Technitium DNS at ISP Scale

[Anime4000]

Would you recommend using Technitium DNS as a recursive resolver for an ISP?

Public DNS providers such as Google Public DNS and Cloudflare DNS impose query rate limits. This can become a problem for customers behind CGNAT, where many users share the same public IP address and may collectively hit those limits.

To address this, I am considering deploying Technitium DNS as my own recursive resolver and allowing unlimited queries from the CGNAT range (100.64.0.0/10).

My network currently serves around 2,000 PPPoE subscribers and handles approximately 30 million DNS queries per day.

All customers benefit from network-wide ad blocking at the ISP level. The current DNS architecture is:

┌───────┐     ┌───────────┐     ┌────────────────────────┐
│ PPPoE ├──┬──┤ AdGuard 1 ├──┬──┤ Technitium Recursive 1 │
└───────┘  │  └───────────┘  │  └────────────────────────┘
           │                 │
           │  ┌───────────┐  │  ┌────────────────────────┐
           └──┤ AdGuard 2 ├──┴──┤ Technitium Recursive 2 │
              └───────────┘     └────────────────────────┘

Technitium DNS performs well over IPv4, but response times over IPv6 are significantly slower:

Pururin Resolver      MY/CJ1   151.158.198.49       23ms    13     expired ≠ DIFFERS  147.136.175.194
Pururin Resolver      MY/CJ1   151.158.198.24       13ms    30     7s      ≠ DIFFERS  147.136.175.194
Pururin Recursive     MY/CJ1   2402:4e20:b00b::1111 989ms   60     38s     ≠ DIFFERS  147.136.175.194
Pururin Recursive     MY/CJ1   2402:4e20:b00b::1001 1780ms  60     39s     ≠ DIFFERS  147.136.175.194
Pururin Recursive     MY/CJ1   192.168.89.102       43ms    30     7s      ✓ OK       134.65.77.134
Pururin Recursive     MY/CJ1   192.168.89.101       35ms    30     7s      ✓ OK       134.65.77.134

Has anyone deployed Technitium DNS at a similar scale? I would be interested in hearing about your experience regarding performance, cache efficiency, IPv6 behaviour, and overall stability in an ISP environment.

[ShreyasZare]

Thanks for asking. I know of 3 ISPs that are using Technitium DNS Server as a recursive resolver and directly as a DNS server for clients. Once of the ISPs is frequently in touch with me and have their deployment in 3 cities. They have traffic in between 100k and 200k per minute being served with no issues.

There are a few settings needed to be done to optimize performance:

• First is to make sure "Cache Maximum Entries" value in Settings > Cache section is set to a high value. You can initially start it with 100K value and then observe the "Cache" value in stats shown above the Top Clients table on Dashboard. If the stats value on dashboard is near the "Cache Maximum Entries" limit then it means the cache is full. If server has enough memory, the "Cache Maximum Entries" value can be kept on increasing if the cache is getting full. Having large number of data cached helps improve performance significantly as it reduces load on the DNS server to frequently resolve domain names.

• It is also recommended to keep Serve Stale enabled with "Serve Stale Max Wait Time" value set to 0 to help reduce pressure on the internal queues to improve performance with large query volume. Also, disable Prefetching by setting "Prefetch Trigger" to 0 since with wait time set to 0, prefetching is not really required.

• At large scale, you also need to enable the "Enable In-Memory Stats" option in Settings > Logging section so that only last hour stats are collected by the DNS server. The stats module otherwise can take up a large amount of memory as it tries to aggregate stats for all incoming queries. Thus limiting it to collect only last hour's data helps use less memory and avoid any performance impact. If you need query logs, its best to use the Query Logs (MySQL) app to collect data onto a MySQL server running on a separate server.

• You also need to make sure that query rate limiting is disabled or set to adequate value. The Queries Per Minute options in the Settings > General section can be used to configure rate limiting.

• It is also recommended to add Secondary Root Zone as it will handle random string queries that some applications use and avoid frequently querying root servers.

Technitium DNS performs well over IPv4, but response times over IPv6 are significantly slower:

It is recommended to not use Prefer IPv6 option as it can cause delays in resolution. Instead just using the Enable IPv6 option would work much better. Also ensure that "Resolver Concurrency" is set to 2 so that the resolver tries concurrent requests to name servers to improve performance.

There are some known issues with IPv6 deployments and that also is a reason why resolution is slower for some domain names. There is nothing that can be done about this though since its an issue with those name servers itself.

[Anime4000]

I run two Technitium DNS in separate LXC, and AdGuard run parallel query to Server 1 and 2, however Server 1 give a lot Server Failure compared with Server 2.

I noticed when AdGuard query same domain multiple time, Technitium DNS return NX Domain and block it.

I liked Technitium DNS compared with PowerDNS because quick to setup and all feature available in one package.

[ShreyasZare]

I run two Technitium DNS in separate LXC, and AdGuard run parallel query to Server 1 and 2, however Server 1 give a lot Server Failure compared with Server 2.

Please check for error logs in Logs > View Logs to find out the reason for Server Failure response. That will tell you why and help to fix them.

I noticed when AdGuard query same domain multiple time, Technitium DNS return NX Domain and block it.

Technitium DNS Server does not generate NXDOMAIN response on its own unless the domain was blocked with a block list. You need to test the domain name using DNS Client tab on the admin panel to find out the reason for NXDOMAIN response.

[Apachez-]

Also do a soft deployment.

I assume this ISP already have resolvers present so you dont need to remove them just because.

Add 1-2 technitium/dns-servers to the list of DNS-servers for the customers to use like instead of just giving out 2x statically or through DHCP then add so you now have 3-4 in total.

Then over time you can first remove just one of the old resolvers and after a while the other.

[Anime4000]

now I run Technitium and PowerDNS Recursive in same time,

Thus, public/customr facing AdGuard will parallel query 4 recursive DNS

One thing I observed, Technitium use a lot of RAM

One time it hit 4GB RAM LXC limit, I had increase to 8GB

[Apachez-]

Which settings do you use in Settings -> Cache and Settings -> Logging?

[Anime4000]

Which settings do you use in Settings -> Cache and Settings -> Logging?

I believe just default