1

I'm trialing out CloudFlare (which I only want for speed optimisation). I'm guessing I should wait a bit longer to test the true benefits, due to propagation.

One thing I can't find out is if such premium DNS services (like CloudFlare) improve SSL/TLS time.

I've trialed CloudFlare on my personal site, which is hosted in Quebec. I am currently in Colombia and the ping has gone down from about 300ms to 55ms. However, the online tools that measure SSL/TLS handshake are reporting very different times.

UPDATE

After struggling through tests and literature to understand what the situation is. The answer is Yes, but if you are using CloudFlare you need to disable their firewall and other features and just use their DNS, see. Those features add about 330ms to your page load.

My DNS lookup times have gone from around 30ms on average in North America and Europe; and sometimes in excess of 200ms in other parts of the world down to between 1-3ms in general; and usually below 15ms anywhere. China seems to be an exception. This is a good site to test DNS times.

TLS time has been reduced from about 60-90ms to about 25-35ms in Europe and North America.

Difference in DNS time:

DNT time: before vs now

Improve this question
3
  • 1
    The things are unrelated but it depends on how you measure time. Before starting any TLS handshake the client needs to know the remote IP. To know it, it uses the DNS. So the total amount of time to do the handshake can be the DNS resolution time + the specific TLS handshake time, and hence obviously this will very upon the DNS performances. If you just measure really the TLS handshake time, starting with the TCP connection (so after the DNS resolution), then the DNS does not influence things (except for edge cases like OCSP or CRL downloading, or CT Log checking)
    – Patrick Mevzek
    Commented Dec 21, 2018 at 21:10
  • 1
    Also ping is a very poor troubleshooting/measurement tool, to the amount of never being useful in fact for many reasons. Use dig if you want to test speed of DNS queries (or any online tool doing the same, but not ping). Or at least specifically traceroute towards port 53 either UDP or TCP. But not ping.
    – Patrick Mevzek
    Commented Dec 21, 2018 at 21:12
  • Are you using CloudFlare's DNS and CDN service (orange cloud) or are you using their DNS but not their CDN (gray cloud)?
    – Maximillian Laumeister ♦
    Commented Dec 22, 2018 at 2:15

2 Answers 2

Reset to default
2

Premium DNS in its simplest form is just DNS redundancy, which almost always promise faster DNS servers around the world. Cloudflare's behemoth network can speed up DNS lookup time according to Cloudflare (https://cloudflare-dns.com/).

Cloudflare is much more than a premium DNS service. I use their free services on all of my websites for added speed and security. I also use their DNS servers (see above link) for the same reasons.

Measuring SSL/TLS handshakes can be problematic. TLS has at least 3 versions, and there is a negotiation going on. Does the server and the client both support TLS 1.3? If yes then use that; otherwise, let's try TLS 1.2 [...]. Cloudflare will allow you to use one of their free shared SSL certificates. I am suspicious that could add an extra step in the TLS negotiation vs using your own SSL cert on your web server.

I would like to see the numbers that you see in your testing. Cloudflare also has different levels of security that you can choose from. I'm certain that the more robust security measures will slow down connection time to your server as they are doing more checks. You may want to turn off the security features and see if that helps.

Improve this answer
2
  • Thanks from my test, DNS was quicker, TLS was quicker, but time to first byte was considerably slower. Overall using CloudFlare gives the same speed as a result. Maybe it was because of security features.
    – Kohjah Breese
    Commented Feb 1, 2019 at 19:11
  • 1
    @KohjahBreese Any slowdown of TTFB was caused by CloudFlare proxying your site (orange cloud). If you use CloudFlare as a faster DNS provider only and don't use the proxying feature (gray cloud), then your TTFB can only improve.
    – Maximillian Laumeister ♦
    Commented Mar 3, 2019 at 0:08
1

The true fact is that Premium DNS increase web security. Domain name servers affect all online business within the context of three main categories: speed, redundancy, and security:

Speed – Everyone hates a slow-loading website, right? DNS queries have a gigantic influence on load times. Slow queries lead to slow site speed which can, in turn, affect search engine rankings.

So yes, The levels of speed, redundancy, and security of any DNS will vary depending on what type you have.

Improve this answer
1
  • "The true fact is that Premium DNS increase web security" -> Not exactly true. By introducing 3rd party DNS, you introduce a second potential point of failure in addition to your registrar that an attacker can attempt to compromise to redirect your site. It's possible that using 3rd party DNS would not decrease your security, but it can never increase it. It's a subtractive effect on security - like adding a second door to your house - no matter how secure the second door is.
    – Maximillian Laumeister ♦
    Commented Jan 25, 2019 at 0:11

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.