Summary

  • In his APNIC cold-start experiment, Geoff Huston's BIND 9.20.23 resolver used four queries to reach www.potaroo.net with an empty cache. His trace of teams.microsoft.com used 94; other reported resolver versions produced 247 and 29 queries under their own conditions.
  • The useful result is the dependency map, not a league table of software versions. CNAME restarts, nameserver addresses, glue and DNSSEC checks determine how much work the resolver must do before its cache can help.

The easiest way to flatter a DNS design is to test it twice. The second time, the recursive resolver remembers the path. Huston, APNIC's chief scientist, chose the less flattering first meeting. His local BIND resolver began with no cached answers and walked from root knowledge through .net and potaroo.net to the address of www.potaroo.net. Four queries. A tidy little staircase.

Then came a name with a much larger entourage. In the same APNIC account, Huston reports Ondřej Surý's 247-query trace for teams.microsoft.com on BIND 9.16. Huston's BIND 9.20 trace required 94, and Surý observed 29 on 9.21. These are individual cold-start walks with different resolver versions and conditions. Their force is in the path they expose, not in claiming a universal speed ranking.

Four CNAME links in the example make the resolver start a new name-resolution journey five times. Some links remain within an already known zone. One crosses to .net, returning the resolver to earlier steps. Nameserver names create their own errands: a referral can say which server knows the answer, but the resolver still needs an address for that server. In-zone glue supplies that address at a critical handoff; nameservers scattered across other domains and top-level domains can make the resolver ask more questions before it even reaches the intended zone.

Huston also puts DNSSEC on the receipt. Validating an answer brings DNSKEY retrieval into the walk. A resolver can gather more nameserver information in advance to make failure less painful, or take a shorter route when everything responds. Neither choice is free. The zone publisher can add aliases and distribute nameservers for its own reasons; recursive resolvers around the Internet perform the resulting first-use work.

That is the power relationship hidden by a warm cache. Huston did not report an outage or a global latency penalty. He showed which design decisions a cold resolver must execute before an answer exists. The next useful measurement is a controlled trace with elapsed time, resolver configuration and failure behavior. Until then, the query count is already a sharp question for anyone commissioning a DNS layout: who gets convenience, and who pays the opening round?