How to Fix Slow DNS Lookup: 7 Steps from Test to Caching

How to fix slow DNS lookup: per Atera’s guide, the steps are: measure with dig, check the resolver config, switch to fast upstream DNS (1.1.1.1, 8.8.8.8), enable local caching (systemd-resolved, dnsmasq), use DNS-over-HTTPS, check for malware, and check ISP DNS performance. The team that walks through this checklist resolves slow DNS in 15 minutes.

Table of contents

• Measure first
• Step 1: check your resolver
• Step 2: switch to fast upstream
• Step 3: enable local caching
• Step 4: use DoH or DoT
• Step 5: check for malware
• Step 6: ISP DNS performance
• Step 7: check for IPv6 issues
• FAQ

Measure first

time dig example.com

Total time should be 50-200ms. The team that sees 1+ seconds has a real problem.

Step 1: check your resolver

cat /etc/resolv.conf
# Or for systemd-resolved
resolvectl status

The team that has slow upstream (8.8.8.8 alone) has a problem. The team that has local cache (127.0.0.53) has the right architecture.

Step 2: switch to fast upstream

Slow: ISP default (often 50-200ms). Fast: 1.1.1.1 (Cloudflare) or 8.8.8.8 (Google) - typically 20-50ms.

# In /etc/systemd/resolved.conf
[Resolve]
DNS=1.1.1.1 8.8.8.8

sudo systemctl restart systemd-resolved

The team that switches to fast DNS has 2-5x faster resolution.

Step 3: enable local caching

systemd-resolved caches responses (TTL-based). Verify:

systemd-resolve --statistics | grep -i cache

The team that has cache hits has 0ms lookups for cached entries.

Step 4: use DoH or DoT

DNS-over-HTTPS (DoH) or DNS-over-TLS (DoT) prevents ISP-level DNS hijacking and can improve privacy:

[Resolve]
DNSOverTLS=yes

The team that uses DoT/DoH has encrypted DNS.

Step 5: check for malware

Some malware changes DNS settings to point to attacker-controlled resolvers:

cat /etc/resolv.conf
# Look for unknown nameservers

The team that has unexpected nameservers has possible malware. The team that runs antivirus / rootkit check has clean system.

Step 6: ISP DNS performance

Some ISPs have slow DNS. Test:

time dig @1.1.1.1 example.com
time dig @8.8.8.8 example.com
time dig @isp.dns.example.com example.com

The team that finds ISP DNS slow switches upstream.

Step 7: check for IPv6 issues

If your system tries IPv6 first and that path is slow:

# Disable IPv6 in resolver
[Resolve]
DNS=1.1.1.1
# or
sysctl -w net.ipv6.conf.all.disable_ipv6=1

The team that has IPv6 fallback issues has faster resolution.

FAQ

What’s a normal DNS lookup time?

20-100ms. Over 200ms is slow. Over 1s is broken.

Should I use 1.1.1.1 or 8.8.8.8?

Both are fast. Pick one and stick with it. The team that uses 1.1.1.1 has Cloudflare’s network; the team that uses 8.8.8.8 has Google’s.

Is local DNS cache safe?

Yes - TTLs control staleness. Modern resolvers (systemd-resolved) respect TTLs correctly.

How do I check if DNS is hijacked?

Compare dig @8.8.8.8 example.com (Google’s resolver) vs your configured resolver. Different answers = hijacking.

What’s DNS prefetching?

Browsers pre-resolve likely URLs. Speeds up navigation. Disable in chrome://settings if you want to test DNS.

If you are sizing the infrastructure for the kind of project this post covers, the RunxBuild hosting calculator is the right place to model the line items. The compute, the memory, the storage, the bandwidth, the database - each one is a separate number, and the team’s mental model for the platform is the sum of those numbers. The RunxBuild dashboard is where the team sees the actual usage in one place.

Useful related references:

• Static/Domains