How to Find the Best DNS Server [1]

DNS servers are the most trusted component of your web browsing experience but few people understand how they work or how their security vulnerabilities can cause you problems. If you're not sure what it is then I recommend that you read both What DNS Servers Do [3] and if you plan to change your DNS servers then read How to Change DNS Server [4].

There are three sections in this how-to guide.

1. Before you start testing
2. How to run the tests using DNS Benchmark and namebench.
3. Further options to configure the testing software

These free programs will help find the best DNS servers for you

Two free utilities are recommended to help you to find the best DNS servers for your system: DNS Benchmark and namebench. Both can run on Windows, Max OS X, and Linux. These benchmarking programs use their databases of DNS servers to test those that will give you the best improvement. Both programs are portable (run without installation), use similar tests, and provide results that are roughly comparable. The differences in their tests are amplified by their different styles of reporting.

How do they work?

DNS Benchmark and namebench use processes and tests that are similar enough that I can discuss them together in this overview. While they using similar tests their results can be quite different and as you will see in the example tests namebench results are generally less reliable.

How often and how much time will I need to test?

You shouldn't have to test your DNS server speeds very often. Normally you would do it once and not do it again until you need to which i when

• you have problems (e.g. web-pages don't load or take to long to load); or
• you change your network configuration (e.g. change DNS server, change ISP, install a new router).

If the results seem unusual, e.g. your ISP's DNS server is taking a long time to respond, then run the tests again at a different time.

Of the two programs, namebench is much quicker for the more comprehensive test - I installed and ran the full test in about 10 minutes. I had installed and run the DNS Benchmark global server test in well under 5 minutes but you should run the more comprehensive test of regional servers to get the best rsults - that took closer to 45 minutes.

What is likely to be the best combination of DNS servers?

At home or in smaller organizations, your ISP is in the best position to provide speedy DNS resolution. In a large organization with its own private network or Intranet then you can run your own DNS server which also offers further options for administering your network.

To introduce some redundancy (alternative sources) your best performance is likely to be from from a mixture of DNS servers that are close to your location and a global network that has a large cache. For example:

• Your configured DNS servers 1 & 2 are provided by your ISP or Intranet
• Your configured DNS server 3 is a global network you select like Google or OpenDNS.

Check this list before you start testing

Only the DNS test program should be using the Internet connection

Your results will be affected by other traffic and may not be consistent with any later test. Likewise, any traffic on your local network can also impact the test results so consider turning off everything except the test computer and the other devices that you need to connect to the Internet, e.g. your router and cable modem.

Ensure that your firewall does not block the tests

If your firewall has outbound-blocking then it can block the tests. You might need to turn that off temporarily by following the specific instructions for each product.

DNS Benchmark firewall FAQ [5]

The first test is likely to be most accurate

The first test may test with DNS address requests that are not stored in the DNS servers cache. Any later tests will be running the same queries which should then be resolved from the server's cache meaning that it will be faster. That will still give you a very useful test result but it could disadvantage servers added to any later tests and it will make a difference to the proportion of requests that are resolved from the server's cache.

So if you have your own list of DNS servers that you want to test then now might be the time to use them. To do this you may need to create a custom list in DNS Benchmark or setup a configuration file in namebench.

Standardize the reporting of results, if you can

In DNS Benchmark if you are doing more than one set of tests and you want to compare the graphs then you will need to set the graph scales before starting the first test. Goto the DNS Benchmark menu and select Set Graph Scale. The graphs are automatically scaled to fit the longest response time. As two tests are unlikely to have the same worst time then the scales will almost always be out unless you set them manually.

Whereas namebench line graphs are set to 200ms and 3500ms the bar graphs have no fixed scale and cannot be standardized.

How to install the software

These programs don't have Windows installer programs so they won't create program folders, modify the registry, or create shortcuts on the desktop of start menu.

In this section I explain how to test using a real examples.

Testing with DNS Benchmark

You will very quickly notice that this program is very verbose. It always explains what is happening and the website provides much more detail on every aspect of its operation. This might put you off but if you follow the steps in this guide you don't need to know all the detail as I've included the main points here.

1. Start DNS Benchmark

To view the DNS servers click on the Nameservers tab highlighted above. You will have to wait about 10 seconds for the list of servers to be loaded.

Your system DNS servers will appear first in the list. The remaining servers are sourced from DNS Benchmark's list of global servers. The advantage of this approach is that you have the opportunity to refine the server list before testing.

At this point you can add or remove servers by using either of two menus:

• Click on the Add/Remove button to display the first menu shown below.
• Click on the system icon at the top left to get the system menu which is a superset of the Add/Remove menu.

.

• Your system DNS servers
• The default global servers
• Your own .ini file.

You can remove all servers to clear the list and start again. Once complete you can save your list to an .ini file.

There are two further options that you might consider to prune the list:

• Remove dead servers that are not responding. This is well worth doing.
• Remove redirecting DNS servers [7]. This might remove DNS servers that you want to avoid but it will also remove OpenDNS and other filtering DNS servers.

2. Run the global server DNS benchmark

I appear to be using my fastest DNS servers because they are indicated by darker boxes and they are the first three:

• Server IP address is in the first column
• Server status is in the second column.
  • The first three servers are the system DNS servers as indicated by the solid green circle. But the third 192.168.1.1 is my NAT router which acts as the default DNS resolver for any computers on the network.
  • The other servers are not the system DNS servers because they have hollow circles.
  • The colour of the circle indicates the quality of the connection:
    Green = good
    Orange = redirecting or hijacking DNS servers [7]
    Red = the server is not responding ie is dead. I remove dead servers so there are no red circles in the example results.
  • OpenDNS also has a blue circle around the server status. This indicates that IP addresses reserved for private networks are being blocked. There are four ranges of addresses so in this case three of the four are being blocked.
    Green = both IPv4 and IPv6 reserved private addresses are being blocked
    Blue = either IPv4 or IPv6 but not both reserved private addresses are being blocked

• The organization owning the DNS server is shown at the right.

The main results in red display the results of cached queries. These are the fastest possible resolutions of a DNS query becase the server already has the DNS record in its cache.

DNS Benchmark provides two particularly useful test results if you check the Show Uncached checkbox:

• Uncached queries (green) where the DNS server cache is bypassed.
• DotCom queries (blue) for major global websites (dotcoms) that are mainly located in the United States.

The servers that are reported to be fastest are my ISP's DNS servers. There is no need to change as I am already using them.

The UltraDNS server has a red bar displays over the server IP address on the left. This indicates that it is having a problem with lost queries. It is not a big problem because queries are lost all the time so they get retransmitted. If that were one of my DNS servers then I would test again at another time to see if it is a regular problem.

3. Create the regional DNS server list

The Custom Namerserver List is a list of your regional DNS servers that are likely to give you the best service. DNS Benchmark goes through its database of nearly 5,000 DNS servers to find those that are likely to perform best for you. It creates the list and then you can run the benchmark.

• Resolved = those you can use
• Refused = those that reject your queries maybe because you are in a region that they don't service
• No reply = dead servers

4. Run the regional DNS server benchmark

The regional DNS server benchmark runs immediately the custom server list is completed. In every other way it is the same as the default server benchmark.

5. Analyze the results

DNS Benchmark displays the results as it works so you will quickly be able to see which DNS servers are performing the best. I've drawn a few conclusions from the set of final results displayed at right. Note that DNS Benchmark allowed me to save these results as an image file because a screenshot wouldn't show enough servers.

• By default DNS Benchmark gives you a better comparison of more servers than namebench which has to be configured to provide results for more than 10 servers.
• Servers in my country are the fastest. Like namebench, DNS Benchmark illustrates the same relationship.
• The results illustrate that the primary driver for DNS query time is the delay (latency) due to the distance between systems on the Internet. This network distance is roughly the same as geographical distance. You will notice the same sort of delay If you ever make a phone call to the other side of the world.

Query response time = network latency + server processing time

• The speed of the DNS server itself is far less important but does make a difference where several DNS servers are located in the same region.
• You can also see that DNS servers with lost queries tend to perform worse. The lost queries are indicated by the red bars overlaying the DNS server IP address in the left hand column. Seven of the eight New Zealand servers with lost queries are the worst performing in that group.This is likely to be the same in other countries

Remember that DNS Benchmark has several tabs to view the various results:

• Nameservers shows you:
  • Server name
  • Server owner
  • Server status
  • Server response times
    • Cached response times are displayed by default
    • Uncached response times are displayed by checking the box
• Tabular Data shows you the numeric results in a small table for each server. The formatting is text-based so you can export it to any editor.
• Conclusions provides you with a comprehensive list of conclusions and recommendations. These are clearly explained to guide you. In the screenshot below, I have only shown the start of the first of seven conclusions. It has a positive green tick so there is no action required. Where DNS Benchmark displays a red cross you will be advised what you should do to improve your configuration.

Here I show you the most important conclusion that DNS Benchmark correctly documents. My current configuration is correctly indicated and DNS Benchmark simply suggests that I swap my two ISP DNS servers.

ipconfig /all 

DNS Servers . . . . . . . . . . . : 203.97.78.43
                                    203.97.78.44
                                    192.168.1.1

6. After completing the benchmark:

The DNS server list will be saved in the default.ini file. As discussed above, you can amend the list or detete it and start again.

To save the results go to DNS Benchmark's System Menu and select 'Export last results to CSV file'. DNS Benchmark also provides for saving any of the results pages either as an image file (.png or .bmp) or a formatted text file (.rtf).

I altered my router configuration and it took effect the next time I restarted my computer and was assigned the DNS configuraton from the router:

ipconfig /all 

DNS Servers . . . . . . . . . . . : 203.97.78.44
                                    203.97.78.43
                                    192.168.1.1

Testing with namebench

1. Start namebench.

• Nameservers lists the IP addresses of your system DNS servers - fastest to slowest. You can delete them from the test or append other servers to the list.
  In this screenshot, 192.168.1.1 is an IP address reserved for private networks such as my NAT router which has two DNS servers defined. On my PC 192.168.1.1 is automatically assigned (by DHCP) from the router. 203.97.78.43 and 203.97.78.44 are my ISPs DNS servers that are manually configured for Windows.
• Include global DNS providers should probably be checkmarked. They will provide a good baseline for comparing other DNS servers. If you don't check this then you will only get results for the fastest DNS servers for your system.
  namebench defaults to 10 DNS servers so the more global servers that are included then the fewer regional DNS servers will be included. For the results graphs, namebench will usually only use the primary DNS server because it removes duplicated/backup/replicated servers so, for example, Google DNS will only count as one DNS server although Google has many servers and several IP addresses.
• Include best available regional DNS services should be checkmarked because these are often the your fastest DNS servers.
• Include censorship checks will include websites that are often censored because of political views, violence and hatred, gambling, etc. I don't bother testing them.
• Upload and share your anonymized results should be checkmarked if you want an easy way to share your results over the Internet. I hoped that Google would provide reporting from this database without running a benchmark - it hasn't happened in three years.
• Health Check Performance should be set to Fast (to query 40 DNS servers at a time) unless you have poor connection in which case set it to Slow (to query 10 DNS servers at a time).
• Number of queries defaults to 250 web sites for each of the DNS servers. You can speed up the tests by changing it to 50 which is the default for DNS Benchmark.
• Query Data Source determines where namebench gets its list of domain names to test. As well as five test scenarios , namebench can extract the information from Camino, Chrome, Chromium, Epiphany, Firefox, Flock, Galeon, Icab, Internet Explorer, Konqueror, Midori, Omniweb, Opera, Safari, Seamonkey, Squid and Sunrise.

2. Set to test both global and regional DNS servers

Before running the benchmark check that these two options are on. They should be on by default:

• Include global DNS servers
• Include best available regional DNS servers

3. Run the benchmark

First, namebench checks the connection quality and makes adjustments for the connection condition. That is why you should not have other Internet activity while running the tests.

namebench then selects the fastest to benchmark:

• checks the DNS servers are available to the test system
• performs TTL tests
• checks for cache sharing with replicated servers and then removes the slower DNS replicas
• selects the DNS servers for benchmarking

The DNS queries are sent to the selected DNS servers.

The results are then saved in html and csv formats.

Finally, the html results are displayed in the browser chosen for the test.

4. Analyze the benchmark results.

A. The report table

• namebench presents a recommended configuration for three DNS servers.
• The current primary DNS server is highlighted in pale yellow. You can see two other DNS servers above it. They are from other ISPs and it is there are good reasons for double-checking these results against DNS Benchmark which does not show them performing so well. They are smaller ISPs and the extra network hop would be expected to make them slower which is exactly what DNS Benchmark shows.
• In other circumstances a 16.8% improvement would a good reason to change my DNS servers. In this case, I would want to do further tests to confirm that the improvement is consistent. The red bar also indicates that there were timeouts for the proposed server. That is sufficient reason to retest,
• Replica DNS servers are indicated so you know which servers have backups available. Or in the case of my router it will appear as a backup of my ISPs DNS servers because that is where it goes to resolve DNS queries.

Click on the screen shot of the results to see the results of the test that I ran:

[8]

B. Bar graphs of response times

There are two types of graph presented. The first are bar graphs of the average and fastest response times. Note that each graph uses a different scale.

The averages response time is affected by the size of the DNS server cache. Global DNS servers perform much better because they have larger servers with larger name databases. OpenDNS, Google and UltraDNS are ranked fifth to seventh but still remain significantly slower than the closest DNS servers.

The second graph shows the fastest response durations. These are roughly proportional to the distance to my computer. The faster New Zealand DNS servers are grouped before the fastest Australian DNS servers which have are actually global servers like Open DNS and Google Public DNS.

For comparison, here are my graphs from two years ago. You can see that both the global and regional servers in Australia have improved their relative performance in their fastest response times which have dropped from 145ms to 45ms - that is impressive. It is due to the global servers being installed in Australia in the meantime. Yet the average response time is no better.

[9]

[9]

C. Line graphs of cumulative response times

The distribution graphs show what percentage of queries are answered in what period of time.

The first graph is for the first 200 milliseconds ie 0.2 seconds.

[9]

[9]

The second graph continues to the 3.5 second (3,500 milliseconds) default for the timeout. Although it is available when you first view the results, when you go to the website it will not be there. Instead the online results include sample index results for Wikipedia.com and Google.com.

This graph shows how the global providers though slower at the start can catch by the time all queries are completed. It is the long tail for the slower response times that will be noticeable when you are browsing. This is more important than the fastest response time because the best and worst are less than 1 second apart whereas the best and worst at completing queries will differ by 2.5 seconds or whatever the timeout is set to. So if you are prepared to live with slightly slower average response times then you can reduce the really slow and annoying response times by using a global DNS service.

Finally, the benchmark parameters are listed.

Testing with DNS Jumper

DNS Jumper is a quick and easy introduction to selecting a global DNS services. It is improving each year but the actual test results are too variable because only it only pings the servers which means the results can be significantly affected by many short-term effects. The sample server lists are much more limited than namebench and DNS benchmark which have thousands of servers compared with under a hundred here. But there are sufficient of the main global servers to provide some good options.

1. Backup your configuration

This is the main window showing your network card. I've selected the Quick Configuration button to do a backup of my DNS server configuration.

If you have more than one network card then select the network card that has your DNS server settings.

There is a button, Flush DNS, for you to empty the DNS cache. In past tests this flush has not been as effective as using the Windows/DOS command "ipconfig /dnsflush".

2. Add your servers to the DNS server list

Maintain the DNS Jumper database using the from the DNS Options button. Here I've manually entered the IP addresses for my ISPs DNS servers.

When I select the DNS Options button they are automatically transferred to the DNS Settings windows where I simply press the Add button to include them in the database.

3. Find the fastest DNS server

Find the "Fastest DNS" has lightning icon on the button. You can search on any of the lists. By default there are two: normal servers and security servers which provide additional security features like filtering of bad websites as OpenDNS does. In the screenshot below I've found the fastest security servers.

• Response time is displayed in milliseconds.
• If the DNS server is invalid or unavailable then the result will be "Error: Host is offline" - you can see that for the Norton servers.

4. Change your DNS configuration if you need to

One reason for including DNS Jumper is because it makes it easier to change your DNS configuration. So you can use it after running DNS Benchmark or namebench.

It is important to remember that DNS Jumper is not testing how long it takes for a DNS query to produce a response. It simply pings the server to get a measure of how far away the servers are. So two servers the same distance away from your computer will show the same response time as DNS Jumper does not measure DNS query response times or timeouts.

If you want to use the fastest servers then the final step is to select the "Apply Fastest DNS" button to save the change. Remember that you should have backed up your configuration first so that you can restore it if the change does not work as well as expected.

The average doesn't need to know about the configuration files and how to change some settings.

dnsbench.exe /domains domains.txt

2 character country code " - " server name "=" server IP address "," server IP address "," True or False
e.g. NZ - My setup=192.168.2.1,202.180.64.2, False

Using DNS servers for security

• What DNS Servers Do [3]
• How to Change DNS Server [4]
• Best Free DNS Server - coming soon
• Safe Computing in Under an Hour [12]
• How to Block Bad Websites [13]
• Best Free Parental Filter [14]

This software category is in need of an editor. If you would like to give something back to the freeware community by taking it over, check out this page [27] for more details. You can then contact us from that page or by clicking here [28]

Domain Name System, DNS, DNS server, DNS resolver, DNS resolution, DNS name server, Internet name server, namebench, DNS Benchmark, DNS Jumper