Performance

The response time of a DNS server can prove critical for the behavior of many other services, from the perceived responsiveness of a website through setting up calls in VoIP. With the Bind 10 installation for this article running on a virtual machine, the Linux Magazine test team conducted several comparative tests between Bind versions 9.9.2 and 10.

Figure 4 shows the results. Our choice of benchmarking tool was Dnsperf 2.0 by Nominum, a manufacturer of DNS appliances [4]. The tool uses a text file with records and types to query the A-record for host.local. The benchmark can then run the text file several times; for the auth server in this article, four records were inspected 10,000 times.

Figure 4: Average values from a benchmark conducted with Dnsperf: Bind 9 is faster.

We also tested the various storage options that Bind 10 offers (text file, SQLite DB, with and without memory cache). We had to use the default configuration for version 9.

In comparison, Bind 9 (at 3,400 queries per second) running on the same VM was just ahead of the quite obviously immature Bind 10. Dnsperf includes a second tool named Resperf for testing recursive resolvers; it first goes through a preheat phase, in which it fills the cache, before measuring the resolver throughput. Here, the test went even more obviously in favor of Bind 9, which managed about 3,000 queries per second compared with 1,600 for Bind 10.

Many Pitfalls

During the tests, yet more problems occurred. For example, after activating the cache for the zones that Bind 10 stored up in SQLite, we were only able to query the zones that were entered in the list of cache zones. We even had to enter the secondary zone that existed in the same SQLite database before we could query it. The fact that the auth server allows zone transfers by default is a 180-degree U-turn compared with the behavior of previous versions. Careless administrators are certainly at risk.

Gentoo users need to ensure that they build Python 3.2 with the sqlite useflag; otherwise, the components that use Python do not work because they cannot access their configurations without this flag.

What is also currently missing is a way of listing the configured zones. An inquiry on the mailing list resulted in constructive suggestions on how to resolve this in certain configurations. A representative of the ISC confirmed both the absence of the feature, as well as the ongoing efforts to add it.

If you use ACLs for primary or secondary zones in your existing installation of Bind, or if you use views in Bind 9, you need to be aware that these features are not possible with the standard Bind 10 tools. Again, the authors of the Linux Magazine test received a negative response on the Bind mailing list. This may change once Bind 10 becomes more widespread outside of provider environments. Right now, these missing features might already be criteria that prevent migration.

Radical Cure Without Benefits

Bind 10 means radical change, without the administrator being rewarded with benefits that justify the effort. Although its newly acquired modularity makes Bind more easily customizable and more versatile, which might also be useful for an Internet provider who offers many primary zones, the functional limitations, such as the lack of views, and especially the lack of an option for running the authoritative and recursive name servers on one machine, might limit the use of Bind 10, at least for many administrators of corporate networks.

The DHCP component is, at most, recommended for experiments only and lives up to the warnings on the website. It would also have made more sense to use the command-line utility for managing zone content; however, this option is completely ruled out, and as long as Bind 9 still outperforms Bind 10, as the benchmark in this short article suggests, corporate admins really have little incentive to upgrade to the new version.

options {
  [...]
  allow-recursion { 10.1.0.0/16; 127.0.0.0/8; ::1; };  [...]
}