XP DNS Client Service

[Mac the Knife]

My Windows XP/SP2 box (yes, I confess, I still have one, dual-booting with SuSE 9.2) was taking AGES (10min+) to boot. A little sleuthing narrowed it down to the svchost process loading the DNS Client service that was taking so long (and occupying 99% of the CPU).

Couldn't figure it out - thought it might be due to SFU or cygwin but no. Out of curiosity disabled the service, anticipating that it would then no longer be able to resolve DNS names. Result, fast boot and no problems accessing anything.

I run an old P2 box with Freesco (a cut-down Linux) as the internet gateway for the home network and of course this has a DNS resolver. What is happening? Is the Freesco box doing the DNS resolving? Presumably so.

Still curious as to why DNS Client was taking so long to load. Tried flushing the DNS cache to see if that make any difference but no again. My kid's XP/SP2 box on the same network boots quickly and the DNS Client service is still enabled there.

Any ideas anyone?

[drauk]

I believe the DNS Client service on Windows is a CACHE, not the actual name resolver. Running it will speed up name resolution if the name server that you normally use is not fast to respond, either because it is slow or your connection to it is slow. If you've told your Windows machine to use your Freesco machine as the DNS server (it's not completely clear from your message but I suspect that is the case) then it will be fast because it is local and that machine will do the caching. As such, no need to run the DNS Client service on your windows machine, though why it took so long to start up I have no idea.

[Mac the Knife]

Thank drauk. I think I've got it figured out now.

As you say, the DNS Client service is a cache. Windows looks in HOSTS first, then the cache (DNS Client Service) and then on upstream until it gets an answer. Upstream is the Freesco DNS cache, then the ISPs slave DNS servers, then the ISP's Master DNS server and finally (possibly with a few in between) the 13 root authoritative DNS servers.

So no penalty for disabling local DNS resolution on the Winbox because the Freesco box is just upstream.

No idea why the service takes so long to start up. I thought it was because I have a huge HOSTS file (redirecting rubbish to 127.0.0.1) but I have the same HOSTS file on the kid's machine which boots quickly.

Cheers!

Edited to add: I have just found this on http://www.dslreports.com/faq/9166 so it seems I am not alone.

[IO540]

There is a problem in win2000 with the DNS client service - it is known to occassionally fail to work, preventing name lookups working at all.

I found this at the office. On just one of a number of PCs, I've had to disable this service. It makes name lookups a lot slower presumably because windoze has to go to the ISP's nameserver but at least it works. Previously, about 50% of name lookups would totally fail and the only way to get it to work was by typing in

ipconfig /flushdns
ipconfig /renew

I never got to the bottom of it. Reinstalling windows might do it but I've got sp4 and loads of security updates there...

[Mac the Knife]

Further research seems to show that XP can also suffer from this (though not as often as 2000).

Apart from slow loading as detailed, XP seemed occasionally to completely lose the plot and not be able to find anything. Flushing the cache occasionally fixed it. Damned irritating. Glad disabling this service has fixed things.

TreeWalk DNS (free) has been suggested as a solution if one needs a DNS cache (it can be a bit slow waiting for your ISP's DNS server) - http://ntcanuck.com/index.htm

[Mac the Knife]

Okay, more research....

Slowdown PROBABLY due to size of the HOSTS blocking file I use (1.13MB) - DNS Client service attempts to cache this on starting (though quite why this should take SO-O-O-O-O long I don't know.

A real jewel for those of you who use HOSTS is the neat little freeware program HostsMan from http://www.abelhadigital.com/ {reference in Widers Security Forums - http://www.wilderssecurity.com/showthread.php?t=61384 }

GUI - Check for errors, remove duplicates, disable DNS caching service, edit, lock etc. Very neat indeed. Good candidate for FAQs and/or best downloads.

We live and learn.....

[drauk]

If you can be bothered you could always configure your own name server to give the custom responses (i.e. 127.0.0.1) for your list of 'bad' addresses. That way you could share one list across all your PCs and have a small HOSTS file. Actually, better written name servers would decline to server information for zones for which they weren't an authority but I believe BIND (whose only glory is its ubiquitousness) does.

Either way there is still no need for a name cache on each machine if you've got one on your local network.