But the Problem arises when it Comes to Resolution times. With my initial configuration I have an average resolution time of < 100ms. For that I am using this configuration:
With the TLS way the Resolution time increases to > 200ms. When I query one of those TLS DNS Servers directly via kdig, I get results in approx. 30-60ms.
Is this something that one has to live with when using TLS or do I have a configuration Problem on my end?
I am Aware that the „delay“ is only noticable when a host is actually not cached, but I was wondering why DoT (DNS over TLS) is bringing such a performance decrease.
I have tested both the configurations based on a few static Domains where I can clearly see, that using DoT is much slower.The strange Thing is that querying one particular resolver for one Domain with and without TLS (without unbound inbetween) give very similar Timings. So there must be something on Unbound side making the difference. My Question was whether this is a configuration issue or a given fact when using Unbound with TLS.
With the TLS way the Resolution time increases to > 200ms. When I query
one of those TLS DNS Servers directly via kdig, I get results in approx.
30-60ms.
Is this something that one has to live with when using TLS or do I have
a configuration Problem on my end?
I'm not sure if the following explains the difference between Unbound
and kdig (with +tls option?) performance. However, with the latest
release, Unbound has implemented TCP connection resuse/TLS session
resumption for downstream (Unbound clients), but not yet for upstream
connections (to authoritative name servers or as a forwarder to Quad9,
Google Public DNS, Cloudflare DNS, etc.).
This is something we expect to be supported in an Unbound release in the
coming months.
I'm not sure if the following explains the difference between Unbound
and kdig (with +tls option?) performance. However, with the latest
release, Unbound has implemented TCP connection resuse/TLS session
resumption for downstream (Unbound clients), but not yet for upstream
connections (to authoritative name servers or as a forwarder to Quad9,
Google Public DNS, Cloudflare DNS, etc.).
This is something we expect to be supported in an Unbound release in the
coming months.
You might want to test DNS-over-TLS performance with getdns Stubby. The
Stubby stub resolver does support TCP connection reuse/TLS session
resumption to upstream connections.
I have tried to set up stubby with my unbound Installation but failed due to issues with DNSSEC. I have decided to wait for the next unbound Version supporting Connection reuse. Do you have a Rough estimation for when it will be available?