DNS reliability and performance

Topic

New Reply

Recently I have been having real issues with DNS lookups – with browsers, Chrome especially, giving DNS lookup errors on a frequent but intermittent basis and web browsing, particularly to new sites, being sloooowwwww.

My choice of DNS servers was the obvious culprit, so I downloaded the DNS checking tools from GMC and Google and tried those, but if anything it made it worse. The bottom line was DNS lookups (which are based on UDP) were being dropped somewhere (and I suspected my router), and it didn’t seem to matter which DNS servers I used. If I tried NSLOOKUP over TCP rather than UDP, it worked reliably and almost instantaneously, but over UDP it was unreliable and slow.

Rebooting the broadband router helped for a short while, but the problem came back and I couldn’t work out whether this was due to general internet traffic, my own other traffic, the router or something else entirely. The bottom line was sometimes it was reliable and sometimes it wasn’t.

In the end, I decided to look at how Windows uses DNS and came up with a solution which not only gives me reliable DNS lookups, but has given me the fastest web browsing I have ever had.

According to TechNet, Windows first tries your primary DNS on your primary network card, then your next DNS server on all network cards in parallel (but most people only have one card anyway), then the next DNS server on all network cards, then all DNS servers on all network cards. The default is 1 1 2 4 4 0, so it takes 4 seconds to query the first 3 servers, and then a further 8 seconds to timeout completely.

They key things in my mind were:

a. I am on broadband, so if packets are not being dropped then I should easily get a response in far less than a second.

b. If the network is acting reliably, then I should get a DNS response from the first server tried, but if the network is dropping packets for any reason, then I want to send out DNS requests in parallel as quickly as possible to enough DNS servers that one request and response will get through. DNS requests and responses are not large, so the bandwidth required for parallel requests would not be excessive.

My solution was as follows:

1. Set DNS Negative Caching TTL to zero – so any negative responses are not cached and Windows will try again (with a different DNS server) next time.

HKLMSYSTEMCurrentControlSetServicesDnscacheParametersMaxNegativeCacheTtl = DWORD:0

2. Set the DNS wait times to 1 1 1 10 10 0:

HKLMSYSTEMCurrentControlSetServicesDnscacheParametersDNSQueryTimeouts = MULTI_SZ:1 1 1 10 10 0

I wanted the total DNS timeout to be 20s-30s, and thought it unlikely that a DNS query would take more than 10s, so allowed a retry in case of a full network glitch and used 1 1 1 10 10 0 rather than 1 1 1 10 0.

3. Set the list of DNS servers as follows:

a. My own ISP’s DNS servers – closest so should be quickest.
b. Google’s public DNS servers
c. A few other public DNS servers
d. My broadband router’s DNS proxy.

Since I did this, my browsing has been rock solid and FAST!!

Hope this helps anyone else with a similar problem.

P.S. Obviously the fastest way to resolve a DNS lookup is from the cache, and I want to increase the cache effectiveness. I don’t seem to have many entries in the cache (30-40), the reason being that the TTLs are quite short. Some DNS entries have a very short TTL <60s with most <5m and all <30m. If anyone has any ideas on how to improve the time DNS entries spend in the cache, that would be welcome.

Reply | Quote

Replies

Hi Protopia,
I use OpenDNS, Primary 208 67 222 222 / Secondary 208 67 220 220 in my router.
I also set my pc to use the recommended MTU (Maximum Transfer Units) for my ISP (TalkTalk) which is 1432 and have never had any trouble. 36174-MTU

Reply | Quote

Well – we have been with plus.net for several years, and it is only recently that we have started having trouble.

But since I couldn’t find my fix elsewhere, I thought it might be nice to post here in case anyone else finds it useful.

Reply | Quote

Thanks for the informative post! Like Roderunner, I use OpenDNS in place of TalkTalk’s offering, but now you have me thinking that I don’t know as much about DNS as I thought I did (and that wasn’t a lot…). I’m going to have a play around tonight and see if I can avoid breaking anything. Our rural broadband is slow and unreliable anyway, at least until Openreach finish installing fibre to the cabinet, so I tend to blame any problems on that.

Reply | Quote

I have intermittent internet failures as well.
All I have ever done is list two DNS for the lan adaptor card. I never realized I could add more by using the advanced settings. I will try your registry changes and see if that helps.

Reply | Quote

Great post, great information. Many (!) thanks for the procedure(s).

Reply | Quote

Protopia,

This is an interesting thread and close to home. What I find perplexing is that on my home network I only have issues with my office computer doing this. In my case all but one system is wired Cat5e connected and the office computer connects directly to the modem/router. When I start to have problems I sometimes can’t even log into my modem to reboot, which has helped this computer. But if I use the computer next to it, a backup for the observatory and temporary weather server, I can log in and do whatever I want. I checked my registry and didn’t find either entry as you have listed on either computer. The symptoms are typical of yours but only on this one computer, out of 6. Rebooting the modem does clear the problem for a day maybe. This is a rural fiber DSL connection with typical speeds of 7-8 MBs and very reliable. The only changes to the modem have been port forwarding for remote access to the observatory and office computers using VNC.

I’ve hesitated using any kind of tweaking program as I don’t understand what the changes are doing. I’ve come to the point where I think I need to reload my OS (Win 7 Pro 64 bit) and get a clean install. It’s been a few years and there’s likely to be a lot of undesirable stuff that should be gotten rid of.

Thanks for your posting.

Reply | Quote

Protopia,

This is an interesting thread and close to home. What I find perplexing is that on my home network I only have issues with my office computer doing this. In my case all but one system is wired Cat5e connected and the office computer connects directly to the modem/router. When I start to have problems I sometimes can’t even log into my modem to reboot, which has helped this computer. But if I use the computer next to it, a backup for the observatory and temporary weather server, I can log in and do whatever I want. I checked my registry and didn’t find either entry as you have listed on either computer. The symptoms are typical of yours but only on this one computer, out of 6. Rebooting the modem does clear the problem for a day maybe. This is a rural fiber DSL connection with typical speeds of 7-8 MBs and very reliable. The only changes to the modem have been port forwarding for remote access to the observatory and office computers using VNC.

I’ve hesitated using any kind of tweaking program as I don’t understand what the changes are doing. I’ve come to the point where I think I need to reload my OS (Win 7 Pro 64 bit) and get a clean install. It’s been a few years and there’s likely to be a lot of undesirable stuff that should be gotten rid of.

Thanks for your posting.

Try these commands as an administrator from the command prompt pressing Enter after each, then reboot –

netsh winsock reset catalog
netsh int ip reset resetlog.txt
ipconfig /flushdns
ipconfig /registerdns

Reply | Quote

Try these commands as an administrator from the command prompt pressing Enter after each, then reboot –

netsh winsock reset catalog
netsh int ip reset resetlog.txt
ipconfig /flushdns
ipconfig /registerdns

I tried “ipconfig /flushdns” – I can’t remember whether it provided any short-term benefit, but certainly didn’t help for very long.

“ipconfig /registerdns” is nothing to do with this issue – this registers your PC with a DNS server (which is typically used for corporate networks and Windows Domains – and not used for Home networks).

Without having researched the details of what the other two commands actually do, they look to me like they might result in Windows losing your network configurations.

Reply | Quote

I tried “ipconfig /flushdns” – I can’t remember whether it provided any short-term benefit, but certainly didn’t help for very long.

“ipconfig /registerdns” is nothing to do with this issue – this registers your PC with a DNS server (which is typically used for corporate networks and Windows Domains – and not used for Home networks).

Without having researched the details of what the other two commands actually do, they look to me like they might result in Windows losing your network configurations.

Suggest you read these two articles –

http://www.windows-secrets.co.uk/2013/08/repair-the-windows-87vista-tcpip-stack/

http://compnetworking.about.com/od/workingwithipaddresses/a/ipconfig.htm

Reply | Quote

Suggest you read these two articles –

http://www.windows-secrets.co.uk/2013/08/repair-the-windows-87vista-tcpip-stack/

http://compnetworking.about.com/od/workingwithipaddresses/a/ipconfig.htm

The first link does not describe what the two “netsh” commands do – it just provides the commands. But if you read this microsoft knowledgebase article you will see that “netsh int ip reset resetlog.txt” does indeed reset the TCP connection completely wiping out your settings (“has the same effect as removing and reinstalling TCP/IP”) and if you read this other microsoft knowledgebase article then you will see that the “netsh winsock reset catalog” command “resets the Winsock catalog to the default configuration” and “should be used with care because any previously installed LSPs will need to be reinstalled” i.e. your firewall is likely to be disabled.

These commands are obviously not for the feint hearted, and decent research and diagnosis is needed to know if these will fix your issues or just make them far far worse.

If you read the 2nd link, you will see that the DHCP comment relates to re-registering your IP with your ISP, so only applies if your PC is connected directly to the internet and not via a home router.

Moral of the story: A little knowledge is a dangerous thing.

Reply | Quote

… What I find perplexing is that on my home network I only have issues with my office computer doing this. In my case all but one system is wired Cat5e connected and the office computer connects directly to the modem/router. … I checked my registry and didn’t find either entry as you have listed on either computer. The symptoms are typical of yours but only on this one computer, out of 6. Rebooting the modem does clear the problem for a day maybe.

These were exactly the symptoms that we had here – the wired PC was set to use the router’s DNS proxy, and the router was set to use OpenDNS. My wireless laptop had its own DNS settings and was more reliable not not perfect.

So I started experimenting, and after making it worse and doing a lot of research, I came up with this solution and not only did it make things much more reliable, but I was surprised that it also made it faster. The registry entry was not originally there – but if it is missing the default values I have talked about are used anyway.

I don’t have any firm idea what the cause of DNS unreliability was, but it is either the router’s ability to handle significant UDP traffic (of which I sometimes have quite a lot) or packet loss elsewhere in the network. My bet is on the router having issues with UDP because at times when I was having a LOT of issues with DNS lookups, if I used NSLOOKUP to use a TCP connection rather than UDP it was both reliable and blindingly fast – but then again this could be caused by routers in the ISP or elsewhere in the Internet being set to drop UDP packets (which are not guaranteed delivery) in preference to TCP ones.

My router is a fairly ancient Netgear one.

I’ve hesitated using any kind of tweaking program as I don’t understand what the changes are doing.

I agree that you should be careful if you don’t know what you are doing – there are a lot of “so called” tweaks on the internet which do nothing or which make things worse. (And I made things significantly worse tweaking DNS before I made them better.)

I’ve come to the point where I think I need to reload my OS (Win 7 Pro 64 bit) and get a clean install. It’s been a few years and there’s likely to be a lot of undesirable stuff that should be gotten rid of. …

Whilst an OS reload can improve things if you have tweaked and screwed them up, in my experience they are a lot of effort for nothing. (I would, however, reload from scratch rather than do an O/S upgrade e.g. from Vista to Win7.)

IMO, far better to tweak carefully using fixes that have been well researched, making careful backups of the registry entries before you tweak them is usually sufficient to undo any mistakes – and (so far at least) I have never done a tweak that broke windows so much that I couldn’t log-on to remove it..

Reply | Quote

Thanks Sudo15,

I have done this and will see where that takes me. Networking isn’t one of my strong points and I really should look deeper into it. As per my earlier post, I had changed Cat5E cables with known good ones, added a wireless adapter as well as a PCIe 10/100/1000 network adapter card. None had changed the behavior and I knew it wasn’t the modem/router as no other computers were acting this way. It wasn’t interference as the data/voice lines had been isolated at the box back soon after the initial install over a year ago when I was having to reboot the modem to get speeds back up every other day or so. None of that since then.

So I’ll keep an eye on this and see what happens. I appreciate the information.

Reply | Quote

Thanks

Reply | Quote

Thanks Sudo15,

I have done this and will see where that takes me. Networking isn’t one of my strong points and I really should look deeper into it. As per my earlier post, I had changed Cat5E cables with known good ones, added a wireless adapter as well as a PCIe 10/100/1000 network adapter card. None had changed the behavior and I knew it wasn’t the modem/router as no other computers were acting this way. It wasn’t interference as the data/voice lines had been isolated at the box back soon after the initial install over a year ago when I was having to reboot the modem to get speeds back up every other day or so. None of that since then.

So I’ll keep an eye on this and see what happens. I appreciate the information.

They are useful commands to make a note of for when you have what seem like anomalous connectivity problems.

Reply | Quote

The first place that is checked is not the dns servers its cache / hosts file.
It may have been corrupted / hacked by a virus leading to some crazy results.

Always flush the dns cache first when diagnosing dns problems.
And check the hosts file.
Its the hosts file that is preloaded into the cache so if its corrupt your cache is corrupt!!

This is a good article although in depth it gives a wider picture of DNS resolution.

http://technet.microsoft.com/en-us/library/cc961411.aspx

There is an app that checks DNS servers and gives you the correct order to put into you DNS fields.
Cant remember it offhand but google should elucidate.

Reply | Quote

The first place that is checked is not the dns servers its cache / hosts file.
It may have been corrupted / hacked by a virus leading to some crazy results.

Always flush the dns cache first when diagnosing dns problems.
And check the hosts file.

This is a good call. Some malware does use the HOSTS file to redirect traffic to the wrong site, but it can only really be done to well known / high-traffic sites like google and bbc.co.uk because it needs to specify each domain individually in the HOSTS file.

A friend recently had a different issue with both Google and BBC not working – she was using her router’s DNS proxy (no idea what it was set to), but was clearly having issues with DNS pollution – changing her DNS servers fixed the issue.

Its the hosts file that is preloaded into the cache so if its corrupt your cache is corrupt!!

Not strictly true – whilst the Hosts file is usually checked first it is not actually loaded into the cache – if you do an “ipconfig /displaydns” you will not find any hosts file entries in there.

There is an app that checks DNS servers and gives you the correct order to put into you DNS fields.
Cant remember it offhand but google should elucidate.

There are two such apps – the Google one and the Gibson Research (GRC) one. I tried both when I was having problems. However, they both reported a lack of reliable DNS servers, and in the end, when I had fixed the reliability I then chose servers which I knew to be both reliable and fast i.e. I started with

1. ISP servers (all of them)
2. Google (all of them)

and then added a couple of other servers which these two tools had found in order to provide servers which were sufficiently spread out on the internet that if there were connectivity issues somewhere in the internet away from my own ISP then I would hopefully get a response from somewhere. I have a feeling that Level 3 was one of them (I think they may provide some of the internet backbone links).

Reply | Quote

Well less than 24 hours after flushing the DNS and other commands above I’m back to about where I was yesterday before I ran them. It may actually have been sooner but I was connected remotely last night on and off checking my e-mails. I rebooted the modem again this morning and all was fine so I’m wondering, what affect does rebooting the modem have on this one computer? As I said before the other 5 network computers do just fine and haven’t needed this to be done. I usually use the computer sitting right next to my office computer to access the modem as mine is hit and miss on connecting. Again, both are Cat5E connected directly, the modem is in my office. I’ve switched wires and swapped outlets on the modem and no difference. I’m unclear what rebooting the modem does to my office computer other than reload the IP address? Or is it refreshing the adapters’s settings?

Reply | Quote

Rebooting the router empties it’s DNS cache, amongst other things. If you have the router as the DHCP server – this is the normal arrangement – the PC will use the router’s DNS. Try pointing your PC directly to an external DNS.

cheers, Paul

Reply | Quote

Rebooting the router empties it’s DNS cache, amongst other things. If you have the router as the DHCP server – this is the normal arrangement – the PC will use the router’s DNS. Try pointing your PC directly to an external DNS.

cheers, Paul

I’m guessing this is done by setting the DNS Server addresses in the IP4V settings and using manually added DNS server addresses such as 8.8.8.8 and 8.8.4.4? Those belonging to Google Public DNS I believe. I’ve entered these into both the wireless and on board adapters.

Reply | Quote

Yup, that’d be the correct method, but I’d use your ISP’s DNS servers first to try and narrow the problem to your network or your ISP.

cheers, Paul

Reply | Quote

Random redirected DNS is a symptom of a rootkit – have you done what i said and have you run an av and rootkit check?

Boot safemode with networking and test.
If it works you have a problem.

Or better still boot with a linux live cd and test – You have to isloate the problem – Computer , Network or External – Hirens is my first choice.

Reply | Quote

Random redirected DNS is a symptom of a rootkit

Could be – or could be a remote DNS server which has been compromised or could be something else entirely.

And a redirected DNS is very different to an unreliable one – that is a completely different symptom and needs a completely different solution.

Reply | Quote

Thank you for a very useful procedure!

Reply | Quote

It was my understanding that Windows reloaded the LSPs during the reboot when it was repairing the winsock – it certainly doesn’t seem to have affected anything other than to restore my browsing for me.

Resetting to defaults is standard procedure when dealing with corruption and resetting the winsock catalog and the TCP/IP stack are proven methods in restoring Internet connectivity without having any adverse effects.

MS even has an auto Fixit for resetting the TCP/IP stack.

Fair enough, I haven’t gone into the theory as deep as some, but I know what works without needing to, just as knowing an electric kettle will boil when you switch it on without having to know how electricity works.

You go onto any Internet specific troubleshooting forum and you will see MSVPs advising those same set of commands as I have and you will see the success rate without any adverse affects being reported.

If you want to know the nitty gritty, then no doubt there will be others on the forum more knowledgeable on the theory than me.

Reply | Quote

Fair enough, I haven’t gone into the theory as deep as some, but I know what works without needing to, just as knowing an electric kettle will boil when you switch it on without having to know how electricity works.

I don’t have a solid explanation for this one either, but I’ve seen a few cases where DNS quits working on specific Windows computers and the problem went away simply by significantly extending the lease time on the router. Most routers have a very short lease time by default, typically one hour. For a home network vs. a hotspot, one doesn’t need IP’s renewing frequently as topology is quite static. Changing the lease time to days or a week alleviated the problem.

Reply | Quote

I don’t have a solid explanation for this one either, but I’ve seen a few cases where DNS quits working on specific Windows computers and the problem went away simply by significantly extending the lease time on the router. Most routers have a very short lease time by default, typically one hour. For a home network vs. a hotspot, one doesn’t need IP’s renewing frequently as topology is quite static. Changing the lease time to days or a week alleviated the problem.

Yes, I’ve come across that fix as well.

Reply | Quote

“should be used with care because any previously installed LSPs will need to be reinstalled” i.e. your firewall is likely to be disabled.

LSPs do not sound like something I might want. Firewall’s being disabled aside sticking stuff in the TCP stack makes me nervous. I recently had a problem that may have been related to this. Has any one experience w/ Browsersafeguard.exe??

Just because you don't know where you are going doesn't mean any road will get you there.

Reply | Quote

LSPs do not sound like something I might want. Firewall’s being disabled aside sticking stuff in the TCP stack makes me nervous. I recently had a problem that may have been related to this. Has any one experience w/ Browsersafeguard.exe??

I’m not sure how resetting the winsock catalog or the TCP/IP stack and this http://malwaretips.com/blogs/browsersafeguard-virus-removal/ are related :confused:

The winsock and TCP/IP stack commands deal with browser and Internet connectivity problems not necessarily caused by the actions of a PuP and if you are using a 3rd party AV that has its own firewall, then Windows Firewall will be disabled anyway.

Reply | Quote

Sudo
I was working on a friends computer that would not load Google.com among other sites.
I was thinking Browsersafeguard.exe might have had something to do with this as it sets itself up as a proxyserver, but may have been a corrupted DNS cache. The sight I visited Bleepingcomputer.com had this:

BrowserSafeguard is a program that scans your web connections for threats and blocks them if detected. BrowserSafeguard is able to do this by configuring your web browser to use the program as a proxy server. This allows all traffic to be inspected as it is passed through the program.

This did not sound at all malicious and I left in installed. The link you sent gives me some second thoughts.
Thanks

PS where has the Thankyou button gone??

Just because you don't know where you are going doesn't mean any road will get you there.

Reply | Quote

Sudo
I was working on a friends computer that would not load Google.com among other sites.
I was thinking Browsersafeguard.exe might have had something to do with this as it sets itself up as a proxyserver, but may have been a corrupted DNS cache. The sight I visited Bleepingcomputer.com had this:
This did not sound at all malicious and I left in installed. The link you sent gives me some second thoughts.
Thanks

I use HitmanPro.alert which protects any browser that I open up and you may want to install CryptoPrevent which is also referenced and linked in the article http://www.thewindowsclub.com/hitman-pro-alert-review-free

I’d also seen that bleepingcomputer.com article as well so something didn’t seem right, but I prefer to side on precaution.

Reply | Quote

I am rather leery of Hitmanpro, IF my memory serves me I had to do my only restore in 11 years after playing with that. My memory is not my strong point and I might have got a corrupt file. On recs here I will look into it again.

And is it just me or is the thankyou button missing???

Just because you don't know where you are going doesn't mean any road will get you there.

Reply | Quote

It’s only a recent instalment for me, having learned about it on another forum, but it hasn’t caused me any problems and pops up to say everything is okay almost as soon as I click on the e to open IE.

This is different to HitmanPro which is a paid for scanner
http://www.surfright.nl/en/hitmanpro whereas the .alert one is a freebie browser guard – which doesn’t redirect

You are correct, removing the Thank you button was one of the “improvements” to the New Lounge. :rolleyes::)

Reply | Quote

You are correct, removing the Thank you button was one of the “improvements” to the New Lounge.

Need I say dopey??
And avatars are now MIA too??

Just because you don't know where you are going doesn't mean any road will get you there.

Reply | Quote

I had a phone call from a friend who could not load google.

I suspected that she was getting DNS servers from her router and that these DNS servers were polluted, and got her to change her PC network settings to use a selection of manual DNS servers and her problem went away immediately.

Not sure if that is the same problem as reported above…

Reply | Quote

I had a phone call from a friend who could not load google.

I suspected that she was getting DNS servers from her router and that these DNS servers were polluted, and got her to change her PC network settings to use a selection of manual DNS servers and her problem went away immediately.

Not sure if that is the same problem as reported above…

No, the problem was due to a malicious toolbar redirecting – Browsersafeguard which the link in Post #29 describes.

Reply | Quote

No, the problem was due to a malicious toolbar redirecting – Browsersafeguard which the link in Post #29 describes.

I reread those posts again, and nothing in those posts says that BrowserSafeguard was definitely the cause. The link says that this is software which prevents uninstalls. Other research suggests that this is software which shows web ads and possibly redirects web pages – but there is nothing in any post here which shows that this was the cause of google.com not being accessible.

So, Browsersafeguard might have been the cause – then again it might have been something else entirely.

Certainly, Browsersafeguard doesn’t sound like software you want to run on your computer though. So removal would probably be a good thing even if it doesn’t fix your google.com issue.

Reply | Quote

Browsersafeguard has piggyback installs that ride along with it, a Conduit software is one of those, it’s a Search hijacker: http://www.shouldiremoveit.com/Software-Version-Updater-9841-program.aspx

Reply | Quote

This discussion is getting somewhat off topic. The topic of this thread is “DNS reliability and performance”, and not about browser redirects caused by malware toolbars or viruses.

Reply | Quote

mea culpa
I promise to reform :rolleyes:

Just because you don't know where you are going doesn't mean any road will get you there.

Reply | Quote

Well – mea culpa also – I contributed to the digression!!!

Reply | Quote

Have we all kissed and made up now

Reply | Quote

Well wavy and I have. Þ~~~~~~~~~~ :p

Reply | Quote