cid 4f2b265e9eff0fc6c6bf64ebc3d7c06e0f2448528df02fcbcad102e71a05c28a · original · open access · via openalex
Title: A Comparative Study of BIND, CoreDNS, and Technitium Performance With Respect to DoT and DoH Protocols Authors: D. M. Moulya; M N Chethan; G N Yashas; Saumya Hegde Venue: IEEE Access Year: 2026 Canonical: doi:10.1109/access.2026.3707650 URL: https://doi.org/10.1109/access.2026.3707650 Collector: openalex OA: true ABSTRACT Encrypted DNS protocols such as DNS-over-TLS (DoT) and DNS-over-HTTPS (DoH) address the privacy vulnerabilities of plain-text DNS but introduce performance trade-offs that depend strongly on the underlying resolver implementation, a dimension largely overlooked in prior work, which has focused on public-resolver protocol comparisons. This paper presents a systematic, implementation-centric evaluation of three widely deployed DNS resolvers (BIND v9.18, CoreDNS v1.11.3, and Technitium v12.2.1) under DoT and DoH, using an intercontinental client-server configuration on Microsoft Azure. We measured five performance metrics (runtime, handshake latency, average query latency, query throughput, and query completion rate) across three load conditions (100, 500, and 1,000 queries), producing 90 test runs. To move beyond descriptive comparison, we applied non-parametric statistical tests and collected system-level resource profiling data. Our results show that DoT performance is statistically implementation-agnostic ( $p = 0.288$ for throughput), with all three resolvers sustaining 170–210 queries per second at 100% completion. DoH performance, however, shows implementation-dependent characteristics ( $p = 0.002$ ): CoreDNS and Technitium maintain 170–190 QPS with 4–6% connection-timeout failures, while BIND collapses to 8–10 QPS which is a 98% throughput reduction with an effect size of $d = 3.51$ . System profiling reveals that BIND’s DoH collapse occurs while CPU, memory, and I/O remain at baseline, indicating a request-serialisation bottleneck in HTTP/2 session management rather than resource exhaustion. These findings demonstrate that resolver selection is as important as choosing the right protocol. Network administrators should carefully test their chosen DNS implementation with encrypted protocols before deployment.