“Slow internet” is usually DNS

Three separate “the internet is broken” reports in one month, from three different people, turned out to be the same thing: a resolver that answered quickly most of the time and took four seconds when it had to go upstream. Everything looked fine in a speed test, because a speed test resolves one name and then moves hundreds of megabytes.

Browsers, on the other hand, resolve dozens of names per page. One slow lookup per page is enough to make a fast connection feel broken.

How to tell in thirty seconds

Ask the machine to resolve the same name twice and time it:

time getent hosts example.com
time getent hosts example.com

If the second is instant and the first is not, you are looking at a cold cache. If both are slow, the resolver is slow. If both are instant while the browser still stalls, stop blaming DNS and look at the TLS handshake.

The TTL trap

Short TTLs make failover quick and make every cold client pay for a lookup. Long TTLs do the opposite. There is no universally right number, but there is a wrong one: copying a 60-second TTL from a tutorial onto a record that changes twice a year, then wondering why the resolver is doing all the work.

The fix is boring. Run a local caching resolver, point the network at it, and watch its query latency rather than the line speed. Most “slow internet” tickets close right there.