400ms to 30ms: diagnosing DNS that looked correct
Name resolution was slow and some hosts failed entirely. The configured resolvers were valid, publicly reachable, and completely useless from the affected machine — because a VPN was capturing the traffic.
Context
Lookups took roughly 400ms each and at least one hostname failed to resolve. The adapter was configured with the ISP resolvers, which respond normally from other machines on the same network.
Constraints
- The same resolver IPs worked perfectly from a different host on the same LAN, so "the DNS server is down" was the wrong conclusion.
- Changing DNS risks cutting off the machine mid-diagnosis.
Decisions
Test from both vantage points before drawing a conclusion
Raw DNS queries from the affected machine timed out on both UDP and TCP/53, while identical queries from the hypervisor returned NOERROR. The resolver was fine; the path to it was not.
Follow the route, not the config
A route lookup showed traffic to the ISP resolvers was being sent into the VPN tunnel, where it was dropped. The configured DNS was therefore dead whenever the VPN was connected, and the OS was silently falling back to the tunnel resolver after paying a timeout.
Measure the fix rather than assert it
After repointing to resolvers that are reachable in both network states, latency was measured inside a single process to avoid including shell startup cost — an easy way to misread a 30ms improvement as a 400ms non-event.
Outcome
- Lookup latency reduced from ~400ms to ~30ms, measured warm and cold.
- The one hostname that still failed was confirmed not to exist at all — the test name was invalid, not the resolver.
- Left a second host untouched after measuring it as already healthy, rather than changing things for consistency.
What it taught me
Configuration that is valid is not configuration that works. When the same setting behaves differently on two hosts, the difference is in the path — measure from the vantage point that matters.
Addresses, hostnames and identifiers in this write-up are abstracted or generalised. If you would like the specific detail, ask — I am happy to walk through it directly.