Performance & Caching
Relevant source files
The following files were used as context for generating this wiki page:
Performance and caching in the dns-hardening-parrot project are primarily managed through the Unbound DNS resolver. The system is designed to provide enterprise-grade speed while maintaining a high security posture. By leveraging a local resolver, the project reduces latency for repeated queries and provides controlled memory allocation for various DNS data types, such as RRsets and messages.
The architecture prioritizes reliability through aggressive prefetching and specific TTL (Time To Live) boundaries, ensuring that valid records remain in the cache while expired or potentially poisoned records are refreshed or discarded according to strict security logic.
Caching Infrastructure
The Unbound configuration defines specific memory slabs and cache sizes to optimize multi-threaded performance. This structure prevents locking contention between threads by dividing the cache into independent segments.
The diagram shows the decision flow for a DNS query, prioritizing the local cache before reaching out to upstream TLS resolvers.
Cache Size and Memory Allocation
The project allocates specific memory limits for different types of DNS data to ensure the system remains stable under load.
| Cache Type | Size | Description |
|---|---|---|
| RRset Cache | 100m | Stores Resource Record sets (e.g., A, AAAA records) |
| Message Cache | 50m | Stores the actual DNS query responses |
| Key Cache | 100m | Stores DNSSEC keys for validation performance |
| Negative Cache | 10m | Stores NXDOMAIN (non-existent domain) responses |
Sources: configs/unbound.conf:59-62, DNS_Hardening_Complete_Guide.md:167-170
Caching Logic and Prefetching
To maintain low latency, the system utilizes prefetching. When a popular record is about to expire (within the last 10% of its TTL), Unbound automatically refreshes it in the background.
prefetch: Enabled to update cache records before they expire.prefetch-key: Specifically fetches DNSSEC keys early to speed up validation.cache-min-ttl: Set to 300 seconds (5 minutes) to prevent frequent re-querying of short-lived records.cache-max-ttl: Capped at 86400 seconds (24 hours) to ensure stale data is eventually refreshed.
Sources: configs/unbound.conf:44-47, README.md:123-126
Multi-threaded Performance
The implementation uses multi-threading and "slabbing" to improve performance on multi-core systems. Slabs reduce the lock overhead when multiple threads access the cache simultaneously.
Visual representation of how multiple threads interact with cache slabs to minimize resource contention.
num-threads: Configured to 2 threads for concurrent query processing.- Slab Settings:
msg-cache-slabs,rrset-cache-slabs,infra-cache-slabs, andkey-cache-slabsare all set to 2 to match the thread count, optimizing memory access patterns.
Sources: configs/unbound.conf:38-42, DNS_Hardening_Complete_Guide.md:150-154
Rate Limiting and Traffic Control
To protect performance from abuse or Denial of Service (DoS) attempts, the system implements local rate limiting.
ratelimit: Restricted to 1000 queries per second.ratelimit-size: 4MB allocated for tracking rate limit states.ratelimit-slabs: Set to 4 to distribute rate limit tracking overhead.
Sources: configs/unbound.conf:49-52, README.md:128-131
System-Level Performance Hardening
The hardening scripts (dns_harden.sh) and system configurations further optimize resolution speed by defining primary and fallback resolvers in /etc/resolv.conf.
# Hardened DNS Configuration
nameserver 127.0.0.1
nameserver 1.1.1.1
nameserver 1.0.0.1
options timeout:2
options attempts:3
Sources: scripts/dns_harden.sh:32-38, TEST_RESULTS.md:17-26
The use of options timeout:2 and options attempts:3 ensures that the system quickly moves to a secondary resolver if the primary fails, preventing long application-level hangs.
Monitoring and Maintenance
Performance is monitored via automated scripts that verify Unbound's responsiveness and connection status to upstream DoT providers on port 853.
dns_status.sh: Checks if the localhost resolver is active and if DNS resolution is working within a 3-second timeout.dns_restore.sh: Provides an emergency mechanism to bypass the hardened local resolver if performance degrades or if the service fails, restoring public resolvers in under 30 seconds.
Sources: scripts/dns_status.sh:41-45, scripts/dns_restore.sh:80-92, MONITORING.md:41-45
The project maintains a high performance-to-security ratio by combining local caching with low-latency DNS over TLS upstreams from Cloudflare and Quad9.
Sources: configs/unbound.conf:75-84, README.md:144-153