DNS Tweaks (This Is All Very Confusing)

[Bold_Fortune]

I don't fully understand DNS, so this is all very confusing to me.

If I have DNS Client Service disabled, why should I need to apply this tweak?...

Windows Registry Editor Version 5.00

;DisableDNSCaching
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Dnscache\Parameters]
"NegativeCacheTime"=dword:00000000 
"NetFailureCacheTime"=dword:00000000 
"NegativeSOACacheTime"=dword:00000000

Given that, why would this tweak be nesessary?...

Windows Registry Editor Version 5.00

;Improve DNS Resolution
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Dnscache\Parameters]
"CacheHashTableBucketSize"=dword:00000001
"CacheHashTableSize"=dword:00000180
"MaxCacheEntryTtlLimit"=dword:0000fa00
"MaxSOACacheEntryTtlLimit"=dword:0000012d 

The top tweak seems to Disable DNS Caching...while the bottom tweak appears that it would enlarge the size of the DNS Cache.

[iron2000]

I think the first one got to do with stopping the caching of negitive entries.

From googling:

"The cache contains both negative and positive entries. Positive entries are those in which the DNS lookup succeeded, and you were able to connect to the web site. When XP looks in the cache, if it finds a positive entry, it immediately uses that DNS information and sends you to the requested web site.

Negative entries are those in which no match was found, and you end up getting a "Cannot find server or DNS Error" in your browser. Similarly, when XP looks in the cache and finds a negative entry, it gives you the error message without bothering to go out to the site.

Negative entries can lead to problems. When you try to make a connection to a site that has a negative entry in your cache, you'll get an error message, even if the site's problems have been resolved and it's now reachable."

The second enlarge the cache so it could store more entries.

More entries->less DNS lookup->speedier

(I think)

[+BudMan MVC]

I don't fully understand DNS, so this is all very confusing to me. 

If I have DNS Client Service disabled, why should I need to apply this tweak?...

So you do NOT understand DNS - but you go an disable the Client service?? Why would you do such a thing?

http://www.microsoft.com/resources/documen...jj_ipa_vitx.asp

In a nutshell;

When the Windows XP Professional resolver receives a positive or negative response to a query, it adds that positive or negative response to its cache, thus creating a DNS resource record. The resolver always checks the cache before querying any DNS server, so if a DNS resource record is in the cache, the resolver uses the record from the cache rather than querying a server. This expedites queries and decreases network traffic for DNS queries.

There would be NO point to turning this service OFF, unless your machine does NOT use DNS.. Or you get all of your webpages from a proxy.. Basically If your on the NET, your using DNS!!

So why and the world would you turn off the client that allows for FASTER resolving of where you want to go??

[Bold_Fortune]

Thanks guys. I got it now.

"I think the first one got to do with stopping the caching of negitive entries."

"The second enlarge the cache so it could store more entries.

More entries->less DNS lookup->speedier"

I'm writing this down to remember it. Thanks, iron2000.

And thank you, Budman, for a great explaination.

Been disabling DNS for so long, I'm going to have to give enabling it a try.

[Bold_Fortune]

Poop. Now I'm even more confused. Budman makes a good point, but blkvipers says this:

DNS Client

Resolves and caches DNS names and Active Directory domain controller functions. This service is not required for DNS lookups, but if it makes you happy to have it running, you may. However, DNS Client is required if using IPSEC. If you attempt to "repair" your network connection and a dialog box complains that the "DNS resolver failed to flush the cache," this service is the reason.

Default XP Home: Automatic

Default XP Pro: Automatic

Safe Setting: Automatic

Log on as: NT AUTHORITY\NetworkService

Dependencies:

What service DNS Client needs to function properly:

TCP/IP Protocol Driver

IPSEC driver

What other service require DNS Client to function properly:

None

[OPaul]

Yea, it's not required. If you disable it all the lookups will be done by your ISPs DNS.

[Bold_Fortune]

Thanks, OPaul. That got it for me in a nutshell.

However, it leaves me with one more question...

Since I disable DNS Client, and "all the lookups are then done by my ISPs DNS," as you say, are the two tweaks I posted above applicable?

It seems to me I wouldn't be able to control my ISPs DNS Cache with these tweaks.

[Colin-uk Veteran]

if you disable the DNS service then improving the size of your DNS cache wont matter as you wont be using it anyway (because its disabled)

i would assume leaving it enabled would mean pages load quicker as it doesnt have to query the DNS server of your ISP

i dont think these tweaks would affect anything at your ISP.

[Bold_Fortune]

Thanks, Colin-uk.

So do you think that neither of these tweaks would be applicable if I disable DNS Client?

I know you said the "enlarging" the DNS Cache tweak would be unnesessary.

Would the "stopping the caching of negative entries" tweak also be mute?

[Bold_Fortune]

@iron2000. I've got something for you in the Discussions About Slimming Down Windows XP forum. Scroll to the bottom of the page...

http://www.hollow-refuge.net/Bold/viewtopic.php?t=347

[vincent]

I can hear Budman pulling his hair out right now.

Personally i don't touch DNS settings at ALL. If it ain't broke why fix it?

[+BudMan MVC]

If you disable the client than yes both of those tweaks are MUTE! And sure you can disable it -- BUT WHY? It provides a VALUABLE function.. If you turn it off.. you have NO dns cache.. every single time you go to a web page, your going to have to ask your ISP's dns.. every single TIME!! Even if it was just a second a go..

I just do not see the point of disabling that service.... Do you run a local caching nameserver? Might not be such a big deal then.. but if your going across a WAN connection for DNS queries.. it just makes no sense to disable that service..

You want to see how much dns traffic it can save.. Do a capture of your traffic, filter for dns with and without the dns client running.. during some typical surfing sessions..

edit: @ ripgut - not pulling any hair out.. Dumbfounded maybe.. I just do not get why someone would disable something that they admit they have no understanding of? Yes I can understand if you do not use the feature that service provides, and you UNDERSTAND what it is and does and how it interacts with the rest of the system, etc.. etc..

Do people really think MS just put services in that serve NO purpose? Sure the system can function with out a DNS cache.. Shoot it can function without a mouse as well - why not remove that? Sure that is sucking up more resources than the dns cache ;)

Edited June 1, 2005 by BudMan

[Bold_Fortune]

When I don't understand something fully enough, I usually turn to an expert. In this case, I had turned to blkviper and his advice on DNS Client.

Now I have two choices. Because I now have two different opinions from two different experts.

I guess I'd be flipping a coin either way...because I don't fully understand DNS Client.

Or, I could simply assume that Microsoft is the highest authority about it's own OS, and leave it at that.

Maybe dummies like me should just leave well enough alone.

I suggest we bar dummies from this Tips and Tweaks section of Neowin all together. Let's leave it to the experts who know all about what they are tweaking.

NeoWin can put up a big signpost for dummies at the entrance:

"Dummies like Bold who don't fully understand their operating systems should leave well enough alone.

If you don't question God, why on earth would you want to question Microsoft? Just click Default, dummy."

[iron2000]

Its stated here that a large HOSTS file slow down the PC and it offers the solution to disabling the DNS Client.

http://www.mvps.org/winhelp2002/hosts.htm

This is one reason to disable DNS Client.

[+BudMan MVC]

Its stated here that a large HOSTS file slow down the PC and it offers the solution to disabling the DNS Client.

http://www.mvps.org/winhelp2002/hosts.htm

This is one reason to disable DNS Client.

586003367[/snapback]

135K host file?? How many entries is that? Your kidding me right.. Do you have that? From a quick test, what you would have to something over 4000 entries in your host file to be over 135K..

Dude its your machine - do with it as you will.. Sure you can disable the service, and DNS will still work.. Shoot I run my own local caching server and I still run it.. there just is NO point not too..

I would HIGHLY suggest you grab a sniffer, say ethereal and setup a capture for DNS traffic.. log an hour or so of your surfing.. with and without the dns client running..

And to be honest I doubt loading 4k entries preloaded into your cache from host file would slow you down....

Do some queries to your ISP's name servers -- how fast are they? Surely not as fast as reading the entry from your RAM.. now is it ;)

[John Veteran]

When you visit www.neowin.net, your browser must find the IP address of the Neowin server, or where the domain resolves to. This action is called a DNS lookup. Every time you click a link, a DNS lookup is performed, because most links point to a domain name and not an IP address. To prevent thousands of DNS lookups for the same domain, operating systems use DNS caches to store the lookups. This means that when I first visit www.neowin.net and my browser receives neowin.net's IP address, that IP address is stored for when I click a link pointing to www.neowin.net/forum. When you think of how many times you click a link that point to somewhere on the neowin.net domain, that's a lot of DNS lookups ;)

Basically, it uses a small bit of RAM (it's nothing but a two-columned table I imagine, one for IP addresses and one for domain names) and saves a bit of network traffic.

[reaction]

Surely the point of disabling a cache is so that you get the most up-to-date information possible.

Enabling any cache means your puter will work faster, but possibly on inaccurate information.

Personally, I would leave the cache enabled. DNS changes are usually quite rare.

R

[aggrophobik]

I leave it enabled, but I clear it every so often. cmd > ipconfig /flushdns

[Marduk]

Can anyone tell me for sure if killing the negative cache is a good thing? I've read a few things saying it is.

[John Veteran]

Can anyone tell me for sure if killing the negative cache is a good thing? I've read a few things saying it is.

586077520[/snapback]

Unless you're in an environment where DNS records are constantly updated, leave it enabled. It will speed up your browsing and marginally lower your network traffic.

[j79zlr]

The problem is that XP caches failed lookups as well as successful ones. For example, if somesite.com's DNS server is poisoned or is down, XP will cache that, now when the server comes back online, you will not send a request for the new info since it is cached, and it will either resolve to the wrong address or report the server can't be found. Therefore I disable DNS caching, besides most DNS servers take less than 1/10th of a second to respond to a DNS query.

joe@wrkstn6 ~ $ dig google.com

; <<>> DiG 9.2.5 <<>> google.com

;; global options: printcmd

;; Got answer:

;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 37365

;; flags: qr rd ra; QUERY: 1, ANSWER: 3, AUTHORITY: 4, ADDITIONAL: 4

;; QUESTION SECTION:

;google.com. IN A

;; ANSWER SECTION:

google.com. 300 IN A 216.239.39.99

google.com. 300 IN A 216.239.57.99

google.com. 300 IN A 216.239.37.99

;; AUTHORITY SECTION:

google.com. 360 IN NS ns4.google.com.

google.com. 360 IN NS ns1.google.com.

google.com. 360 IN NS ns2.google.com.

google.com. 360 IN NS ns3.google.com.

;; ADDITIONAL SECTION:

ns1.google.com. 300 IN A 216.239.32.10

ns2.google.com. 300 IN A 216.239.34.10

ns3.google.com. 300 IN A 216.239.36.10

ns4.google.com. 300 IN A 216.239.38.10

;; Query time: 70 msec

;; SERVER: 64.105.202.138#53(64.105.202.138)

;; WHEN: Fri Jun 17 04:27:56 2005

;; MSG SIZE rcvd: 212

joe@wrkstn6 ~ $

[Bold_Fortune]

This is all great these pros and cons offered for DNS Client, but...

It still leaves my one question unanswered...

If I have DNS Client Service disabled, why should I need to apply this tweak?...

Windows Registry Editor Version 5.00

;DisableDNSCaching
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Dnscache\Parameters]
"NegativeCacheTime"=dword:00000000 
"NetFailureCacheTime"=dword:00000000 
"NegativeSOACacheTime"=dword:00000000

j79zlr has a great site where he offers some useful tips and tweaks, here... http://www.j79zlr.com/

If he (j79zlr) disables DNS Client as he says in his post above, why does he recommend this particular tweak on his site?

Is this tweak applicable if DNS Client is disabled?

[j79zlr]

I have that tweak above on my site because it basically disables the DNS Client, without disabling the service. I do not have any service recommendations on my site.

If you have already disabled the DNS Client service, that tweak does not do anything.

[Bold_Fortune]

Ah, finally. Thanks, Joe. Your word I do take on this subject.

Got a lot out of this thread. Thanks, people. :yes:

[+BudMan MVC]

Ah, finally.  Thanks, Joe.  Your word I do take on this subject. 

586080398[/snapback]

:wacko: I told you back in the start of the THREAD..

"If you disable the client than yes both of those tweaks are MUTE!

As to disabling the dns client because you do not like the neg caching feature.. Which also serves a good purpose.. if your dns server does NOT answer a specific query - what exaclty is the point of ASKING it constantly?

The default TTL for negative responses is 900 seconds (15 minutes). if you do not want negative responses to be cached, set the MaxNegativeCacheTtl registry setting to 0. Or you feel 15 minutes is too long - adjust to want you want..

As to DNS posionsing.. if a DNS entry has been poisioned.. guess what your ISP caching server is ALSO going to have the BAD entry.. And that entry will be there for the LIFE of the TTL.. so what exactly is the point of turning off your local cache?

The time your local cache will use for the TTL for positive responses is the lesser of the following values:

# The number of seconds specified in the query response the resolver received

# The value of the MaxCacheTtl registry setting.

# The default TTL for positive responses is 86,400 seconds (1 day).

So if I query my ISP's dns and I get back a TTL of 7 days.. I will only only cache it for 1 day "MaxCacheTTL setting".. Also if I the TTL is returned is less then 1 day.. Your local cache will store that..

For example - the ttl for www.google.com is 300 seconds

www.l.google.com. 300 IN A 64.233.167.104

So when I query my ISP DNS.. my local cache TTL will be set to what my ISP's dns has left on this TTL.. But NEVER will it be more than 300 seconds.. Which would be the MAX my ISP's dns would cache it for..

www.google.com

----------------------------------------

Record Name . . . . . : www.google.com

Record Type . . . . . : 5

Time To Live . . . . : 173

So your never going to cache an entry for LONGER than your ISP's dns will cache it anyway.. An by default no longer than 1 day.. So if my ISP has something cached for 1 day - be it right or wrong.. It will NEVER go look for another entry - until its cache has been flushed, or the TTL expires.. -- Do you have access to flush your ISP's dns cache??

So what exactly is the point of asking him "EVERY TIME" you want to know the IP address for www.google.com -- he is just going to give you what he has CACHED.. So why not pull that from memory?? Ie the whole point of your dns client..

You ask him for the IP - he tells you what he has, and how long its good for.. Your local cache will then store it for that long.. And not need to ask him again, until after he will have to recheck that host..

So your DNS server queries take less than 1/10 of second - normally.. How long do you think it takes to pull it from Memory? ;) Its about efficency.. There is NO point to query the same thing over and over again - when your going to get back the SAME answer.. It's like your kids asking you if "Are we there yet" every freaking minute on a 3 hour drive..

IMHO -- anyone suggesting that you disable the local dns client.. does not understand what the client does and how, nor how dns functions....