DNS trace

Question

DNS requests seem to have slowed on our network and I'm trying to find a way to test DNS requests and see a report of the routing of the request.
1) are the requests (i.e. from a client web browser) of outside domains being passed on to my ISP nameservers as specified in /etc/named.conf as forwarders
2) and if they are, why have DNS requests slowed in recent days?
I'm hoping a tool that shows the request and associated connections/times will help me diagnose the problem.
Thanks.

Answer 1

I cannot comment on the firewall question but...
If you have not entered forwarders manually then you do end up being slow.
A previous explanation I had on file...
The default activity for the Apple Server DNS (excluding domains for which it is authoritative or for which it has a previously cached answer) is to query the internet Root servers . This does tend to take longer than querying your ISPs DNS server unless there is sufficient traffic in your local LAN to build up a good cache. (Apparently, stuff to do with Recursive versus Non-Recursive queries
To bypass this behaviour you can configure your DNS to query only your ISPs DNS servers, not the internet Root servers. This way, even if your ISP's server does not have the answer cached, they still do all the work and then pass it back to you. Essentially, you only add the one extra step from having your ISP's DNS in the client... Instead of Client-> ISP DNS, you have Client-> Server-> ISP DNS. This difference should be milli-seconds. And once the server caches the response, it should be even faster.
File: /etc/named.conf
Add a forwarders statement to the existing Options clause, for example...
options {
    directory "/var/named";
    allow-transfer {none;};
    recursion true;
    forwarders {
        199.168.4.100;
        199.168.8.100;
    forward only;
But change the IP addresses to the IPs of your ISP's DNS servers (the ones I have listed do not exist!)
The forward only statement tells your server to ONLY query the listed servers (if it does not already have a cached answer or is not authoritative for the domain being queried). 'forward first' would query the forwarders then the root servers (if no answer from forwarders).
This manual edit of /etc/named.conf, in my experience, does not get overwritten by any later changes to the DNS services in Server Admin GUI nor does it prevent the GUI from working properly. It does make a big difference to resolving speed though.
-david
    Server 10.4.8