could try to work with Network Manager if you are so inclined.

sudo apt-get purge network-manager network-manager-gnome
sudo gedit /etc/network/interfaces

My interfaces file looks as follows, but modify yours to your configuration.

# Loopback
#
auto lo
iface lo inet loopback

# First network card (attached to NAT router, attached to cable internet)
#
auto eth0
iface eth0 inet static
address 192.168.1.254
netmask 255.255.255.0
network 192.168.1.0
broadcast 192.168.1.255
gateway 192.168.1.1

Now let's just restart.

sudo reboot

Now you are using a local resolver and the latest root servers. But you'll notice if you try that OpenDNS and Google are in fact answering faster (for names that are in their caches, which is all of the most popular domains). There is no additional configuration that could cause the software to become any more secure that it already is.

12
  • Thanks Christopher. Can you explain why Google DNS is faster than my local cache? I believe its fast, but how could it be faster to go all the way to their server than to go my local cache? Apr 27, 2011 at 7:16
  • Because chances are very good that it already has the answer without having to look it up again.
    – user8290
    Jul 15, 2011 at 19:34
  • @Christopher: But once your local cache has it, the lookups are instant. If you use Google DNS you have to wait 80 ms every single time you do a query.
    – Zan Lynx
    Dec 9, 2011 at 0:59
  • @Zan Lynx Yeah.. so make your local cache ask Google. Woo-hoo!
    – user8290
    Dec 9, 2011 at 1:49
  • 6
    Although @user8290 has a point, I wouldn't say using GoogleDNS is faster than a local one. Yeah, google has the results cached, but come on - if your international speed sucks, it doesn't matter even if Google had all the DNS results in the world. Local networks usually have 100mbps+ so asking the your local network dns server for an answer will be at least 10 times faster than asking 8.8.8.8/8.8.4.4 (depending on your international speed). Of course this is in terms you have the result cached on your DNS server.
    – tftd
    Jun 4, 2013 at 2:10
3

I'm using "dnscache" (package "dnscache-run") and it's very simply. No need to configure anything.
It captures the DNS petitions (port 53) and it caches the responses, the next time that Linux ask for that domain, dnscache returns the IP immediately.
Although there are two parameters that can be changed to improve this program:

echo 16000000 > /etc/sv/dnscache/env/CACHESIZE
echo 16777216 > /etc/sv/dnscache/env/DATALIMIT
0

Whichever tool you use, ensure that port 53 is not enabled incoming on your firewall. You may want to allow only the host with the cache outbound access.

DNSMasq is easy to setup, and well documented. If you install it on a firewall, specify the interfaces to bind to excluding the Internet interface.

Bind is more difficult to configure and may be overkill for as a cache for a small network. I believe the default configuration is caching only. You may want to add an ACL to restrict which addresses can use your server.

0

The dnscache-run package has had the least conflicts with other packages, like libvirt, which use bridge networking and dnsmasq.

sudo apt-get install dnscache-run

This package removes resolvconf (/etc/resolv.conf), and you will need to use /etc/network/interfaces or network manager to view your configuration.

You must log in to answer this question.