Tracking down a slow DNS lookup

The symptom was a command that paused for a few seconds before doing anything, every single time. A delay that is almost exactly the same on every run usually means a timeout, and in this kind of problem the timeout is often a DNS query.

Measure the lookup the way programs do

time getent hosts example.org

getent uses the system resolver, the same path most programs take. Tools like dig talk to a name server directly and can look fast while your application is slow.

Check what is configured

cat /etc/resolv.conf
resolvectl status

Look at the list of name servers. If the first one is unreachable, each lookup waits for it to time out before trying the next. That alone explains a constant delay.

IPv6 and search domains

• Some resolvers ask for an AAAA record and wait for it even when the machine has no working IPv6. Compare dig A and dig AAAA timings.
• A long search line in resolv.conf makes a short name produce several failed queries before the right one. Use fully qualified names (with a trailing dot) to confirm.

Fixing it

Remove or reorder the dead name server, or point the machine at one that answers quickly. After that the delay went away for me, and time getent hosts dropped to a few milliseconds.

← All notes