starred/AdGuardHome

Fork 0

mirror of https://github.com/AdguardTeam/AdGuardHome.git synced 2026-03-04 00:01:12 -05:00

DoT much slower than DoH using the same servers #3070

New issue

Open

opened 2026-03-04 02:56:38 -05:00 by deekerman · 4 comments

deekerman commented

2026-03-04 02:56:38 -05:00

Owner

Originally created by @timkgh on GitHub (Sep 23, 2021).

v0.106.3, using the default adguard filter with security and parental control filters.
Upstream DNS servers: 1.1.1.2, 9.9.9.9

Using DoH for both upstreams shows an average query time of about 28ms, but using DoT it is much slower at 81ms. All other settings are the same. Tests run over 24h for each.

Any ideas why that much slower? Are the TLS connections not kept alive or re-used a lot less than the https connections?

Originally created by @timkgh on GitHub (Sep 23, 2021). v0.106.3, using the default adguard filter with security and parental control filters. Upstream DNS servers: 1.1.1.2, 9.9.9.9 Using DoH for both upstreams shows an average query time of about 28ms, but using DoT it is much slower at 81ms. All other settings are the same. Tests run over 24h for each. Any ideas why that much slower? Are the TLS connections not kept alive or re-used a lot less than the https connections?

deekerman added the

enhancement

performance

labels

2026-03-04 02:56:38 -05:00

deekerman commented

2026-03-04 02:56:46 -05:00

Author

Owner

@timkgh commented on GitHub (Sep 24, 2021):

Ran some tests, here are my observations:

DoT: responses are generally fast, 25-50ms range, but every 7-10 requests I see 1-2 requests that take 200-300ms which pushes the averages up and is not great for responsiveness.

DoH, DoQ: smooth responses for long periods of time, with just occasional high response times of 100-300ms.

I suspect that DoT connections are maybe cycled much faster and that's the price for the TLS handshake.

Could AGH log when it establishes a new connection to the upstream? e.g. nextdns cli prints something like this in the log:
Connected x.x.x.x:443 (con=8ms tls=9ms, TCP, TLS13)

@timkgh commented on GitHub (Sep 24, 2021): Ran some tests, here are my observations: DoT: responses are generally fast, 25-50ms range, **but** every 7-10 requests I see 1-2 requests that take 200-300ms which pushes the averages up and is not great for responsiveness. DoH, DoQ: smooth responses for long periods of time, with just occasional high response times of 100-300ms. I suspect that DoT connections are maybe cycled much faster and that's the price for the TLS handshake. Could AGH log when it establishes a new connection to the upstream? e.g. nextdns cli prints something like this in the log: `Connected x.x.x.x:443 (con=8ms tls=9ms, TCP, TLS13)`

deekerman commented

2026-03-04 02:56:54 -05:00

Author

Owner

@bcookatpcsd commented on GitHub (Sep 24, 2021):

@timkgh

I found things were much faster in the beta release..

(and I wish the logging was better too)

I use an sdns stamp to also cut down on looking up the host..

I've not looked into if that actually does reduce time.. but

My 0.02

I have one stream forward to NextDNS.. 4ms avg

@bcookatpcsd commented on GitHub (Sep 24, 2021): @timkgh I found things were much faster in the beta release.. (and I wish the logging was better too) ![image](https://user-images.githubusercontent.com/55087301/134736872-997efb90-13e8-456d-b80e-5bc4507c455a.png) I use an sdns stamp to also cut down on looking up the host.. I've not looked into if that actually does reduce time.. but My 0.02 I have one stream forward to NextDNS.. 4ms avg

deekerman commented

2026-03-04 02:56:54 -05:00

Author

Owner

@timkgh commented on GitHub (Sep 24, 2021):

4ms ... nice -- is that because of the new optimistic cache feature?

I just use IP addresses so there's no lookup and no need for bootstrap DNS, e.g. https://1.1.1.2/dns-query

I found that "load balancing" mode is problematic, it does quite the opposite of what it should do, based on empirical evidence.
https://github.com/AdguardTeam/AdGuardHome/discussions/3601#discussioncomment-1360429

AGH (and dnsproxy) might benefit from a look at performance, running some tests or at least collecting better stats so that users can report what they observe in practice.

@timkgh commented on GitHub (Sep 24, 2021): 4ms ... nice -- is that because of the new optimistic cache feature? I just use IP addresses so there's no lookup and no need for bootstrap DNS, e.g. https://1.1.1.2/dns-query I found that "load balancing" mode is problematic, it does quite the opposite of what it should do, based on empirical evidence. https://github.com/AdguardTeam/AdGuardHome/discussions/3601#discussioncomment-1360429 AGH (and dnsproxy) might benefit from a look at performance, running some tests or at least collecting better stats so that users can report what they observe in practice.

deekerman commented

2026-03-04 02:56:54 -05:00

Author

Owner

@ameshkov commented on GitHub (Sep 27, 2021):

DOT upstream connections pool implementation is not ideal in general, we'll need to revisit it later at some point.

@ameshkov commented on GitHub (Sep 27, 2021): DOT upstream connections pool implementation is not ideal in general, we'll need to revisit it later at some point.

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference

starred/AdGuardHome#3070

No description provided.

Rows
Columns