Penguin
Recent Changes
Note: You are viewing an old revision of this page. View the current version.

BIND is the caching, authoritative DNS server that is responsible for about 90% of the Internet's DNS system, or more. A number of people dislike BIND however, and are major fans of DanBernstein's TinyDNS.

This page will be a comparison of the two DNS servers. As with most comparisons, it wont be fair or unbiased. If anything, its a rebuttal of all the pro-TinyDns fanboy whining that goes on :)

I'm pulling these points (for now) from Brad Knowle's paper on Name Server Comparison. This paper was focussed on performance of an authoritative or caching nameserver, but discusses the differences in the servers as well.

Bind 8:

Pro:

  • Full recursive/caching and authoritative name server implementation
  • Recursive/caching and authoritative services can share IP addresses
  • Faster than Bind 9
  • Wide OS Support
  • statistics split by resource record type
  • IPv6 Support

Cons:

  • Based on Legacy (spaghetti) code
  • Single-threaded
  • Zone transfers handled externally (fork()/exec())
  • Near End of Life
  • no statistics for SERVFAIL
  • uses way too much cpu for subsequent SERVFAILs

Bind 9:

Pros:

  • Full recursive/caching and authoritative name server implementation
  • Recursive/caching and authoritative services can share IP addresses
  • Ground-up rewrite, secure
  • DNS Security - DNSSEC, TSIG
  • IPv6 support
  • Multi-threaded, multi-proc aware
  • DNS Protocol enhancements - IXFR, DDNS, Notify, EDNS0
  • Standards conformant
  • Split DNS / Views
  • highly portable
  • Internal Zone Transfer mech
  • Drops privilidges, chroot()
  • statistics for SERVFAIL
  • caches SERVFAILs

Cons:

  • Unusably slow with only several hundred recursive clients
  • Seems to run into problems maintaining cache database after a while and over 250mb cached data
  • statistics not split by resource record type
  • more context switches due to threading compared to bind8 at same recursive workload

djbdns (TinyDNS / DnsCache?)

Cons:

  • Violates RFCs

    • Er, excuse me? There is no proof for this. Can we take out the wrong stuff? --ChristopherChan

  • Doesn't support zone transfers (uses optional external mech, non standard)

    • Er...axfrdns is for zone transfers. --ChristopherChan
    • ...and axfrdns is the non-standard optional external mechanism, by any chance? --JohnMcPherson
  • Doesn't provide referrals by default

  • Doesn't support TCP by default (available with included axfrdns) (still doesn't support normal queries over TCP, just AXFRs)

  • Truncates responses illegally
  • Provides strange responses to query types it doesn't support (Violates the "Be liberal in what you accept, conservative in what you generate" principle)
  • Without a third-party patch, cant listen on more than one IP address

  • Cannot put both TinyDns and DnsCache? on the same IP (both listen on port 53 udp)

    • Er, why do you want both a authoritative and caching server on the same ip anyway? --ChristopherChan
  • Does not, and author's code will not, support - DNSSEC, TSIG, IXFR, NOTIFY, EDNS0, IPv6

  • Only supports limited set of record types

  • Design is focussed on "fixing" security issues in Bind-8 and earlier - Bind 9 fixes these anyway
  • Seems to consistently drop a small percentage of queries
  • No good conversion tools from Bind
  • limited hardware/OS support (compared with Bind)
  • Slow. Anecdotal reports of high speed unproven. Testing by the author of this paper shows low performance
  • Slow - Bind 8, Bind 9 30 - 40 times faster, Nominium CNS 150 times faster
  • DJB has censored negative opinion of his software.

Pros: The author of this paper didn't have any positive points about djb's DNS suite, although they are widly publicised elsewhere. Some of the more salient, positive points regarding TinyDNS include:

  • Single data file manages all zones. This makes management of zones very easy.
  • Zone file format is claimed to be streamlined than bind.
  • Some reports of better speed than BIND under certain configurations. (see notes below).
  • Adheres to 'The Unix Way' - lots of small processes doing small tasks, rather than a large monolithic approach
  • Attempts to use a quicker, push mechanism for zone transfer - rsync over ssh. (This isn't compatable with bind, however, it is so much smarter--use better tools to do a better job.)
  • Written with security in mind from the outset.

Readers notes

(dnscache) I don't know about the author, but NO bind has ever managed to take on the load that is placed on the dns caches I run for a farm of over 30 mail servers. Bind 9, being the latest, took out the box immediately and a reset is required to get the box back up. Likewise, the part about bind being multiple times faster is complete nonsense to me since Bind does not provide a single answer and at the same time takes out the box in my case. dnscache allows me to get by with just 3 boxes for dns resolution of my mail server farm. I cannot even imagine how many I need if I use Bind. Nuff said. -- ChristopherChan

The report published at the top of this page was performed several years ago - it's possible some things have changed. DJB has a page refuting many of Brad Knowles's claims, entitled Brad Knowles's Slander. I've not taken the time to go over it thouroughly, nor have I investigated relative merits of the two DNS servers further than reading Brad's original paper. DJB seems to contradict some of Brad's points simply by rejecting the wording, without bothering to answer the meaning. Brad also referred to works published by DJB himself regarding TinyDNS performance, which seems fair enough to cite. The fact that performance has improved since then bears little relevance on the state of things at the time. I encourage interested readers to go over both documents and make up their own mind. I'll keep using BIND because it's what I know, performance is perfectly fine for what I need it for, and any security concerns are very outdated. -- DanielLawson