Friday, September 09, 2005

Changing the DNS query timeout in Windows XP  

I've been having some networking trouble lately. When my PC laptop is busy downloading a file, Windows XP starts failing to resolve DNS queries. So even simple lookups that I know must be cached at multiple levels, like www.google.com, start failing to resolve. Windows just times out after fifteen seconds and gives up.

Needless to say, this makes web browsing while downloading a file insanely frustrating.

My Mac laptops don't seem to have the same problem. I have no idea whether this is a problem with my ISP, my wireless router, Windows itself, or some combination of the three. And frankly, as an end user I don't care and shouldn't have to care. I just want it to stop sucking.

I set out to see if I could increase the client-side DNS timeout so that Windows would be a little more forgiving about slow DNS responses. It turns out there is a way to do that, though it's nearly impossible to find via a web search. (Even Windows experts, which I make no claim to be, seem to have trouble with this one because it's so obscure.)

Here's the registry setting to increase the DNS client-side timeout in Windows 2000 and XP:

HKEY_LOCAL_MACHINE \ SYSTEM \ CurrentControlSet \ Services \ Tcpip \ Parameters \ DNSQueryTimeouts

[Update Nov 3, 2006: Fixed the above link. It used to point here, but that link now redirects you to the main page for the Windows 2000 resource kit. Remember, kids, cool URLs don't change.]

Read the above link for details. The registry entry does not exist by default; you have to create it. I don't suggest you do this lightly unless you're familiar with using regedit to tweak parameters.

Screenshot of regedit.exe

The default value when the property isn't present is documented to be "1 2 2 4 8 0", which appears to represent that 15-second total timeout. (15 = 1 + 2 + 4 + 8. It's not clear to me exactly what the other 2 is for; it may be redundant.)

I wanted something a little longer, so I quadrupled all the numbers to "4 8 8 16 32 0".

Screenshot of regedit.exe

Now I have a 60-second total timeout, with the final query given 32 seconds to get through. In practice this has proven to be a long enough timeout that Windows can continue to resolve DNS names even when my network connection is busy.

And that's good news. I'm much happier again, and I can continue to use my PC laptop without wanting to chuck it out the window every time I download a file.

26 comments:

  • Anonymous said...

    see www.microsoft.com/resources/documentation/Windows/2000/server/reskit/en-us/regentry/96406.asp

  • Drew Thaler said...

    Yes, I know. The link named "HKEY_LOCAL_MACHINE \ SYSTEM \ CurrentControlSet \ Services \ Tcpip \ Parameters \ DNSQueryTimeouts" in the article goes to that Microsoft page.

    It's documented, sure, just not very well referenced. Googling or searching Microsoft's help for it leads to a lot of dead ends with much-repeated details for changing DNS caching timeouts, which are not at all the same thing. Further, it's in the Windows 2000 registry reference and not present in any XP reference that I've found.

  • Anonymous said...

    Helped me a lot too! Thanks for your help!

    Roberto

  • Anonymous said...

    I'm glad you posted this. My in-laws were having a terrible time with DNS timeouts that were manifesting as being unable to find pages with their web browser. After finding your note and reading the link to the Microsoft site I used the nslookup command line tool to do some testing (http://www.microsoft.com/resources/documentation/windows/xp/all/proddocs/en-us/nslookup.mspx?mfr=true) to determine what value to increase the timeouts to. It also helped me determind that the primary DNS server for their ISP consistently times out, even when I set the timeout to 30 seconds!

    In the end I settled on the settings 6, 8, 8, 16, 32, 0 since 6 seconds usually gets a response, but 8 seconds almost never fails.

    As far as your confusion about the second 2 in the default settings, it's important to note that it's for when your system gives up on the preferred DNS server and starts trying secondary DNS servers.

    Thanks again for the info!

  • Anonymous said...

    Not to pick on anyone, but I think someone needs to straighten you "know it alls" out. First, I realize that the original comment was written in 2005... since then, Google might have improved its search results, because if you search for "changing windows dns retry" the answer shows up in the 7th link. That's not really hard to find as some of you say.

    Second, the anonymous person that wrote the second 2 is for your secondary DNS server... not quite. You're mixing two ideas together. Even the originator of this thread had the timeout wrong... it's not 15 seconds. Windows by default retries with the following pattern: 1, 2, 2, 4, 8... count it, that's 17 seconds. In other words, after the first query is sent, wait 1 second... if you don't get a response, send another query, and wait 2 seconds... another query, another 2 seconds... another query, then wait 4 seconds... send the 5th query, wait 8 seconds... if you don't get a response, call it quits on the primary DNS server. Run a packet sniffer and you'll see this to be true. If after 17 seconds the primary DNS server hasn't responded, then Windows switches over to the secondary server, and attempts another 5 queries. After a total of 34 seconds, DNS lookup fails.

    So for the person who quadrupled your individual retry timers, you ended up with 68 seconds, not 60... and that's just for the primary. In total, you've got 136 seconds. Probably a bit excessive, but hey, whatever works for you.

    -Sandeep

  • Drew Thaler said...

    You seem to be right about the seventeen seconds. Thanks for the technical correction, but the difference is immaterial. And yes, you correctly figured out that overkill was the whole point of quadrupling the numbers.

    About how easy it is to find, you are technically correct but effectively wrong. If you happen to pick that exact search string ("changing windows dns retry") then today you can find the answer buried in the middle of the page in the 7th link: Appendix C: Windows Sockets and DNS Registry Parameters. However, if you check the other 69 results from the top 70 or so, you'll find that that is the only link that is useful. Every other link is either completely unrelated, or about DNS server parameters.

    So a year later my point still stands: it's still not very easy to find, and it's neither very well discussed nor very well linked into the web.

    That was the point of doing a blog entry about it.

  • Anonymous said...

    I played and Played with this....I have a small network of mixed xp and Linux machines, only one of the XP machines was having this (very frustrating) problem. I believe the issue was due to corrupted/ conflicting registry entries left over from multiple NIC cards (some wireless that installed their own protocol under the TCP/IP listings) that were installed at one time or another. Anyway after following several forums that were supposed to fix the issue, I could see no appreciable change. At that point I ran WinSockXPfix a commonly available freeware tool meant to restore connectivity on XP machines when the TCP/IP stack has become corrupted, most commonly due to spyware removal. This tool is freely available at many sites around the web (try www.snapfiles.com) Anyway this tool resolved the issue completely!

  • Anonymous said...

    Well.. I'm using WIN2K SP4 5.0.2195, and this

    HKEY_LOCAL_MACHINE \ SYSTEM \ CurrentControlSet \ Services \ Tcpip \ Parameters \ DNSQueryTimeouts

    parameter doesn't exist on any of my systems nor does it work as you describe after adding it.

    I used regedt32 to add a REG_MULTI_SZ parameter with following settings:
    4
    5
    6
    7
    8
    0

    no matter what ANY nslookup query from DOS shell returns this error:


    DNS request timed out.
    timeout was 2 seconds.
    *** Request to [my-isp-dns] timed-out

    only on the first attempt, subsequent execution of the same nslookup returns successfuly.

    So.. the poster that said it will take 17 seconds or 34, and requeries or whatever.. That's not what I see on 5 computers with win2k... It just times out after *2* seconds, even after adding this special registry key and rebooting..

    If I change timeout interactively in nslookup using:

    nslookup prompt > set timeout=6

    then the timeout really changes to 6 seconds (only for this nslookup session) and if it times out it will display an error indicating that *6* seconds elapsed and not 2..

    I see many posts online claiming this parameter is also valid in win2k.. so hey, maybe it works like advertised on XP.. but I need this solution on win2k.

    thanks.

  • Anonymous said...

    Update: Running regmon I see NEW value is picked up by applications, so it must be my stupid ISP that kills the query after 2 seconds no matter what. for the record, no reboot or NIC restart is needed it's all dynamic. Hope this helps others..

  • Anonymous said...

    Thanks for the tech advice, Drew. Finding a solution on the net *WAS* difficult with so many irrelevant results returned by Google. My network is a dialup desktop/W2K/ICS-host + laptop/XP/ICS-client. I've spent months trying to solve this problem, puzzling over why FireFox was frequently failing to load some pages but not others and not always. This solution works.

  • Gonagoonu said...

    There are some feisty geeks on this blog. I was doing some research on this earlier today and I gotta back Drew on the level of difficulty. Not an easy research project.

    For the anonymous blogger who started off with "Not to Pick on Anyone..." I find fault with your analysis. If you review the info at:
    http://www.microsoft.com/technet/prodtechnol/windows2000serv/reskit/regentry/96406.mspx?mfr=true

    You will see on the line regarding the third limit that the query is sent to ALL DNS servers and not just the preferred one. You suggested the secondary DNS server doesn't get queried until the 5th limit has been exceeded. I have not confirmed with a sniffer, but expect that would confirm the info I pointed out.

    Good discussion for a poorly documented issue. Anyway... I had to throw in my two cents. I would love to set this up in my lab so I can verify the effectiveness of certain tweaks, but who has the time.

  • Anonymous said...

    The nslookup timeout is for just that application, if it is shorter than the underlying DNS timeout then *it* will give up before the actual DNS request fails.

    You can set a large nslookup timeout and the response you will get from a failed query is different than when nslookup runs out of patience.

  • Kevin McLarnon said...

    Drew, thanks for this post. It's still valid - helped address a frustrating problem I've been having connecting to my company via VPN over my Satellite link. Data doesn't get here faster, but it does arrive, which is a welcome improvement!

  • Anonymous said...

    Thanks Drew. I just replaced my motherboard and the old timeout problem cropped up again. I forgot how I fixed it the first time. Your blog was the only way I could find to get the solution.

  • starrychloe said...

    This was so easy to find... in 2008. I used "windows xp dns timeout" and your page came up first! I'm having wireless trouble, and Firefox kept saying "Address Not Found
    Firefox can't find the server ..."

  • starrychloe said...

    Also consider using another backup public DNS server: http://www.google.com/search?hl=en&q=public+dns+server&btnG=Search

  • Unknown said...

    Hi, everyone. This is a good page for the DnsQueryTimeouts, but does anyone know the following: Does this actially work in XP? Can non-integer numbers (say 0.5 seconds) be used? Can a "0" appear before the end of the list? (maybe I want to try all servers as the second attempt)

    Thanks

  • Anonymous said...

    I tried this but I'm still getting network timeout messages after just a few seconds..not even 15. any insights? I'm trying to watch required videos for an online course and it's pretty frustrating not to be able to access them..considering I need the course for my job AND had to pay for it out of my own pocket. Anyway, I've actually been having this problem on all 3 computers in the house, Windows XP, Vista and Ubuntu; Firefox, IE, Opera and Google Chrome, which makes me think it must be something about our internet connection; but I couldn't find anything helpful anywhere else, so..any ideas? anything that can help would be greatly appreciated.

  • Gobanian said...

    i have a possibly related question in Vista Ultimate. I cannot send any messages by hotmail, gmail or yahoo mail from any browser (tried Chrome, Firefox, IE.) The problem has just started after a year of normal use. message longer than about 200 words do not send and after a short period i get a message saying they have timed out. also it will not accept attachments. Can anyone help?

  • Unknown said...

    Hi John,

    Have you recently changed your ISP or Internet connection type? Or router? This problem sounds similar to one I've experienced with more "standard" e-mail clients, and the problem lied in the MTU setting of the router. You may want to confirm your MTU setting is correct.

    If that's not it, I'd suggest posting your Q on a tech support forum, so people can assist you more directly. Error messages and what-not would be helpful in that case as well.

    Best Wishes,
    Kurosh

  • Gobanian said...

    Thanks for the response. No, it's the same ISP and an ageing router i have had ever since switching to this ISP. Also, when I plug the connection into a different computer it works fine. So I think it must be somewhere in my computer.
    But I would like to check the MTU settings and I don't know how to do that. What's the best tech support forum?

  • Rom said...

    Thanks, I recently started hosting my own website and found it necessary to set up a name server for moy internal zone. Problem was that my xp machines were timing out often when looking up pages. Im no dns expert, but I guess as it caches more over time, this will improve, in the meantime this tweak has greatly improved page loads.

  • Anonymous said...

    This info was the answer I needed to addressing the sloppy start order of Windows.

    How long have we had to live with and endure the erroneous errors and inaccurate, misleading, messages of the Windows Event Viewer.

    I built a clean 2008 server only to be rewarded, once again with a list of errors (non-critical I might add), that were not (as always) due to the hardware, or the configuration.

    I can't really complain, Micropants have kept me in a well paid profession for many years while persistently frustrating me as penance.

    Thanks to the detail on this page I was able to achieve a completely boot-up error-free W2K8 Domain Controller.

    Thank you, peace at last!

  • Kilikopele said...

    Hi! Today is 3-14-2012 and this thread still managed to help someone immensely! Thanks!!

  • Sophist said...

    According to Technet http://blogs.technet.com/b/stdqry/archive/2011/12/15/dns-clients-and-timeouts-part-2.aspx later queries are done to multiple DNS servers in parallel.

    And most people have only one network connection and a fast broadband connection and should normally expect a DNS response within 1s.

    So I have set my DNSQueryTimeouts to 1 1 1 10 10 0 so that it gets to issuing parallel queries to all DNS servers as quickly as possible. Then I put my ISP's DNS servers in the list first (since they are physically closest and least likely to be subject to network packet drops, with several public DNS servers behind, and let Windows do its stuff.

    And my web browsing has speeded up immensely!!!

  • Unknown said...

    NSlookup is simply part of Windows, so you can get access to it from the the command line.
    Nslookup