However you did not empty your ISP's dns server cache.
That 2 msec response time is from his cache, the 543 msec for
your server is when it's not in your server's cache.
So you're not making a fair comparison.
A response from a cache is always going to be faster, that's why people
use caching servers.
However with everybody & his cat using your ISP's server it gets query
blocked and thus is caching the bad (blocked) response.
So either you get bad data fast or good data slowly.
Once you get a second spam with similar contents, queries for that copy
will be in your cache and be fast.
Given that a modern SA parallelizes DNS queries a somewhat slow DNS
response (hundreds of Msecs) won't have too much overall affect on the
spam processing time.
On Tue, 15 Sep 2015, Marc Richter wrote:
Yes
Am 15.09.2015 um 13:30 schrieb Axb:
On 09/15/2015 01:23 PM, Marc Richter wrote:
Also, you shouldn't make assumptions without measuring something:
1. without forwarding:
;; Query time: 543 msec
;; SERVER: 127.0.0.1#53(127.0.0.1)
2. with forwarding to my ISP's servers:
;; Query time: 2 msec
;; SERVER: 127.0.0.1#53(127.0.0.1)
That's 271 times faster than root-servers's lookup.
did you EMPTY cache after each query?
--
Dave Funk University of Iowa
<dbfunk (at) engineering.uiowa.edu> College of Engineering
319/335-5751 FAX: 319/384-0549 1256 Seamans Center
Sys_admin/Postmaster/cell_admin Iowa City, IA 52242-1527
#include <std_disclaimer.h>
Better is not better, 'standard' is better. B{
