D. J. Bernstein
Internet publication
djbdns
Frequently asked questions

External DNS cache


How do I configure an external cache? I'd like to run dnscache on IP address 1.2.3.4 to handle DNS queries from the 1.2.3 network.

Answer: This answer assumes that your boot scripts are already running svscan in a /service directory. dnscache relies on svscan to start it and to restart it at boot time.

You will have to make three decisions:

Create the service directory by running the dnscache-conf program, with your IP address at the end of the line:
     dnscache-conf dnscache dnslog /etc/dnscachex 1.2.3.4
Tell svscan about the new service:
     ln -s /etc/dnscachex /service
svscan will start the service within five seconds.

By default, dnscache does not accept queries from remote hosts. Use

     touch /etc/dnscachex/root/ip/1.2.3
to tell dnscache to accept queries from 1.2.3.*. You can add or remove networks on the fly.
How do I configure my clients to use an external cache? This machine has IP address 1.2.3.248. I'm already running dnscache on another machine on IP address 1.2.3.4, and I've told dnscache to accept queries from 1.2.3.248.

Answer: Add

     nameserver 1.2.3.4
to /etc/resolv.conf. Web browsers, SMTP clients, and other DNS client (``stub resolver'') applications running on this machine will send their DNS queries to 1.2.3.4.

Now test your favorite clients. If dnscache on 1.2.3.4 has not been configured to accept queries from 1.2.3.248, your DNS queries will time out.


Can I use an external cache and a separate DNS server on the same host?

Answer: Yes, the same way as for a local cache. Put the external cache on one IP address, and the DNS server on another IP address. UNIX allows one machine to handle many IP addresses.

If you are upgrading from a BIND configuration with a single IP address acting both as an external cache and as a DNS server, you should first separate the services:

  1. Set up a new DNS server on another IP address.
  2. Tell your parent server to move its delegation to the new IP address: e.g., change the IP address of ns.your.dom.
  3. Wait for the change of delegation to take effect.
  4. Configure the original IP address as a pure cache, no longer talking to outside hosts.
This separation is recommended for all sites, no matter what DNS software is in use, so that caching can't interfere with incoming queries.
How do I increase the cache size? I'd like dnscache to use 100 megabytes of memory.

Answer:

     echo 100000000 > /service/dnscache/env/CACHESIZE
     echo 104857600 > /service/dnscache/env/DATALIMIT
If dnscache is already running, restart it:
     svc -t /service/dnscache

dnscache services created with djbdns 1.00 or earlier do not have the /env directory. Instead edit /service/dnscache/run; change CACHESIZE=1000000 to CACHESIZE=100000000 and -d3000000 to -d104857600.


How do I measure the effects of the cache size? We're a Big Organization with many clients using this external cache, so presumably our cache size should be larger than average. On the other hand, this machine isn't dedicated to name service, so I don't want to waste memory.

Answer: dnscache frequently logs a stats line in /service/dnscache/log/main/current. The second number after stats on the line is the cache motion. The cache motion is the number of bytes of cache entries that have been written to the cache since dnscache started.

Look at this number now, and again in 24 hours; subtract to see the 1-day cache motion. (Or extrapolate, using ps to see how long the dnscache process has been running.) Now divide the cache size by the 1-day cache motion:

Another way to measure cache effectiveness is to divide the cache motion by the query count, which is the first number after stats. When the cache is very large, this ratio will be at its minimum possible value, measuring unavoidable DNS traffic; when the cache is too small, the ratio is too high.

If you're switching from BIND to dnscache, you might be tempted to look at BIND's memory use, and set the dnscache cache size to the same amount. In most cases this is excessive.