Slow DNS is often not DNS

A site takes two seconds to open, so everyone blames DNS. Measure first:

dig example.com +stats | grep 'Query time'
time curl -o /dev/null -s -w '%{time_namelookup} %{time_connect} %{time_total}\n' https://example.com

time_namelookup is the lookup; the gap to time_connect is the TCP handshake. Five milliseconds of lookup and 800 of connect means the path, not the resolver.

Genuinely slow DNS usually looks like several unreachable nameservers in resolv.conf, each costing a five-second timeout, or an IPv6-only resolver on a host with no IPv6 route.

And sometimes the application simply opens a new connection per request with no pooling and no cache, so every request pays for a lookup. Fix the client, not the resolver.