Why are only com/net/org slow?

10 msg	Master <--> slave named.conf 'auto-genera...
1 msg	Recursive and non-recursive
5 msg	Anyone still interested in Philip Hazel's 'make...
2 msg	How can I find out who is my domain name server...
2 msg	How to configure a dns server without internet ...
9 msg	network tools

Why are only com/net/org slow?
\ W Sanders (11 Mar 2008)
. \ Kevin Darcy (12 Mar 2008)
. . \ Peter Dambier (12 Mar 2008)
. \ Mark Andrews (12 Mar 2008)
. . \ John Wobus (12 Mar 2008)
. \ Bryan Irvine (12 Mar 2008)
. . \ W Sanders (12 Mar 2008)

13 msg	bad horizontal referral ?
3 msg	Limit queries per IP address.
6 msg	Is NSEC case sensitive while being signed?
4 msg	getting CNAME to work for www.domain.com equals...
5 msg	named selectively denies recursion
8 msg	DNS 'A' query for a single dot
2 msg	configure: error: BIND 9 libraries must be inst...
1 msg	multiple ips per name server
3 msg	Is 'domain' a valid directive ?
2 msg	Doublt about DNS Client...
2 msg	how do overlapping views work in bind?
6 msg	Transferring of zones that use view.
9 msg	Bind9 - Reverse net /20 mask 255.255.240.0

Subject:	Why are only com/net/org slow?
Group:	Bind-users
From:	W Sanders
Date:	11 Mar 2008

This doesn't seem to have much to do with BIND, but it's one I have not
seen before. We operate some cache-only DNS servers for customers to
point their resolvers to. Most of these are running BIND 9.4.1+.

On all the hosts I've tested so far, when I do a

dig @ourserver somedomain.com
dig @ourserver somedomain.net
dig @ourserver somedomain.org

it takes 4+ sec to get the initial non-cached response, whether valid
or
NXDOMAIN, back from com/net/org. In fact org often *hangs*.

All other TLDs, and ".", are fast and behave as expected.

I can reproduce this from several of our cache-only servers, in a
variety of geographic locations.

It's killing people who are (ab)using our servers to lookup up DNS
records for antispam purposes, since spammer's garbage domain names
will not be cached, and take a while to look up or even time out.

It's most likely some bizarre problem on our networks (we have a lot of
split routes etc), especially since .org hangs occasionally for valid
name lookups. I haven't the foggiest idea how to debug this
further. Anyone seen this?

Thanks - W Sanders
http://wsanders.net

________________________________________________________________________________ ____
Be a better friend, newshound, and
know-it-all with Yahoo! Mobile. Try it now. http://mobile.yahoo.com/;_ylt=Ahu06i62sR8HDtDypao8Wcj9tAcJ