From a201f7de01db7824dfbb7a5883fbc3719c0dc33b Mon Sep 17 00:00:00 2001
From: Aditya Nugraha <vortexilation@gmail.com>
Date: Mon, 3 Aug 2026 10:57:25 +0700
Subject: [PATCH 1/6] dnsforward: fix misreported upstream response times

The dashboard's upstream response times were wrong in four independent
ways: inflated by roughly 2-4x whenever optimistic caching was enabled,
far higher than the actual network latency to the upstream servers, shown
against a headline figure that measured something else entirely, and
averaged over time incorrectly.

1. The response times were taken from the per-request
proxy.DNSContext.QueryStatistics, and the entries marked as served from
the cache were skipped.  An optimistic cache hit is answered from the
cache right away while dnsproxy refreshes the expired entry in a
background goroutine that uses a cloned DNSContext, whose statistics are
discarded.  Popular domain names are therefore never sampled at all, and
the average ends up being based on cache misses alone, which are skewed
towards the rare domain names that upstreams resolve slower.

Collect the response times from a *statsUpstream decorator wrapping every
upstream.Upstream instead.  It sits below dnsproxy, so it observes every
exchange, foreground and background alike, and it becomes the single
source of truth: stats.Entry.UpstreamStats is removed so that nothing is
counted twice.  The decorator is applied to the general, private-rDNS,
fallback, and per-client custom upstream configurations.

2. A plain DNS upstream retries once when an attempt times out, for
example when a UDP datagram is lost, and the retried exchange succeeds.
Its duration is then at least the whole upstream timeout, which defaults
to ten seconds, even though the successful attempt itself took about a
millisecond.  Averaged in as an ordinary response, a single such sample
outweighs a hundred normal ones several times over, which is what made
the reported times bear no relation to the round-trip time.  Skip the
exchanges whose duration reaches the timeout, since a single attempt
cannot take that long, so their duration describes the retry policy and
the configured timeout rather than the speed of the upstream.

3. The "Average upstream response time" panel showed avg_processing_time
as its headline, which is the time AdGuard Home itself takes and covers
every request, including the ones answered from the cache or blocked by a
filter.  Those take almost no time, so the headline was typically an
order of magnitude lower than every upstream listed right below it.  Add
an avg_upstream_response_time property to GET /control/stats, averaged
over the responses of the upstream servers, and show that instead.

4. The average processing time was the unweighted mean of the per-hour
means, so an hour with a handful of requests weighed as much as an hour
with tens of thousands of them.  Weight it by the number of requests, the
way the upstream response times already were.

Two things constrain the implementation:

  - The wrapping is done in place on s.conf.UpstreamConfig rather than on
    a copy handed to the proxy, because several tests assign mock
    upstreams to it after Prepare and rely on the proxy sharing that
    pointer.

  - The decorator must not acquire Server.serverLock.  Server.Resolve
    holds it for reading while driving the internal proxy over the same
    upstreams, so a nested RLock would deadlock whenever a writer queues
    between the two.  Hence Server.upstreamStats, which is set once in
    NewServer and never reset.

Note that the metric now also counts the internal proxy's lookups (client
rDNS, updater) and DNS64 sub-queries, and that the statistics "ignored
clients" list no longer applies to upstream timings, since a background
refresh has no client to attribute it to.  The ignored *domains* list is
still honoured.

Closes #8435.
Closes #8457.
---
 CHANGELOG.md                                  |  29 ++
 client_v2/src/api/model/stats.ts              |   2 +
 .../src/components/Dashboard/Dashboard.tsx    |   2 +-
 .../UpstreamAvgTime/UpstreamAvgTime.tsx       |   4 +-
 client_v2/src/stores/stats.ts                 |   3 +
 internal/client/upstreammanager.go            |  19 +-
 internal/dnsforward/dnsforward.go             |  32 +-
 internal/dnsforward/stats.go                  |  11 +-
 internal/dnsforward/stats_internal_test.go    |  30 +-
 internal/dnsforward/upstreamstats.go          | 165 +++++++++
 .../dnsforward/upstreamstats_internal_test.go | 315 ++++++++++++++++++
 internal/stats/http.go                        |   9 +
 internal/stats/stats.go                       |  46 +++
 internal/stats/stats_test.go                  |  24 +-
 internal/stats/unit.go                        |  97 ++++--
 internal/stats/unit_internal_test.go          |  33 ++
 openapi/CHANGELOG.md                          |   4 +
 openapi/openapi.yaml                          |  13 +-
 18 files changed, 785 insertions(+), 53 deletions(-)
 create mode 100644 internal/dnsforward/upstreamstats.go
 create mode 100644 internal/dnsforward/upstreamstats_internal_test.go

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 4f0a676a578..d90533f3616 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -46,8 +46,37 @@ NOTE: Add new changes BELOW THIS COMMENT.
 
 - Blocked requests without an EDNS(0) OPT record ([#8183]).
 
+- Inflated average upstream response time on the dashboard when optimistic caching is enabled
+  ([#8435]).  An optimistic cache hit is answered from the cache right away and the expired entry
+  is refreshed by a background query, and those background queries used to be left out of the
+  statistics.  The average was therefore based on cache misses alone, which are skewed towards
+  rare domain names that the upstream itself resolves slower.  Every exchange with an upstream
+  server is now counted, including the background ones.
+
+- Upstream response times on the dashboard being far higher than the actual network latency to
+  the upstream servers ([#8457]).  A plain DNS upstream retries once when an attempt times out,
+  for example when a UDP datagram is lost, so a retried exchange takes at least the whole
+  `upstream_timeout`, ten seconds by default, even though the successful attempt itself took a
+  millisecond.  Such an exchange used to be averaged in as an ordinary response, where a single
+  one of them outweighed a hundred normal ones several times over.  Exchanges that had to retry
+  after a timeout are no longer counted, since their duration describes the retry policy and the
+  configured timeout rather than the speed of the upstream.
+
+- The "Average upstream response time" panel on the dashboard showed the average *processing*
+  time next to the list of per-upstream response times.  Processing time covers every request,
+  including the ones answered from the cache or blocked by a filter, which take almost no time,
+  so the panel's headline was typically an order of magnitude lower than every upstream listed
+  below it.  It now shows the new `avg_upstream_response_time` property of `GET /control/stats`,
+  which is averaged over the responses of the upstream servers.
+
+- The average processing time was the unweighted mean of the hourly means, which gave an hour
+  with a handful of requests the same weight as an hour with tens of thousands of them.  It is
+  now weighted by the number of requests, the same way the upstream response times already were.
+
 [#7514]: https://github.com/AdguardTeam/AdGuardHome/issues/7514
 [#8183]: https://github.com/AdguardTeam/AdGuardHome/issues/8183
+[#8435]: https://github.com/AdguardTeam/AdGuardHome/issues/8435
+[#8457]: https://github.com/AdguardTeam/AdGuardHome/issues/8457
 
 <!--
 NOTE: Add new changes ABOVE THIS COMMENT.
diff --git a/client_v2/src/api/model/stats.ts b/client_v2/src/api/model/stats.ts
index 84379e77bb5..3302d45f13b 100644
--- a/client_v2/src/api/model/stats.ts
+++ b/client_v2/src/api/model/stats.ts
@@ -19,6 +19,8 @@ export interface Stats {
     num_replaced_parental?: number;
     /** Average time in seconds on processing a DNS request */
     avg_processing_time?: number;
+    /** Average time in seconds that the upstream DNS servers took to respond */
+    avg_upstream_response_time?: number;
     top_queried_domains?: TopArrayEntry[];
     top_clients?: TopArrayEntry[];
     top_blocked_domains?: TopArrayEntry[];
diff --git a/client_v2/src/components/Dashboard/Dashboard.tsx b/client_v2/src/components/Dashboard/Dashboard.tsx
index dd302689d74..715549c7801 100644
--- a/client_v2/src/components/Dashboard/Dashboard.tsx
+++ b/client_v2/src/components/Dashboard/Dashboard.tsx
@@ -189,7 +189,7 @@ export const Dashboard = () => {
 
                             <UpstreamAvgTime
                                 topUpstreamsAvgTime={statsState.topUpstreamsAvgTime}
-                                avgProcessingTime={statsState.avgProcessingTime}
+                                avgUpstreamResponseTime={statsState.avgUpstreamResponseTime}
                             />
                         </div>
                     </Show>
diff --git a/client_v2/src/components/Dashboard/blocks/UpstreamAvgTime/UpstreamAvgTime.tsx b/client_v2/src/components/Dashboard/blocks/UpstreamAvgTime/UpstreamAvgTime.tsx
index 70c0bbbe2a4..91083720a4c 100644
--- a/client_v2/src/components/Dashboard/blocks/UpstreamAvgTime/UpstreamAvgTime.tsx
+++ b/client_v2/src/components/Dashboard/blocks/UpstreamAvgTime/UpstreamAvgTime.tsx
@@ -18,7 +18,7 @@ type UpstreamInfo = {
 
 type Props = {
     topUpstreamsAvgTime: UpstreamInfo[];
-    avgProcessingTime: number;
+    avgUpstreamResponseTime: number;
 };
 
 export const UpstreamAvgTime = (props: Props) => {
@@ -44,7 +44,7 @@ export const UpstreamAvgTime = (props: Props) => {
 
                 <Show when={hasStats()}>
                     <div class={cn(theme.text.t3, s.cardSubtitle)}>
-                        {(props.avgProcessingTime ?? 0).toFixed(0)}{' '}
+                        {(props.avgUpstreamResponseTime ?? 0).toFixed(0)}{' '}
                         {intl.getMessage('milliseconds_abbreviation')}
                     </div>
                 </Show>
diff --git a/client_v2/src/stores/stats.ts b/client_v2/src/stores/stats.ts
index defb66198b6..0acb7a409c7 100644
--- a/client_v2/src/stores/stats.ts
+++ b/client_v2/src/stores/stats.ts
@@ -44,6 +44,7 @@ type StatsState = {
     numReplacedSafebrowsing: number;
     numReplacedSafesearch: number;
     avgProcessingTime: number;
+    avgUpstreamResponseTime: number;
     timeUnits: string;
     enabled: boolean;
     topUpstreamsAvgTime: { name: string; count: number }[];
@@ -73,6 +74,7 @@ const initialState: StatsState = {
     numReplacedSafebrowsing: 0,
     numReplacedSafesearch: 0,
     avgProcessingTime: 0,
+    avgUpstreamResponseTime: 0,
     timeUnits: TIME_UNITS?.HOURS || 'hours',
     enabled: true,
     topUpstreamsAvgTime: [],
@@ -108,6 +110,7 @@ export const getStats = async (period?: number) => {
             numReplacedSafebrowsing: data.num_replaced_safebrowsing || 0,
             numReplacedSafesearch: data.num_replaced_safesearch || 0,
             avgProcessingTime: secondsToMilliseconds(data.avg_processing_time),
+            avgUpstreamResponseTime: secondsToMilliseconds(data.avg_upstream_response_time),
             timeUnits: data.time_units || initialState.timeUnits,
             topUpstreamsAvgTime: normalizeTopStats(data.top_upstreams_avg_time || []).map(
                 (item: { name: string; count: number }) => ({
diff --git a/internal/client/upstreammanager.go b/internal/client/upstreammanager.go
index 3c57174169b..14b021f4be0 100644
--- a/internal/client/upstreammanager.go
+++ b/internal/client/upstreammanager.go
@@ -16,10 +16,23 @@ import (
 	"github.com/AdguardTeam/golibs/timeutil"
 )
 
+// UpstreamConfigWrapper wraps parsed upstream configurations, e.g. to collect
+// statistics about the exchanges with them.
+type UpstreamConfigWrapper interface {
+	// WrapUpstreamConfig returns a wrapped copy of uc, or nil if uc is nil.  It
+	// must not modify uc.
+	WrapUpstreamConfig(uc *proxy.UpstreamConfig) (wrapped *proxy.UpstreamConfig)
+}
+
 // CommonUpstreamConfig contains common settings for custom client upstream
 // configurations.
 type CommonUpstreamConfig struct {
-	Bootstrap               upstream.Resolver
+	Bootstrap upstream.Resolver
+
+	// UpstreamConfigWrapper wraps the parsed custom client upstream
+	// configurations.  If it's nil, they are used as is.
+	UpstreamConfigWrapper UpstreamConfigWrapper
+
 	UpstreamTimeout         time.Duration
 	BootstrapPreferIPv6     bool
 	EDNSClientSubnetEnabled bool
@@ -232,6 +245,10 @@ func newCustomUpstreamConfig(
 		panic(fmt.Errorf("creating custom upstream config: %w", err))
 	}
 
+	if w := conf.UpstreamConfigWrapper; w != nil {
+		upsConf = w.WrapUpstreamConfig(upsConf)
+	}
+
 	return proxy.NewCustomUpstreamConfig(
 		upsConf,
 		cliConf.upstreamsCacheEnabled,
diff --git a/internal/dnsforward/dnsforward.go b/internal/dnsforward/dnsforward.go
index e396e0c5051..c2de8ac489d 100644
--- a/internal/dnsforward/dnsforward.go
+++ b/internal/dnsforward/dnsforward.go
@@ -121,6 +121,14 @@ type Server struct {
 	// stats is the statistics collector for client's DNS usage data.
 	stats stats.Interface
 
+	// upstreamStats is the same collector as stats, but it's set once and never
+	// reset, so that it can be used from [statsUpstream] without acquiring
+	// serverLock.  An upstream exchange may happen while serverLock is already
+	// held for reading, see [Server.Resolve], so acquiring it again there could
+	// deadlock with a concurrent writer.  Updating an already closed collector
+	// only loses the data, which is acceptable during the shutdown.
+	upstreamStats stats.Interface
+
 	// sysResolvers used to fetch system resolvers to use by default for private
 	// PTR resolving.
 	sysResolvers SystemResolvers
@@ -242,13 +250,14 @@ func NewServer(p DNSCreateParams) (s *Server, err error) {
 	}
 
 	s = &Server{
-		dnsFilter:   p.DNSFilter,
-		dhcpServer:  p.DHCPServer,
-		stats:       p.Stats,
-		queryLog:    p.QueryLog,
-		privateNets: p.PrivateNets,
-		baseLogger:  p.Logger,
-		logger:      p.Logger.With(slogutil.KeyPrefix, "dnsforward"),
+		dnsFilter:     p.DNSFilter,
+		dhcpServer:    p.DHCPServer,
+		stats:         p.Stats,
+		upstreamStats: p.Stats,
+		queryLog:      p.QueryLog,
+		privateNets:   p.PrivateNets,
+		baseLogger:    p.Logger,
+		logger:        p.Logger.With(slogutil.KeyPrefix, "dnsforward"),
 		// TODO(e.burkov):  Use some case-insensitive string comparison.
 		localDomainSuffix: strings.ToLower(localDomainSuffix),
 		etcHosts:          etcHosts,
@@ -567,9 +576,10 @@ func (s *Server) prepareUpstreamSettings(ctx context.Context, boot upstream.Reso
 		return fmt.Errorf("preparing upstream config: %w", err)
 	}
 
-	s.conf.UpstreamConfig = uc
+	s.conf.UpstreamConfig = s.WrapUpstreamConfig(uc)
 	s.conf.ClientsContainer.UpdateCommonUpstreamConfig(&client.CommonUpstreamConfig{
 		Bootstrap:               boot,
+		UpstreamConfigWrapper:   s,
 		UpstreamTimeout:         s.conf.UpstreamTimeout,
 		BootstrapPreferIPv6:     s.conf.BootstrapPreferIPv6,
 		EDNSClientSubnetEnabled: s.conf.EDNSClientSubnet.Enabled,
@@ -665,11 +675,13 @@ func (s *Server) prepareInternalDNS(ctx context.Context) (err error) {
 		return err
 	}
 
-	s.conf.PrivateRDNSUpstreamConfig, err = s.prepareLocalResolvers(ctx)
+	privateUC, err := s.prepareLocalResolvers(ctx)
 	if err != nil {
 		return err
 	}
 
+	s.conf.PrivateRDNSUpstreamConfig = s.WrapUpstreamConfig(privateUC)
+
 	err = s.prepareInternalProxy()
 	if err != nil {
 		return fmt.Errorf("preparing internal proxy: %w", err)
@@ -698,7 +710,7 @@ func (s *Server) setupFallbackDNS() (uc *proxy.UpstreamConfig, err error) {
 		return nil, err
 	}
 
-	return uc, nil
+	return s.WrapUpstreamConfig(uc), nil
 }
 
 // setupAddrProc initializes the address processor.  It assumes s.serverLock is
diff --git a/internal/dnsforward/stats.go b/internal/dnsforward/stats.go
index a0b5a72d833..434087f983e 100644
--- a/internal/dnsforward/stats.go
+++ b/internal/dnsforward/stats.go
@@ -143,15 +143,10 @@ func (s *Server) logQuery(dctx *dnsContext, ip net.IP, processingTime time.Durat
 func (s *Server) updateStats(dctx *dnsContext, clientIP string, processingTime time.Duration) {
 	pctx := dctx.proxyCtx
 
-	var upstreamStats []*proxy.UpstreamStatistics
-	qs := pctx.QueryStatistics()
-	if qs != nil {
-		upstreamStats = append(upstreamStats, qs.Main()...)
-		upstreamStats = append(upstreamStats, qs.Fallback()...)
-	}
-
+	// NOTE:  The upstream response times are not taken from
+	// [proxy.DNSContext.QueryStatistics] here, since they are collected for
+	// every exchange, including the background ones, see [statsUpstream].
 	e := &stats.Entry{
-		UpstreamStats:  upstreamStats,
 		Domain:         aghnet.NormalizeDomain(pctx.Req.Question[0].Name),
 		Result:         stats.RNotFiltered,
 		ProcessingTime: processingTime,
diff --git a/internal/dnsforward/stats_internal_test.go b/internal/dnsforward/stats_internal_test.go
index 91f5aa85852..8802280d8d9 100644
--- a/internal/dnsforward/stats_internal_test.go
+++ b/internal/dnsforward/stats_internal_test.go
@@ -2,6 +2,8 @@ package dnsforward
 
 import (
 	"net/netip"
+	"slices"
+	"sync"
 	"testing"
 	"time"
 
@@ -36,13 +38,20 @@ func (l *testQueryLog) ShouldLog(string, uint16, uint16, []string) bool {
 	return true
 }
 
-// testStats is a simple [stats.Interface] implementation for tests.
+// testStats is a simple [stats.Interface] implementation for tests.  It's safe
+// for concurrent use, since the upstream entries may be collected from the
+// background goroutines, e.g. the optimistic cache resolver's ones.
 type testStats struct {
 	// Stats is embedded here simply to make testStats a [stats.Interface]
 	// without actually implementing all methods.
 	stats.Interface
 
+	// mu protects lastEntry and upsEntries.
+	mu sync.Mutex
+
 	lastEntry *stats.Entry
+
+	upsEntries []*stats.UpstreamEntry
 }
 
 // Update implements the [stats.Interface] interface for *testStats.
@@ -51,9 +60,28 @@ func (l *testStats) Update(e *stats.Entry) {
 		return
 	}
 
+	l.mu.Lock()
+	defer l.mu.Unlock()
+
 	l.lastEntry = e
 }
 
+// UpdateUpstream implements the [stats.Interface] interface for *testStats.
+func (l *testStats) UpdateUpstream(e *stats.UpstreamEntry) {
+	l.mu.Lock()
+	defer l.mu.Unlock()
+
+	l.upsEntries = append(l.upsEntries, e)
+}
+
+// upstreamEntries returns a copy of the collected upstream entries.
+func (l *testStats) upstreamEntries() (entries []*stats.UpstreamEntry) {
+	l.mu.Lock()
+	defer l.mu.Unlock()
+
+	return slices.Clone(l.upsEntries)
+}
+
 // ShouldCount implements the [stats.Interface] interface for *testStats.
 func (l *testStats) ShouldCount(string, uint16, uint16, []string) bool {
 	return true
diff --git a/internal/dnsforward/upstreamstats.go b/internal/dnsforward/upstreamstats.go
new file mode 100644
index 00000000000..f24027f73e0
--- /dev/null
+++ b/internal/dnsforward/upstreamstats.go
@@ -0,0 +1,165 @@
+package dnsforward
+
+import (
+	"time"
+
+	"github.com/AdguardTeam/AdGuardHome/internal/aghnet"
+	"github.com/AdguardTeam/AdGuardHome/internal/stats"
+	"github.com/AdguardTeam/dnsproxy/proxy"
+	"github.com/AdguardTeam/dnsproxy/upstream"
+	"github.com/miekg/dns"
+)
+
+// statsUpstream is an [upstream.Upstream] that records the duration of each
+// successful exchange in the statistics.
+//
+// The response times are collected here, and not from
+// [proxy.DNSContext.QueryStatistics], because the latter only describes the
+// exchanges performed for a client's request.  The optimistic cache replies
+// from the cache right away and refreshes the expired entry in a background
+// goroutine, so those exchanges would never be counted, and the average
+// upstream response time would only be based on cache misses, which are biased
+// towards rare and slow domain names.
+//
+// See https://github.com/AdguardTeam/AdGuardHome/issues/8435.
+type statsUpstream struct {
+	// upstream is the wrapped upstream DNS server.  It must not be nil.
+	upstream upstream.Upstream
+
+	// srv is used to access the statistics.  It must not be nil.
+	srv *Server
+
+	// timeout is the timeout of a single exchange attempt with the wrapped
+	// upstream, see [ServerConfig.UpstreamTimeout].  It is zero if there is no
+	// timeout.
+	timeout time.Duration
+}
+
+// type check
+var _ upstream.Upstream = (*statsUpstream)(nil)
+
+// Exchange implements the [upstream.Upstream] interface for *statsUpstream.
+func (u *statsUpstream) Exchange(req *dns.Msg) (resp *dns.Msg, err error) {
+	startTime := time.Now()
+	resp, err = u.upstream.Exchange(req)
+	if err != nil {
+		// Don't count the failed exchanges, since their duration is mostly
+		// defined by the timeout.
+		return resp, err
+	}
+
+	u.srv.updateUpstreamStats(u.upstream.Address(), req, time.Since(startTime), u.timeout)
+
+	return resp, nil
+}
+
+// Address implements the [upstream.Upstream] interface for *statsUpstream.
+func (u *statsUpstream) Address() (addr string) {
+	return u.upstream.Address()
+}
+
+// Close implements the [upstream.Upstream] interface for *statsUpstream.
+func (u *statsUpstream) Close() (err error) {
+	return u.upstream.Close()
+}
+
+// updateUpstreamStats writes the response time of a single successful exchange
+// with the upstream server at addr into the statistics.  timeout is the timeout
+// of a single exchange attempt, if any.  req must not be nil.
+func (s *Server) updateUpstreamStats(addr string, req *dns.Msg, dur, timeout time.Duration) {
+	if len(req.Question) == 0 {
+		return
+	}
+
+	if timeout > 0 && dur >= timeout {
+		// A single attempt cannot take longer than the timeout, so this
+		// exchange has retried at least once after an attempt that timed out.
+		//
+		// Such a duration describes the retry policy and the configured
+		// timeout, which defaults to ten seconds, rather than the speed of the
+		// upstream.  Averaging it in makes the reported response time an order
+		// of magnitude higher than the actual one: with a ten-second timeout,
+		// one retried query out of a hundred outweighs the other ninety-nine
+		// several times over.
+		//
+		// See https://github.com/AdguardTeam/AdGuardHome/issues/8457.
+		s.logger.Debug(
+			"upstream retried after timeout; not counting in stats",
+			"addr", addr,
+			"duration", dur,
+			"timeout", timeout,
+		)
+
+		return
+	}
+
+	// NOTE:  s.serverLock must not be acquired here, see [Server.upstreamStats].
+	if s.upstreamStats == nil {
+		return
+	}
+
+	s.upstreamStats.UpdateUpstream(&stats.UpstreamEntry{
+		Address:       addr,
+		Domain:        aghnet.NormalizeDomain(req.Question[0].Name),
+		QueryDuration: dur,
+	})
+}
+
+// WrapUpstreamConfig implements the [client.UpstreamConfigWrapper] interface
+// for *Server.  It returns a copy of uc with each upstream wrapped into
+// [*statsUpstream], or nil if uc is nil.  uc itself is not modified, but the
+// returned configuration shares the underlying upstreams with it, so only one
+// of the two should ever be closed.
+func (s *Server) WrapUpstreamConfig(uc *proxy.UpstreamConfig) (wrapped *proxy.UpstreamConfig) {
+	if uc == nil {
+		return nil
+	}
+
+	return &proxy.UpstreamConfig{
+		DomainReservedUpstreams:  s.wrapUpstreamsMap(uc.DomainReservedUpstreams),
+		SpecifiedDomainUpstreams: s.wrapUpstreamsMap(uc.SpecifiedDomainUpstreams),
+		SubdomainExclusions:      uc.SubdomainExclusions,
+		Upstreams:                s.wrapUpstreams(uc.Upstreams),
+	}
+}
+
+// wrapUpstreamsMap returns a copy of ups with each upstream wrapped into
+// [*statsUpstream], or nil if ups is nil.
+func (s *Server) wrapUpstreamsMap(
+	ups map[string][]upstream.Upstream,
+) (wrapped map[string][]upstream.Upstream) {
+	if ups == nil {
+		return nil
+	}
+
+	wrapped = make(map[string][]upstream.Upstream, len(ups))
+	for domain, u := range ups {
+		wrapped[domain] = s.wrapUpstreams(u)
+	}
+
+	return wrapped
+}
+
+// wrapUpstreams returns a copy of ups with each upstream wrapped into
+// [*statsUpstream], or nil if ups is nil.  A single upstream may be referenced
+// by several fields of a [proxy.UpstreamConfig], in which case it gets a
+// wrapper of its own for each reference, just like it gets closed once for each
+// of them, see [proxy.UpstreamConfig.Close].
+func (s *Server) wrapUpstreams(ups []upstream.Upstream) (wrapped []upstream.Upstream) {
+	if ups == nil {
+		return nil
+	}
+
+	timeout := s.conf.UpstreamTimeout
+
+	wrapped = make([]upstream.Upstream, 0, len(ups))
+	for _, u := range ups {
+		wrapped = append(wrapped, &statsUpstream{
+			upstream: u,
+			srv:      s,
+			timeout:  timeout,
+		})
+	}
+
+	return wrapped
+}
diff --git a/internal/dnsforward/upstreamstats_internal_test.go b/internal/dnsforward/upstreamstats_internal_test.go
new file mode 100644
index 00000000000..9f886cf50c8
--- /dev/null
+++ b/internal/dnsforward/upstreamstats_internal_test.go
@@ -0,0 +1,315 @@
+package dnsforward
+
+import (
+	"net"
+	"sync/atomic"
+	"testing"
+	"time"
+
+	"github.com/AdguardTeam/AdGuardHome/internal/aghtest"
+	"github.com/AdguardTeam/AdGuardHome/internal/filtering"
+	"github.com/AdguardTeam/AdGuardHome/internal/stats"
+	"github.com/AdguardTeam/dnsproxy/proxy"
+	"github.com/AdguardTeam/dnsproxy/upstream"
+	"github.com/AdguardTeam/golibs/container"
+	"github.com/AdguardTeam/golibs/errors"
+	"github.com/AdguardTeam/golibs/testutil"
+	"github.com/AdguardTeam/golibs/timeutil"
+	"github.com/miekg/dns"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+func TestStatsUpstream_Exchange(t *testing.T) {
+	const domain = "example.com."
+
+	req := (&dns.Msg{}).SetQuestion(domain, dns.TypeA)
+
+	testCases := []struct {
+		upsErr     error
+		req        *dns.Msg
+		name       string
+		wantDomain string
+	}{{
+		upsErr:     nil,
+		req:        req,
+		name:       "success",
+		wantDomain: "example.com",
+	}, {
+		upsErr:     errors.Error("network is unreachable"),
+		req:        req,
+		name:       "error",
+		wantDomain: "",
+	}, {
+		upsErr:     nil,
+		req:        &dns.Msg{},
+		name:       "no_question",
+		wantDomain: "",
+	}}
+
+	for _, tc := range testCases {
+		t.Run(tc.name, func(t *testing.T) {
+			st := &testStats{}
+			ups := &statsUpstream{
+				upstream: aghtest.NewUpstreamMock(func(req *dns.Msg) (resp *dns.Msg, err error) {
+					if tc.upsErr != nil {
+						return nil, tc.upsErr
+					}
+
+					return (&dns.Msg{}).SetReply(req), nil
+				}),
+				srv: &Server{upstreamStats: st},
+			}
+
+			_, err := ups.Exchange(tc.req)
+			if tc.upsErr != nil {
+				assert.ErrorIs(t, err, tc.upsErr)
+			} else {
+				assert.NoError(t, err)
+			}
+
+			entries := st.upstreamEntries()
+			if tc.wantDomain == "" {
+				assert.Empty(t, entries)
+
+				return
+			}
+
+			require.Len(t, entries, 1)
+
+			assert.Equal(t, tc.wantDomain, entries[0].Domain)
+			assert.Equal(t, ups.Address(), entries[0].Address)
+		})
+	}
+}
+
+// TestStatsUpstream_Exchange_timeoutRetry is a regression test for the upstream
+// response times being much higher than the actual network latency, see
+// https://github.com/AdguardTeam/AdGuardHome/issues/8457.
+//
+// A plain DNS upstream retries once when an attempt times out, e.g. when a UDP
+// datagram is lost, and the retried exchange succeeds.  Its duration is then at
+// least the whole upstream timeout, which defaults to ten seconds, so a single
+// such sample outweighs a hundred normal ones several times over.
+func TestStatsUpstream_Exchange_timeoutRetry(t *testing.T) {
+	const domain = "example.com."
+	const upsTimeout = 1 * time.Second
+
+	// dropFirst tells the upstream to ignore the very first query, the way a
+	// lossy network would.
+	var dropFirst atomic.Bool
+
+	var reqNum atomic.Uint32
+	upsAddr := aghtest.StartLocalhostUpstream(t, dns.HandlerFunc(func(
+		w dns.ResponseWriter,
+		r *dns.Msg,
+	) {
+		if reqNum.Add(1) == 1 && dropFirst.Load() {
+			return
+		}
+
+		resp := (&dns.Msg{}).SetReply(r)
+		resp.Answer = []dns.RR{&dns.A{
+			Hdr: dns.RR_Header{Name: domain, Rrtype: dns.TypeA, Class: dns.ClassINET, Ttl: 60},
+			A:   net.IP{1, 2, 3, 4},
+		}}
+
+		require.NoError(testutil.PanicT{}, w.WriteMsg(resp))
+	})).String()
+
+	testCases := []struct {
+		name      string
+		dropFirst bool
+		wantLen   int
+	}{{
+		name:      "normal_exchange_counted",
+		dropFirst: false,
+		wantLen:   1,
+	}, {
+		name:      "retried_exchange_not_counted",
+		dropFirst: true,
+		wantLen:   0,
+	}}
+
+	for _, tc := range testCases {
+		t.Run(tc.name, func(t *testing.T) {
+			reqNum.Store(0)
+			dropFirst.Store(tc.dropFirst)
+
+			ups, err := upstream.AddressToUpstream(upsAddr, &upstream.Options{
+				Logger:  testLogger,
+				Timeout: upsTimeout,
+			})
+			require.NoError(t, err)
+			testutil.CleanupAndRequireSuccess(t, ups.Close)
+
+			st := &testStats{}
+			wrapped := &statsUpstream{
+				upstream: ups,
+				srv:      &Server{upstreamStats: st, logger: testLogger},
+				timeout:  upsTimeout,
+			}
+
+			resp, err := wrapped.Exchange((&dns.Msg{}).SetQuestion(domain, dns.TypeA))
+			require.NoError(t, err)
+			require.NotEmpty(t, resp.Answer)
+
+			assert.Len(t, st.upstreamEntries(), tc.wantLen)
+		})
+	}
+}
+
+func TestServer_WrapUpstreamConfig(t *testing.T) {
+	s := &Server{}
+
+	t.Run("nil", func(t *testing.T) {
+		assert.Nil(t, s.WrapUpstreamConfig(nil))
+	})
+
+	t.Run("all_fields", func(t *testing.T) {
+		ups := aghtest.NewUpstreamMock(func(req *dns.Msg) (resp *dns.Msg, err error) {
+			panic(testutil.UnexpectedCall(req))
+		})
+		exclusions := container.NewMapSet("excluded.example.")
+
+		uc := &proxy.UpstreamConfig{
+			DomainReservedUpstreams: map[string][]upstream.Upstream{
+				"reserved.example.": {ups},
+			},
+			SpecifiedDomainUpstreams: map[string][]upstream.Upstream{
+				"specified.example.": {ups},
+			},
+			SubdomainExclusions: exclusions,
+			Upstreams:           []upstream.Upstream{ups},
+		}
+
+		wrapped := s.WrapUpstreamConfig(uc)
+		require.NotNil(t, wrapped)
+
+		assert.Same(t, exclusions, wrapped.SubdomainExclusions)
+
+		// The original configuration must stay intact.
+		assert.Same(t, ups, uc.Upstreams[0])
+
+		for _, u := range [][]upstream.Upstream{
+			wrapped.Upstreams,
+			wrapped.DomainReservedUpstreams["reserved.example."],
+			wrapped.SpecifiedDomainUpstreams["specified.example."],
+		} {
+			require.Len(t, u, 1)
+
+			su, ok := u[0].(*statsUpstream)
+			require.True(t, ok)
+
+			assert.Same(t, ups, su.upstream)
+			assert.Same(t, s, su.srv)
+		}
+	})
+
+	t.Run("nil_fields", func(t *testing.T) {
+		wrapped := s.WrapUpstreamConfig(&proxy.UpstreamConfig{})
+		require.NotNil(t, wrapped)
+
+		assert.Nil(t, wrapped.Upstreams)
+		assert.Nil(t, wrapped.DomainReservedUpstreams)
+		assert.Nil(t, wrapped.SpecifiedDomainUpstreams)
+	})
+}
+
+// TestServer_updateStats_optimisticCache is a regression test for the biased
+// average upstream response time, see
+// https://github.com/AdguardTeam/AdGuardHome/issues/8435.
+//
+// The response served from the optimistic cache is refreshed in the background,
+// and that refresh must be counted in the upstream statistics as well.
+func TestServer_updateStats_optimisticCache(t *testing.T) {
+	const domain = "example.com."
+
+	// cacheTTL is the TTL that the upstream sets on its answers, and also the
+	// maximum TTL of the cache, so that the entry expires quickly.
+	const cacheTTL = 1 * time.Second
+
+	upsAddr := aghtest.StartLocalhostUpstream(t, dns.HandlerFunc(func(
+		w dns.ResponseWriter,
+		r *dns.Msg,
+	) {
+		resp := (&dns.Msg{}).SetReply(r)
+		resp.Answer = []dns.RR{&dns.A{
+			Hdr: dns.RR_Header{
+				Name:   domain,
+				Rrtype: dns.TypeA,
+				Class:  dns.ClassINET,
+				Ttl:    uint32(cacheTTL.Seconds()),
+			},
+			A: net.IP{1, 2, 3, 4},
+		}}
+
+		require.NoError(testutil.PanicT{}, w.WriteMsg(resp))
+	})).String()
+
+	st := &testStats{}
+	forwardConf := ServerConfig{
+		UDPListenAddrs: []*net.UDPAddr{{}},
+		TCPListenAddrs: []*net.TCPAddr{{}},
+		TLSConf:        &TLSConfig{},
+		Config: Config{
+			UpstreamDNS:              []string{upsAddr},
+			UpstreamMode:             UpstreamModeLoadBalance,
+			CacheEnabled:             true,
+			CacheSize:                4096,
+			CacheMaxTTL:              uint32(cacheTTL.Seconds()),
+			CacheOptimistic:          true,
+			CacheOptimisticAnswerTTL: timeutil.Duration(time.Minute),
+			CacheOptimisticMaxAge:    timeutil.Duration(time.Hour),
+			EDNSClientSubnet:         &EDNSClientSubnet{Enabled: false},
+			ClientsContainer:         EmptyClientsContainer{},
+		},
+		ServePlainDNS: true,
+	}
+
+	s := createTestServer(t, &filtering.Config{
+		Logger:            testLogger,
+		ProtectionEnabled: true,
+		BlockingMode:      filtering.BlockingModeDefault,
+	}, forwardConf, testTLSConfigProvider)
+	s.stats, s.upstreamStats = st, st
+
+	startDeferStop(t, s)
+	addr := s.dnsProxy.Addr(proxy.ProtoUDP).String()
+
+	req := (&dns.Msg{}).SetQuestion(domain, dns.TypeA)
+
+	// The first query is a cache miss, so it's resolved by the upstream.
+	resp, err := dns.Exchange(req, addr)
+	require.NoError(t, err)
+	require.NotEmpty(t, resp.Answer)
+
+	assert.Len(t, st.upstreamEntries(), 1)
+
+	// Let the cached entry expire.
+	time.Sleep(cacheTTL + 100*time.Millisecond)
+
+	// The second query is an optimistic cache hit, so it's answered right away
+	// while the entry is refreshed in the background.
+	resp, err = dns.Exchange(req, addr)
+	require.NoError(t, err)
+	require.NotEmpty(t, resp.Answer)
+
+	// Use a timeout that is generous enough for the background refresh to
+	// finish on a loaded machine.
+	const refreshTimeout = 10 * time.Second
+
+	assert.Eventually(t, func() (ok bool) {
+		return len(st.upstreamEntries()) == 2
+	}, refreshTimeout, refreshTimeout/100)
+
+	// NOTE:  Don't assert on QueryDuration, since an exchange with a localhost
+	// upstream may well finish within a single tick of a coarse system clock.
+	for _, e := range st.upstreamEntries() {
+		assert.Equal(t, "example.com", e.Domain)
+		assert.Equal(t, upsAddr, e.Address)
+	}
+}
+
+// type check
+var _ stats.Interface = (*testStats)(nil)
diff --git a/internal/stats/http.go b/internal/stats/http.go
index 6feb3c8bab7..a7487a8bdf8 100644
--- a/internal/stats/http.go
+++ b/internal/stats/http.go
@@ -53,7 +53,16 @@ type StatsResp struct {
 	NumReplacedSafesearch   uint64 `json:"num_replaced_safesearch"`
 	NumReplacedParental     uint64 `json:"num_replaced_parental"`
 
+	// AvgProcessingTime is the average time of processing a request by AdGuard
+	// Home itself, in seconds.  It covers every request, including the ones
+	// answered from the cache or blocked by a filter, which take almost no
+	// time, so it is normally much lower than AvgUpstreamResponseTime.
 	AvgProcessingTime float64 `json:"avg_processing_time"`
+
+	// AvgUpstreamResponseTime is the average time that the upstream DNS servers
+	// took to respond, in seconds.  Unlike AvgProcessingTime, it only covers
+	// the requests that have actually been sent to an upstream server.
+	AvgUpstreamResponseTime float64 `json:"avg_upstream_response_time"`
 }
 
 // handleStats is the handler for the GET /control/stats HTTP API.
diff --git a/internal/stats/stats.go b/internal/stats/stats.go
index 5d1995cbaee..108b2b64507 100644
--- a/internal/stats/stats.go
+++ b/internal/stats/stats.go
@@ -94,6 +94,17 @@ type Interface interface {
 	// Update collects the incoming statistics data.
 	Update(e *Entry)
 
+	// UpdateUpstream collects the response time of a single successful exchange
+	// with an upstream DNS server.
+	//
+	// It's called separately from [Interface.Update], since not every exchange
+	// with an upstream server is bound to a client's request.  Most notably,
+	// the optimistic cache resolves expired entries in the background, and
+	// those exchanges must be accounted for as well, or else the average
+	// upstream response time is only based on cache misses, which are biased
+	// towards rare and slow domain names.
+	UpdateUpstream(e *UpstreamEntry)
+
 	// GetTopClientIP returns at most limit IP addresses corresponding to the
 	// clients with the most number of requests.
 	TopClientsIP(limit uint) []netip.Addr
@@ -302,6 +313,41 @@ func (s *StatsCtx) Update(e *Entry) {
 	s.curr.add(e)
 }
 
+// UpdateUpstream implements the [Interface] interface for *StatsCtx.  e must
+// not be nil.
+func (s *StatsCtx) UpdateUpstream(e *UpstreamEntry) {
+	s.confMu.Lock()
+	defer s.confMu.Unlock()
+
+	if !s.enabled || s.limit == 0 {
+		return
+	}
+
+	err := e.validate()
+	if err != nil {
+		s.logger.Debug("validating upstream entry", slogutil.KeyError, err)
+
+		return
+	}
+
+	// Only the domain can be checked here, since a background exchange, such as
+	// an optimistic cache refresh, has no client associated with it.
+	if s.isIgnored(e.Domain) {
+		return
+	}
+
+	s.currMu.Lock()
+	defer s.currMu.Unlock()
+
+	if s.curr == nil {
+		s.logger.Error("current unit is nil")
+
+		return
+	}
+
+	s.curr.addUpstream(e)
+}
+
 // WriteDiskConfig implements the [Interface] interface for *StatsCtx.
 func (s *StatsCtx) WriteDiskConfig(dc *Config) {
 	s.confMu.RLock()
diff --git a/internal/stats/stats_test.go b/internal/stats/stats_test.go
index 7e773ca6bc9..26e6faab984 100644
--- a/internal/stats/stats_test.go
+++ b/internal/stats/stats_test.go
@@ -15,7 +15,6 @@ import (
 	"github.com/AdguardTeam/AdGuardHome/internal/aghnet"
 	"github.com/AdguardTeam/AdGuardHome/internal/aghtest"
 	"github.com/AdguardTeam/AdGuardHome/internal/stats"
-	"github.com/AdguardTeam/dnsproxy/proxy"
 	"github.com/AdguardTeam/golibs/logutil/slogutil"
 	"github.com/AdguardTeam/golibs/netutil"
 	"github.com/AdguardTeam/golibs/testutil"
@@ -83,19 +82,21 @@ func TestStats(t *testing.T) {
 			Client:         cliIPStr,
 			Result:         stats.RFiltered,
 			ProcessingTime: time.Microsecond * 123456,
-			UpstreamStats: []*proxy.UpstreamStatistics{{
-				Address:       respUpstream,
-				QueryDuration: time.Microsecond * 222222,
-			}},
 		}, {
 			Domain:         reqDomain,
 			Client:         cliIPStr,
 			Result:         stats.RNotFiltered,
 			ProcessingTime: time.Microsecond * 123456,
-			UpstreamStats: []*proxy.UpstreamStatistics{{
-				Address:       respUpstream,
-				QueryDuration: time.Microsecond * 222222,
-			}},
+		}}
+
+		upsEntries := []*stats.UpstreamEntry{{
+			Address:       respUpstream,
+			Domain:        reqDomain,
+			QueryDuration: time.Microsecond * 222222,
+		}, {
+			Address:       respUpstream,
+			Domain:        reqDomain,
+			QueryDuration: time.Microsecond * 222222,
 		}}
 
 		wantData := &stats.StatsResp{
@@ -127,12 +128,17 @@ func TestStats(t *testing.T) {
 			NumReplacedSafesearch:   0,
 			NumReplacedParental:     0,
 			AvgProcessingTime:       0.123456,
+			AvgUpstreamResponseTime: 0.222222,
 		}
 
 		for _, e := range entries {
 			s.Update(e)
 		}
 
+		for _, e := range upsEntries {
+			s.UpdateUpstream(e)
+		}
+
 		data := &stats.StatsResp{}
 		req := httptest.NewRequest(http.MethodGet, "/control/stats", nil)
 		assertSuccessAndUnmarshal(t, data, handlers["/control/stats"], req)
diff --git a/internal/stats/unit.go b/internal/stats/unit.go
index a8d7a3d6266..479683a99e7 100644
--- a/internal/stats/unit.go
+++ b/internal/stats/unit.go
@@ -10,7 +10,6 @@ import (
 	"time"
 
 	"github.com/AdguardTeam/AdGuardHome/internal/aghnet"
-	"github.com/AdguardTeam/dnsproxy/proxy"
 	"github.com/AdguardTeam/golibs/errors"
 	"github.com/AdguardTeam/golibs/logutil/slogutil"
 	"go.etcd.io/bbolt"
@@ -63,10 +62,6 @@ type Entry struct {
 	// Domain is the domain name requested.
 	Domain string
 
-	// UpstreamStats contains the DNS query statistics for both the upstream and
-	// fallback DNS servers.  Don't modify items in the slice.
-	UpstreamStats []*proxy.UpstreamStatistics
-
 	// Result is the result of processing the request.
 	Result Result
 
@@ -91,6 +86,34 @@ func (e *Entry) validate() (err error) {
 	}
 }
 
+// UpstreamEntry is a statistics data entry for a single successful DNS exchange
+// with an upstream server.
+//
+// Note that such an exchange isn't necessarily bound to a client's request, see
+// [Interface.UpdateUpstream].
+type UpstreamEntry struct {
+	// Address is the address of the upstream DNS server that responded.
+	Address string
+
+	// Domain is the domain name that has been requested from the upstream.
+	Domain string
+
+	// QueryDuration is the duration of the exchange.
+	QueryDuration time.Duration
+}
+
+// validate returns an error if the upstream entry is not valid.
+func (e *UpstreamEntry) validate() (err error) {
+	switch {
+	case e.Address == "":
+		return errors.Error("upstream address is empty")
+	case e.Domain == "":
+		return errors.Error("domain is empty")
+	default:
+		return nil
+	}
+}
+
 // unit collects the statistics data for a specific period of time.
 type unit struct {
 	// domains stores the number of requests for each domain.
@@ -327,16 +350,13 @@ func (u *unit) add(e *Entry) {
 	pt := uint64(e.ProcessingTime.Microseconds())
 	u.timeSum += pt
 	u.nTotal++
+}
 
-	for _, s := range e.UpstreamStats {
-		if s.IsCached || s.Error != nil {
-			continue
-		}
-
-		addr := s.Address
-		u.upstreamsResponses[addr]++
-		u.upstreamsTimeSum[addr] += uint64(s.QueryDuration.Microseconds())
-	}
+// addUpstream adds the data about a single upstream exchange to u.  It's safe
+// for concurrent use.
+func (u *unit) addUpstream(e *UpstreamEntry) {
+	u.upstreamsResponses[e.Address]++
+	u.upstreamsTimeSum[e.Address] += uint64(e.QueryDuration.Microseconds())
 }
 
 // flushUnitToDB puts udb to the database at id.
@@ -445,6 +465,8 @@ func (s *StatsCtx) dataFromUnits(units []*unitDB, curID uint32) (resp *StatsResp
 		TopUpstreamsResponses: topUpstreamsResponses,
 		TopUpstreamsAvgTime:   topUpstreamsAvgTime,
 		TopClients:            topsCollector(units, maxClients, nil, topClientPairs(s)),
+
+		AvgUpstreamResponseTime: avgUpstreamResponseTime(units),
 	}
 
 	s.fillCollectedStats(resp, units, curID)
@@ -453,13 +475,21 @@ func (s *StatsCtx) dataFromUnits(units []*unitDB, curID uint32) (resp *StatsResp
 	sum := unitDB{
 		NResult: make([]uint64, resultLast),
 	}
-	var timeN uint32
+
+	// timeSum is the total processing time of all the requests within units, in
+	// microseconds, and timeN is their number.
+	//
+	// NOTE:  [unitDB.TimeAvg] is the mean processing time within a single unit,
+	// so it must be weighted by the number of requests of that unit.  Taking
+	// the mean of the means instead would give an hour with a handful of
+	// requests the same weight as an hour with tens of thousands of them, and
+	// would also disagree with the upstream response times, which are averaged
+	// over the whole period, see [topUpstreamsPairs].
+	var timeSum, timeN uint64
 	for _, u := range units {
 		sum.NTotal += u.NTotal
-		sum.TimeAvg += u.TimeAvg
-		if u.TimeAvg != 0 {
-			timeN++
-		}
+		timeSum += uint64(u.TimeAvg) * u.NTotal
+		timeN += u.NTotal
 		sum.NResult[RFiltered] += u.NResult[RFiltered]
 		sum.NResult[RSafeBrowsing] += u.NResult[RSafeBrowsing]
 		sum.NResult[RSafeSearch] += u.NResult[RSafeSearch]
@@ -473,7 +503,7 @@ func (s *StatsCtx) dataFromUnits(units []*unitDB, curID uint32) (resp *StatsResp
 	resp.NumReplacedParental = sum.NResult[RParental]
 
 	if timeN != 0 {
-		resp.AvgProcessingTime = microsecondsToSeconds(float64(sum.TimeAvg / timeN))
+		resp.AvgProcessingTime = microsecondsToSeconds(float64(timeSum) / float64(timeN))
 	}
 
 	return resp
@@ -596,6 +626,33 @@ func topUpstreamsPairs(
 	return topUpstreamsResponses, prepareTopUpstreamsAvgTime(upstreamsAvgTime)
 }
 
+// avgUpstreamResponseTime returns the average time that the upstream DNS
+// servers took to respond within units, in seconds.
+//
+// It is averaged over the responses of every upstream server, as opposed to
+// [StatsResp.AvgProcessingTime], which is averaged over every request that
+// AdGuard Home has processed, including the ones answered from the cache or
+// blocked by a filter.  Those take almost no time, so the two values are
+// expected to differ, often by an order of magnitude.
+func avgUpstreamResponseTime(units []*unitDB) (avg float64) {
+	var timeSum, respNum uint64
+	for _, u := range units {
+		for _, cp := range u.UpstreamsTimeSum {
+			timeSum += cp.Count
+		}
+
+		for _, cp := range u.UpstreamsResponses {
+			respNum += cp.Count
+		}
+	}
+
+	if respNum == 0 {
+		return 0
+	}
+
+	return microsecondsToSeconds(float64(timeSum) / float64(respNum))
+}
+
 // microsecondsToSeconds converts microseconds to seconds.
 //
 // NOTE:  Frontend expects time duration in seconds as floating-point number
diff --git a/internal/stats/unit_internal_test.go b/internal/stats/unit_internal_test.go
index ea3bff50df9..c58a2e35e32 100644
--- a/internal/stats/unit_internal_test.go
+++ b/internal/stats/unit_internal_test.go
@@ -175,3 +175,36 @@ func TestTopUpstreamsPairs(t *testing.T) {
 		})
 	}
 }
+
+// TestStatsCtx_dataFromUnits_avgProcessingTime makes sure that the average
+// processing time is weighted by the number of requests of each unit.
+//
+// [unitDB.TimeAvg] is the mean within a single unit, so taking the mean of the
+// means would give a nearly idle hour the same weight as a busy one.
+func TestStatsCtx_dataFromUnits_avgProcessingTime(t *testing.T) {
+	t.Parallel()
+
+	// A busy unit with a low mean and a nearly idle one with a high mean.  The
+	// weighted mean is dominated by the busy unit:
+	//
+	//	(1000*1000 + 100000*10) / (1000 + 10) = 1980.198 microseconds
+	//
+	// The unweighted mean of the means would be (1000 + 100000) / 2 = 50500,
+	// which is off by more than an order of magnitude.
+	units := []*unitDB{{
+		NResult: make([]uint64, resultLast),
+		NTotal:  1000,
+		TimeAvg: 1000,
+	}, {
+		NResult: make([]uint64, resultLast),
+		NTotal:  10,
+		TimeAvg: 100_000,
+	}}
+
+	s := &StatsCtx{}
+	resp := s.dataFromUnits(units, 0)
+
+	wantAvg := microsecondsToSeconds(2_000_000 / 1010.0)
+	assert.InDelta(t, wantAvg, resp.AvgProcessingTime, 1e-12)
+	assert.Equal(t, uint64(1010), resp.NumDNSQueries)
+}
diff --git a/openapi/CHANGELOG.md b/openapi/CHANGELOG.md
index 32ab9a7ce1d..e3340490a9e 100644
--- a/openapi/CHANGELOG.md
+++ b/openapi/CHANGELOG.md
@@ -20,6 +20,10 @@
 
 - New property `"language"` in `POST /control/install/check_config` and `POST /control/install/configure` HTTP APIs defines the language to use once AdGuard Home is installed.
 
+### New `avg_upstream_response_time` field in `GET /control/stats`
+
+- New property `avg_upstream_response_time` in the `Stats` object contains the average time in seconds that the upstream DNS servers took to respond.  Unlike `avg_processing_time`, which covers every request AdGuard Home has processed, including the ones answered from the cache or blocked by a filter, it only covers the requests that have actually been sent to an upstream server.  The two are therefore expected to differ, often by an order of magnitude.
+
 ## v0.107.78: API changes
 
 The property `interval` of the objects returned from and accepted by the aforementioned APIs can now be any integer between 0 and 8760 (365 days).
diff --git a/openapi/openapi.yaml b/openapi/openapi.yaml
index 7c927bb7ae5..340ccff9709 100644
--- a/openapi/openapi.yaml
+++ b/openapi/openapi.yaml
@@ -1948,7 +1948,18 @@
         'avg_processing_time':
           'type': 'number'
           'format': 'float'
-          'description': 'Average time in seconds on processing a DNS request'
+          'description':
+            'Average time in seconds on processing a DNS request.  It covers every request,
+            including the ones answered from the cache or blocked by a filter, so it is
+            normally much lower than avg_upstream_response_time.'
+          'example': 0.34
+        'avg_upstream_response_time':
+          'type': 'number'
+          'format': 'float'
+          'description':
+            'Average time in seconds that the upstream DNS servers took to respond.  Unlike
+            avg_processing_time, it only covers the requests that have actually been sent to
+            an upstream server.'
           'example': 0.34
         'top_queried_domains':
           'type': 'array'

From 54692022d75b74c060f7f645cb6eae0321fdbdb5 Mon Sep 17 00:00:00 2001
From: Aditya Nugraha <vortexilation@gmail.com>
Date: Mon, 3 Aug 2026 10:58:31 +0700
Subject: [PATCH 2/6] client: confirm that the DNS cache has been cleared

Accepting the "Clear cache?" dialog gave no feedback at all on success, so
there was no way to tell whether it had worked.  clearDnsCache awaited
cacheClear and only reported failures, leaving the success path silent.
The previous user interface did show a notification, so this is a
regression in the rewrite rather than a missing feature.

Show one, using the new dns_cache_cleared string.
---
 CHANGELOG.md                      | 4 ++++
 client_v2/src/__locales/en.json   | 1 +
 client_v2/src/stores/dnsConfig.ts | 1 +
 3 files changed, 6 insertions(+)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index d90533f3616..ecd63b66f13 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -73,6 +73,10 @@ NOTE: Add new changes BELOW THIS COMMENT.
   with a handful of requests the same weight as an hour with tens of thousands of them.  It is
   now weighted by the number of requests, the same way the upstream response times already were.
 
+- Clearing the DNS cache gave no feedback at all once the confirmation dialog was accepted, so
+  there was no way to tell whether it had worked.  It now shows a notification on success, the
+  way the previous user interface did; failures were already reported.
+
 [#7514]: https://github.com/AdguardTeam/AdGuardHome/issues/7514
 [#8183]: https://github.com/AdguardTeam/AdGuardHome/issues/8183
 [#8435]: https://github.com/AdguardTeam/AdGuardHome/issues/8435
diff --git a/client_v2/src/__locales/en.json b/client_v2/src/__locales/en.json
index e86f5af005c..c1c75e12a15 100644
--- a/client_v2/src/__locales/en.json
+++ b/client_v2/src/__locales/en.json
@@ -214,6 +214,7 @@
   "dns_bootstrap_dns_placeholder": "IP addresses",
   "dns_bootstrap_dns_title": "Bootstrap DNS servers",
   "dns_bootstrap_servers": "Bootstrap DNS servers",
+  "dns_cache_cleared": "DNS cache cleared",
   "dns_cache_desc": "Stores DNS responses locally",
   "dns_cache_size": "Cache size",
   "dns_cache_size_desc": "Sets the DNS cache size",
diff --git a/client_v2/src/stores/dnsConfig.ts b/client_v2/src/stores/dnsConfig.ts
index 9663c4c5fb7..b6aaf25411b 100644
--- a/client_v2/src/stores/dnsConfig.ts
+++ b/client_v2/src/stores/dnsConfig.ts
@@ -95,6 +95,7 @@ export const getDnsConfig = async () => {
 export const clearDnsCache = async () => {
     try {
         await cacheClear();
+        addSuccessToast(intl.getMessage('dns_cache_cleared'));
     } catch (error) {
         addErrorToast({ error });
     }

From 07a9d6f6626842510fbc7f14d7d929af7a890a98 Mon Sep 17 00:00:00 2001
From: Aditya Nugraha <vortexilation@gmail.com>
Date: Mon, 3 Aug 2026 16:19:09 +0700
Subject: [PATCH 3/6] dnsforward: address review of the upstream statistics

Three defects in the upstream wrapper.

The ignore lists were bypassed.  statsUpstream recorded every successful
exchange, while ShouldCount is only consulted afterwards, in
processQueryLogsAndStats, and an UpstreamEntry carries no client identity
for UpdateUpstream to check.  A query from a client with ignored
statistics therefore still contributed its upstream address and duration,
which both contradicts the documented behaviour and biases the averages
this collection exists to report.  The first commit called that an
accepted consequence; it is not.

An exchange cannot be attributed to a client from inside a wrapper, so
record the verdict where the client is still known: processUpstream now
marks the request of an ignored query for the duration of its resolution,
and the wrappers skip the exchanges of a marked request.  Only ignored
queries are stored, so the map stays empty on a server that ignores
nothing.  Exchanges belonging to no request at all, such as the background
refreshes of the optimistic cache, are never marked and remain counted,
which is the point of collecting them here in the first place.

The timeout was read from mutable state.  wrapUpstreams took it from
Server.conf, which is written under serverLock by a /control/dns_config
update, while WrapUpstreamConfig is also called lazily by the client
upstream manager without that lock.  Take the timeout as an argument
instead; the client manager already has it in CommonUpstreamConfig.

The private rDNS wrappers held the wrong threshold.  Those upstreams are
built with defaultLocalTimeout, one second, but every wrapper stored the
configured timeout, normally ten seconds.  A one-second retried exchange
with a local resolver was therefore compared against ten and recorded as
an ordinary response, reintroducing the inflated sample this change
removes.  Passing the timeout explicitly lets each configuration carry the
one its upstreams were constructed with.

Each is covered by a test that fails against the previous implementation:
an end-to-end query from an ignored client, a concurrent wrap against a
protected timeout write under -race, and the thresholds stored for the
main and private rDNS configurations.
---
 internal/client/upstreammanager.go            |  10 +-
 internal/dnsforward/dnsforward.go             |  19 +-
 internal/dnsforward/process.go                |   5 +
 internal/dnsforward/stats.go                  |  30 ++-
 internal/dnsforward/stats_internal_test.go    |   9 +-
 internal/dnsforward/upstreamstats.go          |  74 ++++++-
 .../dnsforward/upstreamstats_internal_test.go | 188 +++++++++++++++++-
 7 files changed, 307 insertions(+), 28 deletions(-)

diff --git a/internal/client/upstreammanager.go b/internal/client/upstreammanager.go
index 14b021f4be0..0255f1078b1 100644
--- a/internal/client/upstreammanager.go
+++ b/internal/client/upstreammanager.go
@@ -20,8 +20,12 @@ import (
 // statistics about the exchanges with them.
 type UpstreamConfigWrapper interface {
 	// WrapUpstreamConfig returns a wrapped copy of uc, or nil if uc is nil.  It
-	// must not modify uc.
-	WrapUpstreamConfig(uc *proxy.UpstreamConfig) (wrapped *proxy.UpstreamConfig)
+	// must not modify uc.  timeout must be the timeout that the upstreams of uc
+	// have been constructed with.
+	WrapUpstreamConfig(
+		uc *proxy.UpstreamConfig,
+		timeout time.Duration,
+	) (wrapped *proxy.UpstreamConfig)
 }
 
 // CommonUpstreamConfig contains common settings for custom client upstream
@@ -246,7 +250,7 @@ func newCustomUpstreamConfig(
 	}
 
 	if w := conf.UpstreamConfigWrapper; w != nil {
-		upsConf = w.WrapUpstreamConfig(upsConf)
+		upsConf = w.WrapUpstreamConfig(upsConf, conf.UpstreamTimeout)
 	}
 
 	return proxy.NewCustomUpstreamConfig(
diff --git a/internal/dnsforward/dnsforward.go b/internal/dnsforward/dnsforward.go
index c2de8ac489d..fec267b24a5 100644
--- a/internal/dnsforward/dnsforward.go
+++ b/internal/dnsforward/dnsforward.go
@@ -121,6 +121,16 @@ type Server struct {
 	// stats is the statistics collector for client's DNS usage data.
 	stats stats.Interface
 
+	// ignoredReqs contains the request messages of the queries whose statistics
+	// must not be counted, keyed by *dns.Msg.  An upstream exchange carries no
+	// client identity, so [statsUpstream] cannot apply the ignore lists itself;
+	// the request handler records the decision here, while the client is still
+	// known, see [Server.markIgnoredReq].
+	//
+	// Only the ignored queries are stored, so the map is empty unless some
+	// client or domain is actually ignored.
+	ignoredReqs sync.Map
+
 	// upstreamStats is the same collector as stats, but it's set once and never
 	// reset, so that it can be used from [statsUpstream] without acquiring
 	// serverLock.  An upstream exchange may happen while serverLock is already
@@ -576,7 +586,7 @@ func (s *Server) prepareUpstreamSettings(ctx context.Context, boot upstream.Reso
 		return fmt.Errorf("preparing upstream config: %w", err)
 	}
 
-	s.conf.UpstreamConfig = s.WrapUpstreamConfig(uc)
+	s.conf.UpstreamConfig = s.WrapUpstreamConfig(uc, s.conf.UpstreamTimeout)
 	s.conf.ClientsContainer.UpdateCommonUpstreamConfig(&client.CommonUpstreamConfig{
 		Bootstrap:               boot,
 		UpstreamConfigWrapper:   s,
@@ -680,7 +690,10 @@ func (s *Server) prepareInternalDNS(ctx context.Context) (err error) {
 		return err
 	}
 
-	s.conf.PrivateRDNSUpstreamConfig = s.WrapUpstreamConfig(privateUC)
+	// NOTE:  The private rDNS upstreams are constructed with defaultLocalTimeout,
+	// see prepareLocalResolvers, so that is the timeout a retried exchange with
+	// them is measured against.
+	s.conf.PrivateRDNSUpstreamConfig = s.WrapUpstreamConfig(privateUC, defaultLocalTimeout)
 
 	err = s.prepareInternalProxy()
 	if err != nil {
@@ -710,7 +723,7 @@ func (s *Server) setupFallbackDNS() (uc *proxy.UpstreamConfig, err error) {
 		return nil, err
 	}
 
-	return s.WrapUpstreamConfig(uc), nil
+	return s.WrapUpstreamConfig(uc, s.conf.UpstreamTimeout), nil
 }
 
 // setupAddrProc initializes the address processor.  It assumes s.serverLock is
diff --git a/internal/dnsforward/process.go b/internal/dnsforward/process.go
index 4969fe032fb..4bcbae41e34 100644
--- a/internal/dnsforward/process.go
+++ b/internal/dnsforward/process.go
@@ -480,6 +480,11 @@ func (s *Server) processUpstream(
 
 	s.setCustomUpstream(ctx, l, pctx, dctx.clientID)
 
+	// Record whether the statistics ignore this query before resolving it,
+	// since the upstream wrappers that collect the response times have no way
+	// of knowing its client, see [Server.markIgnoredReq].
+	defer s.markIgnoredReq(dctx)()
+
 	// Process the request further since it wasn't filtered.
 	prx := s.proxy()
 	if prx == nil {
diff --git a/internal/dnsforward/stats.go b/internal/dnsforward/stats.go
index 434087f983e..761b7eb742e 100644
--- a/internal/dnsforward/stats.go
+++ b/internal/dnsforward/stats.go
@@ -29,19 +29,10 @@ func (s *Server) processQueryLogsAndStats(
 	host := aghnet.NormalizeDomain(q.Name)
 	processingTime := time.Since(dctx.startTime)
 
-	ip := pctx.Addr.Addr().AsSlice()
-	s.anonymizer.Load()(ip)
-	ipStr := net.IP(ip).String()
+	ip, ipStr, ids := s.clientIdentity(dctx)
 
 	l.DebugContext(ctx, "client ip for stats and querylog", "ip", ipStr)
 
-	ids := []string{ipStr}
-	if dctx.clientID != "" {
-		// Use the ClientID first because it has a higher priority.  Filters
-		// have the same priority, see applyAdditionalFiltering.
-		ids = []string{dctx.clientID, ipStr}
-	}
-
 	qt, cl := q.Qtype, q.Qclass
 
 	// Synchronize access to s.queryLog and s.stats so they won't be suddenly
@@ -75,6 +66,25 @@ func (s *Server) processQueryLogsAndStats(
 	return resultCodeSuccess
 }
 
+// clientIdentity returns the anonymized address of the client of dctx, its
+// string form, and the identifiers by which the query log and the statistics
+// know it.  dctx must not be nil.
+func (s *Server) clientIdentity(dctx *dnsContext) (ip net.IP, ipStr string, ids []string) {
+	addr := dctx.proxyCtx.Addr.Addr().AsSlice()
+	s.anonymizer.Load()(addr)
+
+	ip = net.IP(addr)
+	ipStr = ip.String()
+
+	if dctx.clientID != "" {
+		// Use the ClientID first because it has a higher priority.  Filters
+		// have the same priority, see applyAdditionalFiltering.
+		return ip, ipStr, []string{dctx.clientID, ipStr}
+	}
+
+	return ip, ipStr, []string{ipStr}
+}
+
 // shouldLog returns true if the query with the given data should be logged in
 // the query log.  s.serverLock is expected to be locked.
 func (s *Server) shouldLog(host string, qt, cl uint16, ids []string) (ok bool) {
diff --git a/internal/dnsforward/stats_internal_test.go b/internal/dnsforward/stats_internal_test.go
index 8802280d8d9..4277a200f97 100644
--- a/internal/dnsforward/stats_internal_test.go
+++ b/internal/dnsforward/stats_internal_test.go
@@ -52,6 +52,9 @@ type testStats struct {
 	lastEntry *stats.Entry
 
 	upsEntries []*stats.UpstreamEntry
+
+	// onShouldCount, if not nil, decides the verdict of ShouldCount.
+	onShouldCount func(host string, qt, cl uint16, ids []string) (ok bool)
 }
 
 // Update implements the [stats.Interface] interface for *testStats.
@@ -83,7 +86,11 @@ func (l *testStats) upstreamEntries() (entries []*stats.UpstreamEntry) {
 }
 
 // ShouldCount implements the [stats.Interface] interface for *testStats.
-func (l *testStats) ShouldCount(string, uint16, uint16, []string) bool {
+func (l *testStats) ShouldCount(host string, qt, cl uint16, ids []string) bool {
+	if l.onShouldCount != nil {
+		return l.onShouldCount(host, qt, cl, ids)
+	}
+
 	return true
 }
 
diff --git a/internal/dnsforward/upstreamstats.go b/internal/dnsforward/upstreamstats.go
index f24027f73e0..a4bf6fde9d0 100644
--- a/internal/dnsforward/upstreamstats.go
+++ b/internal/dnsforward/upstreamstats.go
@@ -53,6 +53,45 @@ func (u *statsUpstream) Exchange(req *dns.Msg) (resp *dns.Msg, err error) {
 	return resp, nil
 }
 
+// markIgnoredReq records the request of dctx as one whose upstream exchanges
+// must not be counted, when the statistics ignore its client or its domain.  It
+// returns the function that undoes it, which must be called once the request
+// has been resolved.
+//
+// An upstream exchange carries no client identity, so [statsUpstream] cannot
+// consult [stats.Interface.ShouldCount] itself.  The decision is therefore made
+// here, where the client is still known, and left for the wrappers to find.
+// Exchanges that belong to no request at all, such as the background refreshes
+// of the optimistic cache, are never marked and so are always counted.
+//
+// dctx and its proxy context must not be nil.
+func (s *Server) markIgnoredReq(dctx *dnsContext) (unmark func()) {
+	pctx := dctx.proxyCtx
+	q := pctx.Req.Question[0]
+	_, _, ids := s.clientIdentity(dctx)
+
+	s.serverLock.RLock()
+	count := s.shouldCountStat(aghnet.NormalizeDomain(q.Name), q.Qtype, q.Qclass, ids)
+	s.serverLock.RUnlock()
+
+	if count {
+		return func() {}
+	}
+
+	req := pctx.Req
+	s.ignoredReqs.Store(req, struct{}{})
+
+	return func() { s.ignoredReqs.Delete(req) }
+}
+
+// isIgnoredReq returns true if req belongs to a query whose statistics are
+// ignored, see [Server.markIgnoredReq].
+func (s *Server) isIgnoredReq(req *dns.Msg) (ok bool) {
+	_, ok = s.ignoredReqs.Load(req)
+
+	return ok
+}
+
 // Address implements the [upstream.Upstream] interface for *statsUpstream.
 func (u *statsUpstream) Address() (addr string) {
 	return u.upstream.Address()
@@ -71,6 +110,12 @@ func (s *Server) updateUpstreamStats(addr string, req *dns.Msg, dur, timeout tim
 		return
 	}
 
+	if s.isIgnoredReq(req) {
+		// The statistics ignore the client or the domain of the query this
+		// exchange was performed for, see [Server.markIgnoredReq].
+		return
+	}
+
 	if timeout > 0 && dur >= timeout {
 		// A single attempt cannot take longer than the timeout, so this
 		// exchange has retried at least once after an attempt that timed out.
@@ -110,16 +155,27 @@ func (s *Server) updateUpstreamStats(addr string, req *dns.Msg, dur, timeout tim
 // [*statsUpstream], or nil if uc is nil.  uc itself is not modified, but the
 // returned configuration shares the underlying upstreams with it, so only one
 // of the two should ever be closed.
-func (s *Server) WrapUpstreamConfig(uc *proxy.UpstreamConfig) (wrapped *proxy.UpstreamConfig) {
+//
+// timeout must be the timeout that the upstreams of uc have actually been
+// constructed with, since it is what tells a retried exchange from a slow one,
+// see [Server.updateUpstreamStats].  It differs between configurations: the
+// private rDNS upstreams use [defaultLocalTimeout] rather than the configured
+// one.  It is taken as an argument rather than read from [Server.conf], which
+// is mutable and is written under serverLock while this method may be called
+// without it, from the client upstream manager.
+func (s *Server) WrapUpstreamConfig(
+	uc *proxy.UpstreamConfig,
+	timeout time.Duration,
+) (wrapped *proxy.UpstreamConfig) {
 	if uc == nil {
 		return nil
 	}
 
 	return &proxy.UpstreamConfig{
-		DomainReservedUpstreams:  s.wrapUpstreamsMap(uc.DomainReservedUpstreams),
-		SpecifiedDomainUpstreams: s.wrapUpstreamsMap(uc.SpecifiedDomainUpstreams),
+		DomainReservedUpstreams:  s.wrapUpstreamsMap(uc.DomainReservedUpstreams, timeout),
+		SpecifiedDomainUpstreams: s.wrapUpstreamsMap(uc.SpecifiedDomainUpstreams, timeout),
 		SubdomainExclusions:      uc.SubdomainExclusions,
-		Upstreams:                s.wrapUpstreams(uc.Upstreams),
+		Upstreams:                s.wrapUpstreams(uc.Upstreams, timeout),
 	}
 }
 
@@ -127,6 +183,7 @@ func (s *Server) WrapUpstreamConfig(uc *proxy.UpstreamConfig) (wrapped *proxy.Up
 // [*statsUpstream], or nil if ups is nil.
 func (s *Server) wrapUpstreamsMap(
 	ups map[string][]upstream.Upstream,
+	timeout time.Duration,
 ) (wrapped map[string][]upstream.Upstream) {
 	if ups == nil {
 		return nil
@@ -134,7 +191,7 @@ func (s *Server) wrapUpstreamsMap(
 
 	wrapped = make(map[string][]upstream.Upstream, len(ups))
 	for domain, u := range ups {
-		wrapped[domain] = s.wrapUpstreams(u)
+		wrapped[domain] = s.wrapUpstreams(u, timeout)
 	}
 
 	return wrapped
@@ -145,13 +202,14 @@ func (s *Server) wrapUpstreamsMap(
 // by several fields of a [proxy.UpstreamConfig], in which case it gets a
 // wrapper of its own for each reference, just like it gets closed once for each
 // of them, see [proxy.UpstreamConfig.Close].
-func (s *Server) wrapUpstreams(ups []upstream.Upstream) (wrapped []upstream.Upstream) {
+func (s *Server) wrapUpstreams(
+	ups []upstream.Upstream,
+	timeout time.Duration,
+) (wrapped []upstream.Upstream) {
 	if ups == nil {
 		return nil
 	}
 
-	timeout := s.conf.UpstreamTimeout
-
 	wrapped = make([]upstream.Upstream, 0, len(ups))
 	for _, u := range ups {
 		wrapped = append(wrapped, &statsUpstream{
diff --git a/internal/dnsforward/upstreamstats_internal_test.go b/internal/dnsforward/upstreamstats_internal_test.go
index 9f886cf50c8..4a488ef9cdd 100644
--- a/internal/dnsforward/upstreamstats_internal_test.go
+++ b/internal/dnsforward/upstreamstats_internal_test.go
@@ -2,6 +2,7 @@ package dnsforward
 
 import (
 	"net"
+	"sync"
 	"sync/atomic"
 	"testing"
 	"time"
@@ -159,11 +160,14 @@ func TestStatsUpstream_Exchange_timeoutRetry(t *testing.T) {
 	}
 }
 
+// testUpsTimeout is the upstream timeout used by the wrapper tests.
+const testUpsTimeout = 10 * time.Second
+
 func TestServer_WrapUpstreamConfig(t *testing.T) {
 	s := &Server{}
 
 	t.Run("nil", func(t *testing.T) {
-		assert.Nil(t, s.WrapUpstreamConfig(nil))
+		assert.Nil(t, s.WrapUpstreamConfig(nil, testUpsTimeout))
 	})
 
 	t.Run("all_fields", func(t *testing.T) {
@@ -183,7 +187,7 @@ func TestServer_WrapUpstreamConfig(t *testing.T) {
 			Upstreams:           []upstream.Upstream{ups},
 		}
 
-		wrapped := s.WrapUpstreamConfig(uc)
+		wrapped := s.WrapUpstreamConfig(uc, testUpsTimeout)
 		require.NotNil(t, wrapped)
 
 		assert.Same(t, exclusions, wrapped.SubdomainExclusions)
@@ -207,7 +211,7 @@ func TestServer_WrapUpstreamConfig(t *testing.T) {
 	})
 
 	t.Run("nil_fields", func(t *testing.T) {
-		wrapped := s.WrapUpstreamConfig(&proxy.UpstreamConfig{})
+		wrapped := s.WrapUpstreamConfig(&proxy.UpstreamConfig{}, testUpsTimeout)
 		require.NotNil(t, wrapped)
 
 		assert.Nil(t, wrapped.Upstreams)
@@ -313,3 +317,181 @@ func TestServer_updateStats_optimisticCache(t *testing.T) {
 
 // type check
 var _ stats.Interface = (*testStats)(nil)
+
+// TestServer_updateStats_ignoredClient is a regression test for the statistics
+// ignore lists being bypassed by the upstream wrappers.
+//
+// An upstream exchange carries no client identity, so a wrapper that recorded
+// every exchange would count the queries of a client whose statistics are
+// ignored, which both contradicts the documented behaviour and biases the very
+// averages this collection exists to report.
+func TestServer_updateStats_ignoredClient(t *testing.T) {
+	const domain = "example.com."
+
+	upsAddr := aghtest.StartLocalhostUpstream(t, dns.HandlerFunc(func(
+		w dns.ResponseWriter,
+		r *dns.Msg,
+	) {
+		resp := (&dns.Msg{}).SetReply(r)
+		resp.Answer = []dns.RR{&dns.A{
+			Hdr: dns.RR_Header{Name: domain, Rrtype: dns.TypeA, Class: dns.ClassINET, Ttl: 60},
+			A:   net.IP{1, 2, 3, 4},
+		}}
+
+		require.NoError(testutil.PanicT{}, w.WriteMsg(resp))
+	})).String()
+
+	var countClient atomic.Bool
+	st := &testStats{
+		onShouldCount: func(_ string, _, _ uint16, _ []string) (ok bool) {
+			return countClient.Load()
+		},
+	}
+
+	forwardConf := ServerConfig{
+		UDPListenAddrs: []*net.UDPAddr{{}},
+		TCPListenAddrs: []*net.TCPAddr{{}},
+		TLSConf:        &TLSConfig{},
+		Config: Config{
+			UpstreamDNS:      []string{upsAddr},
+			UpstreamMode:     UpstreamModeLoadBalance,
+			EDNSClientSubnet: &EDNSClientSubnet{Enabled: false},
+			ClientsContainer: EmptyClientsContainer{},
+		},
+		ServePlainDNS: true,
+	}
+
+	s := createTestServer(t, &filtering.Config{
+		Logger:            testLogger,
+		ProtectionEnabled: true,
+		BlockingMode:      filtering.BlockingModeDefault,
+	}, forwardConf, testTLSConfigProvider)
+	s.stats, s.upstreamStats = st, st
+
+	startDeferStop(t, s)
+	addr := s.dnsProxy.Addr(proxy.ProtoUDP).String()
+
+	t.Run("ignored", func(t *testing.T) {
+		countClient.Store(false)
+
+		resp, err := dns.Exchange((&dns.Msg{}).SetQuestion(domain, dns.TypeA), addr)
+		require.NoError(t, err)
+		require.NotEmpty(t, resp.Answer)
+
+		assert.Empty(t, st.upstreamEntries())
+	})
+
+	t.Run("counted", func(t *testing.T) {
+		countClient.Store(true)
+
+		// Use a different name, so that the answer isn't served from the cache.
+		resp, err := dns.Exchange((&dns.Msg{}).SetQuestion("other."+domain, dns.TypeA), addr)
+		require.NoError(t, err)
+		require.NotNil(t, resp)
+
+		assert.Len(t, st.upstreamEntries(), 1)
+	})
+}
+
+// TestServer_WrapUpstreamConfig_race makes sure that wrapping does not read the
+// mutable [Server.conf], which is written under serverLock while the client
+// upstream manager may wrap a configuration without holding it.
+//
+// Run with -race.
+func TestServer_WrapUpstreamConfig_race(t *testing.T) {
+	t.Parallel()
+
+	s := &Server{}
+	uc := &proxy.UpstreamConfig{
+		Upstreams: []upstream.Upstream{
+			aghtest.NewUpstreamMock(func(req *dns.Msg) (resp *dns.Msg, err error) {
+				panic(testutil.UnexpectedCall(req))
+			}),
+		},
+	}
+
+	const iterations = 200
+
+	var wg sync.WaitGroup
+	wg.Add(2)
+
+	// A /control/dns_config update writing the timeout under the lock.
+	go func() {
+		defer wg.Done()
+
+		for i := range iterations {
+			s.serverLock.Lock()
+			s.conf.UpstreamTimeout = time.Duration(i+1) * time.Second
+			s.serverLock.Unlock()
+		}
+	}()
+
+	// The client upstream manager wrapping a configuration without the lock.
+	go func() {
+		defer wg.Done()
+
+		for range iterations {
+			assert.NotNil(t, s.WrapUpstreamConfig(uc, testUpsTimeout))
+		}
+	}()
+
+	wg.Wait()
+}
+
+// TestServer_prepareInternalDNS_privateTimeout is a regression test for the
+// private rDNS wrappers carrying the wrong retry threshold.
+//
+// Those upstreams are constructed with [defaultLocalTimeout], one second, while
+// the configured upstream timeout is normally ten.  A wrapper holding the
+// configured timeout would compare a one-second retried exchange against ten
+// seconds and record it as an ordinary response, reintroducing exactly the
+// inflated sample this collection is meant to exclude.
+func TestServer_prepareInternalDNS_privateTimeout(t *testing.T) {
+	const upsTimeout = 10 * time.Second
+
+	require.NotEqual(t, upsTimeout, defaultLocalTimeout)
+
+	upsAddr := aghtest.StartLocalhostUpstream(t, dns.HandlerFunc(func(
+		w dns.ResponseWriter,
+		r *dns.Msg,
+	) {
+		require.NoError(testutil.PanicT{}, w.WriteMsg((&dns.Msg{}).SetReply(r)))
+	})).String()
+
+	forwardConf := ServerConfig{
+		UDPListenAddrs: []*net.UDPAddr{{}},
+		TCPListenAddrs: []*net.TCPAddr{{}},
+		TLSConf:        &TLSConfig{},
+		Config: Config{
+			UpstreamDNS:      []string{upsAddr},
+			UpstreamMode:     UpstreamModeLoadBalance,
+			EDNSClientSubnet: &EDNSClientSubnet{Enabled: false},
+			ClientsContainer: EmptyClientsContainer{},
+		},
+		LocalPTRResolvers: []string{upsAddr},
+		UsePrivateRDNS:    true,
+		UpstreamTimeout:   upsTimeout,
+		ServePlainDNS:     true,
+	}
+
+	s := createTestServer(t, &filtering.Config{
+		Logger:            testLogger,
+		ProtectionEnabled: true,
+		BlockingMode:      filtering.BlockingModeDefault,
+	}, forwardConf, testTLSConfigProvider)
+
+	// wrapperTimeout returns the retry threshold stored in the first wrapper of
+	// uc.
+	wrapperTimeout := func(uc *proxy.UpstreamConfig) (d time.Duration) {
+		require.NotNil(t, uc)
+		require.NotEmpty(t, uc.Upstreams)
+
+		su, ok := uc.Upstreams[0].(*statsUpstream)
+		require.True(t, ok)
+
+		return su.timeout
+	}
+
+	assert.Equal(t, upsTimeout, wrapperTimeout(s.conf.UpstreamConfig))
+	assert.Equal(t, defaultLocalTimeout, wrapperTimeout(s.conf.PrivateRDNSUpstreamConfig))
+}

From 8ca9112f044e0549c4b6ed77b11e9a9375db0f87 Mon Sep 17 00:00:00 2001
From: Aditya Nugraha <vortexilation@gmail.com>
Date: Mon, 3 Aug 2026 22:12:27 +0700
Subject: [PATCH 4/6] dnsforward: split the upstream statistics test case

gocognit reports TestStatsUpstream_Exchange at 12, over the limit of 10
that go-lint.sh applies to this package.  Extract the per-case body into a
helper; coverage is unchanged.
---
 .../dnsforward/upstreamstats_internal_test.go | 60 +++++++++++--------
 1 file changed, 35 insertions(+), 25 deletions(-)

diff --git a/internal/dnsforward/upstreamstats_internal_test.go b/internal/dnsforward/upstreamstats_internal_test.go
index 4a488ef9cdd..9acbc0125b2 100644
--- a/internal/dnsforward/upstreamstats_internal_test.go
+++ b/internal/dnsforward/upstreamstats_internal_test.go
@@ -50,38 +50,48 @@ func TestStatsUpstream_Exchange(t *testing.T) {
 
 	for _, tc := range testCases {
 		t.Run(tc.name, func(t *testing.T) {
-			st := &testStats{}
-			ups := &statsUpstream{
-				upstream: aghtest.NewUpstreamMock(func(req *dns.Msg) (resp *dns.Msg, err error) {
-					if tc.upsErr != nil {
-						return nil, tc.upsErr
-					}
-
-					return (&dns.Msg{}).SetReply(req), nil
-				}),
-				srv: &Server{upstreamStats: st},
-			}
+			assertExchangeSample(t, tc.req, tc.upsErr, tc.wantDomain)
+		})
+	}
+}
+
+// assertExchangeSample performs a single exchange through a [statsUpstream]
+// whose wrapped upstream fails with upsErr, if it is not nil, and asserts that
+// the statistics received a sample for wantDomain, or none at all if it is
+// empty.
+func assertExchangeSample(t *testing.T, req *dns.Msg, upsErr error, wantDomain string) {
+	t.Helper()
 
-			_, err := ups.Exchange(tc.req)
-			if tc.upsErr != nil {
-				assert.ErrorIs(t, err, tc.upsErr)
-			} else {
-				assert.NoError(t, err)
+	st := &testStats{}
+	ups := &statsUpstream{
+		upstream: aghtest.NewUpstreamMock(func(req *dns.Msg) (resp *dns.Msg, err error) {
+			if upsErr != nil {
+				return nil, upsErr
 			}
 
-			entries := st.upstreamEntries()
-			if tc.wantDomain == "" {
-				assert.Empty(t, entries)
+			return (&dns.Msg{}).SetReply(req), nil
+		}),
+		srv: &Server{upstreamStats: st},
+	}
 
-				return
-			}
+	_, err := ups.Exchange(req)
+	if upsErr != nil {
+		assert.ErrorIs(t, err, upsErr)
+	} else {
+		assert.NoError(t, err)
+	}
 
-			require.Len(t, entries, 1)
+	entries := st.upstreamEntries()
+	if wantDomain == "" {
+		assert.Empty(t, entries)
 
-			assert.Equal(t, tc.wantDomain, entries[0].Domain)
-			assert.Equal(t, ups.Address(), entries[0].Address)
-		})
+		return
 	}
+
+	require.Len(t, entries, 1)
+
+	assert.Equal(t, wantDomain, entries[0].Domain)
+	assert.Equal(t, ups.Address(), entries[0].Address)
 }
 
 // TestStatsUpstream_Exchange_timeoutRetry is a regression test for the upstream

From 227775bf913a077856600d6b9756133a847aebb1 Mon Sep 17 00:00:00 2001
From: Aditya Nugraha <vortexilation@gmail.com>
Date: Wed, 5 Aug 2026 02:54:56 +0700
Subject: [PATCH 5/6] dnsforward: collect optimistic refreshes through the
 proxy

Replace the upstream wrapper with the callback added in
AdguardTeam/dnsproxy#520.

The wrapper could not work.  An exchange has to be attributed to the
request it belongs to, both so that the statistics ignore lists apply and
so that a background refresh can be told from a foreground query, and an
upstream.Upstream is given no way to do it: Exchange takes only a *dns.Msg
and no context, and ExchangeParallel and ExchangeAll copy the request once
per upstream before calling it, so no identity of the original survives.
The request-pointer key therefore missed in parallel and fastest-address
mode with more than one upstream, and queries from clients with ignored
statistics were counted after all.  Only the single-upstream path skips
the copy, which is why the first regression passed.

Foreground exchanges go back to being collected from
proxy.DNSContext.QueryStatistics, which is client-attributed and already
gated by ShouldCount, so the ignore lists behave exactly as they did
before this branch.  Background refreshes arrive through
proxy.Config.OnOptimisticRefresh, which fires once the optimistic cache
has refreshed an expired entry; they belong to no client by construction,
so there is nothing to attribute and nothing to double count.

A retried exchange is still left out, but the check moved to where the
statistics entry is built, and compares against the timeout the upstreams
of that request were constructed with: defaultLocalTimeout for private
rDNS, the configured one otherwise.

Both are covered end to end, and both regressions fail against the
unfixed implementation: the retry filter in load-balance, parallel, and
fastest-address mode, and the refresh collection against an entry that
expires while the test runs.
---
 CHANGELOG.md                                  |   4 +-
 internal/client/upstreammanager.go            |  23 +-
 internal/dnsforward/config.go                 |   1 +
 internal/dnsforward/dnsforward.go             |  45 +-
 internal/dnsforward/process.go                |   5 -
 internal/dnsforward/stats.go                  | 127 ++++-
 internal/dnsforward/stats_internal_test.go    | 185 ++++++-
 internal/dnsforward/upstreamstats.go          | 223 --------
 .../dnsforward/upstreamstats_internal_test.go | 507 ------------------
 internal/stats/unit.go                        |  15 +
 10 files changed, 302 insertions(+), 833 deletions(-)
 delete mode 100644 internal/dnsforward/upstreamstats.go
 delete mode 100644 internal/dnsforward/upstreamstats_internal_test.go

diff --git a/CHANGELOG.md b/CHANGELOG.md
index ecd63b66f13..6f016b5c1f1 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -50,8 +50,8 @@ NOTE: Add new changes BELOW THIS COMMENT.
   ([#8435]).  An optimistic cache hit is answered from the cache right away and the expired entry
   is refreshed by a background query, and those background queries used to be left out of the
   statistics.  The average was therefore based on cache misses alone, which are skewed towards
-  rare domain names that the upstream itself resolves slower.  Every exchange with an upstream
-  server is now counted, including the background ones.
+  rare domain names that the upstream itself resolves slower.  Those refreshes are now counted
+  as well, through the new `OnOptimisticRefresh` callback of the DNS proxy.
 
 - Upstream response times on the dashboard being far higher than the actual network latency to
   the upstream servers ([#8457]).  A plain DNS upstream retries once when an attempt times out,
diff --git a/internal/client/upstreammanager.go b/internal/client/upstreammanager.go
index 0255f1078b1..3c57174169b 100644
--- a/internal/client/upstreammanager.go
+++ b/internal/client/upstreammanager.go
@@ -16,27 +16,10 @@ import (
 	"github.com/AdguardTeam/golibs/timeutil"
 )
 
-// UpstreamConfigWrapper wraps parsed upstream configurations, e.g. to collect
-// statistics about the exchanges with them.
-type UpstreamConfigWrapper interface {
-	// WrapUpstreamConfig returns a wrapped copy of uc, or nil if uc is nil.  It
-	// must not modify uc.  timeout must be the timeout that the upstreams of uc
-	// have been constructed with.
-	WrapUpstreamConfig(
-		uc *proxy.UpstreamConfig,
-		timeout time.Duration,
-	) (wrapped *proxy.UpstreamConfig)
-}
-
 // CommonUpstreamConfig contains common settings for custom client upstream
 // configurations.
 type CommonUpstreamConfig struct {
-	Bootstrap upstream.Resolver
-
-	// UpstreamConfigWrapper wraps the parsed custom client upstream
-	// configurations.  If it's nil, they are used as is.
-	UpstreamConfigWrapper UpstreamConfigWrapper
-
+	Bootstrap               upstream.Resolver
 	UpstreamTimeout         time.Duration
 	BootstrapPreferIPv6     bool
 	EDNSClientSubnetEnabled bool
@@ -249,10 +232,6 @@ func newCustomUpstreamConfig(
 		panic(fmt.Errorf("creating custom upstream config: %w", err))
 	}
 
-	if w := conf.UpstreamConfigWrapper; w != nil {
-		upsConf = w.WrapUpstreamConfig(upsConf, conf.UpstreamTimeout)
-	}
-
 	return proxy.NewCustomUpstreamConfig(
 		upsConf,
 		cliConf.upstreamsCacheEnabled,
diff --git a/internal/dnsforward/config.go b/internal/dnsforward/config.go
index 5be0793be6e..462f8c72f1b 100644
--- a/internal/dnsforward/config.go
+++ b/internal/dnsforward/config.go
@@ -354,6 +354,7 @@ func (s *Server) newProxyConfig(ctx context.Context) (conf *proxy.Config, err er
 		UpstreamConfig:            srvConf.UpstreamConfig,
 		PrivateRDNSUpstreamConfig: srvConf.PrivateRDNSUpstreamConfig,
 		RequestHandler:            ratelimitMw.Wrap(logMw.Wrap(s.Wrap(s))),
+		OnOptimisticRefresh:       s.handleOptimisticRefresh,
 		EnableEDNSClientSubnet:    srvConf.EDNSClientSubnet.Enabled,
 		MaxGoroutines:             srvConf.MaxGoroutines,
 		UseDNS64:                  srvConf.UseDNS64,
diff --git a/internal/dnsforward/dnsforward.go b/internal/dnsforward/dnsforward.go
index fec267b24a5..e396e0c5051 100644
--- a/internal/dnsforward/dnsforward.go
+++ b/internal/dnsforward/dnsforward.go
@@ -121,24 +121,6 @@ type Server struct {
 	// stats is the statistics collector for client's DNS usage data.
 	stats stats.Interface
 
-	// ignoredReqs contains the request messages of the queries whose statistics
-	// must not be counted, keyed by *dns.Msg.  An upstream exchange carries no
-	// client identity, so [statsUpstream] cannot apply the ignore lists itself;
-	// the request handler records the decision here, while the client is still
-	// known, see [Server.markIgnoredReq].
-	//
-	// Only the ignored queries are stored, so the map is empty unless some
-	// client or domain is actually ignored.
-	ignoredReqs sync.Map
-
-	// upstreamStats is the same collector as stats, but it's set once and never
-	// reset, so that it can be used from [statsUpstream] without acquiring
-	// serverLock.  An upstream exchange may happen while serverLock is already
-	// held for reading, see [Server.Resolve], so acquiring it again there could
-	// deadlock with a concurrent writer.  Updating an already closed collector
-	// only loses the data, which is acceptable during the shutdown.
-	upstreamStats stats.Interface
-
 	// sysResolvers used to fetch system resolvers to use by default for private
 	// PTR resolving.
 	sysResolvers SystemResolvers
@@ -260,14 +242,13 @@ func NewServer(p DNSCreateParams) (s *Server, err error) {
 	}
 
 	s = &Server{
-		dnsFilter:     p.DNSFilter,
-		dhcpServer:    p.DHCPServer,
-		stats:         p.Stats,
-		upstreamStats: p.Stats,
-		queryLog:      p.QueryLog,
-		privateNets:   p.PrivateNets,
-		baseLogger:    p.Logger,
-		logger:        p.Logger.With(slogutil.KeyPrefix, "dnsforward"),
+		dnsFilter:   p.DNSFilter,
+		dhcpServer:  p.DHCPServer,
+		stats:       p.Stats,
+		queryLog:    p.QueryLog,
+		privateNets: p.PrivateNets,
+		baseLogger:  p.Logger,
+		logger:      p.Logger.With(slogutil.KeyPrefix, "dnsforward"),
 		// TODO(e.burkov):  Use some case-insensitive string comparison.
 		localDomainSuffix: strings.ToLower(localDomainSuffix),
 		etcHosts:          etcHosts,
@@ -586,10 +567,9 @@ func (s *Server) prepareUpstreamSettings(ctx context.Context, boot upstream.Reso
 		return fmt.Errorf("preparing upstream config: %w", err)
 	}
 
-	s.conf.UpstreamConfig = s.WrapUpstreamConfig(uc, s.conf.UpstreamTimeout)
+	s.conf.UpstreamConfig = uc
 	s.conf.ClientsContainer.UpdateCommonUpstreamConfig(&client.CommonUpstreamConfig{
 		Bootstrap:               boot,
-		UpstreamConfigWrapper:   s,
 		UpstreamTimeout:         s.conf.UpstreamTimeout,
 		BootstrapPreferIPv6:     s.conf.BootstrapPreferIPv6,
 		EDNSClientSubnetEnabled: s.conf.EDNSClientSubnet.Enabled,
@@ -685,16 +665,11 @@ func (s *Server) prepareInternalDNS(ctx context.Context) (err error) {
 		return err
 	}
 
-	privateUC, err := s.prepareLocalResolvers(ctx)
+	s.conf.PrivateRDNSUpstreamConfig, err = s.prepareLocalResolvers(ctx)
 	if err != nil {
 		return err
 	}
 
-	// NOTE:  The private rDNS upstreams are constructed with defaultLocalTimeout,
-	// see prepareLocalResolvers, so that is the timeout a retried exchange with
-	// them is measured against.
-	s.conf.PrivateRDNSUpstreamConfig = s.WrapUpstreamConfig(privateUC, defaultLocalTimeout)
-
 	err = s.prepareInternalProxy()
 	if err != nil {
 		return fmt.Errorf("preparing internal proxy: %w", err)
@@ -723,7 +698,7 @@ func (s *Server) setupFallbackDNS() (uc *proxy.UpstreamConfig, err error) {
 		return nil, err
 	}
 
-	return s.WrapUpstreamConfig(uc, s.conf.UpstreamTimeout), nil
+	return uc, nil
 }
 
 // setupAddrProc initializes the address processor.  It assumes s.serverLock is
diff --git a/internal/dnsforward/process.go b/internal/dnsforward/process.go
index 4bcbae41e34..4969fe032fb 100644
--- a/internal/dnsforward/process.go
+++ b/internal/dnsforward/process.go
@@ -480,11 +480,6 @@ func (s *Server) processUpstream(
 
 	s.setCustomUpstream(ctx, l, pctx, dctx.clientID)
 
-	// Record whether the statistics ignore this query before resolving it,
-	// since the upstream wrappers that collect the response times have no way
-	// of knowing its client, see [Server.markIgnoredReq].
-	defer s.markIgnoredReq(dctx)()
-
 	// Process the request further since it wasn't filtered.
 	prx := s.proxy()
 	if prx == nil {
diff --git a/internal/dnsforward/stats.go b/internal/dnsforward/stats.go
index 761b7eb742e..2cb0fae5094 100644
--- a/internal/dnsforward/stats.go
+++ b/internal/dnsforward/stats.go
@@ -4,6 +4,7 @@ import (
 	"context"
 	"log/slog"
 	"net"
+	"net/netip"
 	"time"
 
 	"github.com/AdguardTeam/AdGuardHome/internal/aghnet"
@@ -29,10 +30,19 @@ func (s *Server) processQueryLogsAndStats(
 	host := aghnet.NormalizeDomain(q.Name)
 	processingTime := time.Since(dctx.startTime)
 
-	ip, ipStr, ids := s.clientIdentity(dctx)
+	ip := pctx.Addr.Addr().AsSlice()
+	s.anonymizer.Load()(ip)
+	ipStr := net.IP(ip).String()
 
 	l.DebugContext(ctx, "client ip for stats and querylog", "ip", ipStr)
 
+	ids := []string{ipStr}
+	if dctx.clientID != "" {
+		// Use the ClientID first because it has a higher priority.  Filters
+		// have the same priority, see applyAdditionalFiltering.
+		ids = []string{dctx.clientID, ipStr}
+	}
+
 	qt, cl := q.Qtype, q.Qclass
 
 	// Synchronize access to s.queryLog and s.stats so they won't be suddenly
@@ -66,25 +76,6 @@ func (s *Server) processQueryLogsAndStats(
 	return resultCodeSuccess
 }
 
-// clientIdentity returns the anonymized address of the client of dctx, its
-// string form, and the identifiers by which the query log and the statistics
-// know it.  dctx must not be nil.
-func (s *Server) clientIdentity(dctx *dnsContext) (ip net.IP, ipStr string, ids []string) {
-	addr := dctx.proxyCtx.Addr.Addr().AsSlice()
-	s.anonymizer.Load()(addr)
-
-	ip = net.IP(addr)
-	ipStr = ip.String()
-
-	if dctx.clientID != "" {
-		// Use the ClientID first because it has a higher priority.  Filters
-		// have the same priority, see applyAdditionalFiltering.
-		return ip, ipStr, []string{dctx.clientID, ipStr}
-	}
-
-	return ip, ipStr, []string{ipStr}
-}
-
 // shouldLog returns true if the query with the given data should be logged in
 // the query log.  s.serverLock is expected to be locked.
 func (s *Server) shouldLog(host string, qt, cl uint16, ids []string) (ok bool) {
@@ -149,14 +140,104 @@ func (s *Server) logQuery(dctx *dnsContext, ip net.IP, processingTime time.Durat
 	s.queryLog.Add(p)
 }
 
+// retryThreshold returns the duration at or above which a successful exchange
+// must have retried after an attempt that timed out, since a single attempt
+// cannot outlast the timeout it was made with.  pctx must not be nil.
+//
+// s.serverLock is expected to be locked.
+func (s *Server) retryThreshold(pctx *proxy.DNSContext) (d time.Duration) {
+	if pctx.RequestedPrivateRDNS != (netip.Prefix{}) {
+		// The private rDNS upstreams are constructed with a timeout of their
+		// own, see prepareLocalResolvers.
+		return defaultLocalTimeout
+	}
+
+	return s.conf.UpstreamTimeout
+}
+
+// appendCountedUpstreams appends those of us that should be counted in the
+// statistics to stats.
+//
+// A plain DNS upstream retries once when an attempt times out, for example
+// when a UDP datagram is lost, and reports the retried exchange as an ordinary
+// success.  Its duration is then at least the whole timeout, ten seconds by
+// default, even though the successful attempt itself took a millisecond.
+// Averaging such a sample in makes the reported response time an order of
+// magnitude higher than the actual one, so leave it out: it describes the retry
+// policy and the configured timeout rather than the speed of the upstream.
+//
+// See https://github.com/AdguardTeam/AdGuardHome/issues/8457.
+func appendCountedUpstreams(
+	stats []*proxy.UpstreamStatistics,
+	us []*proxy.UpstreamStatistics,
+	threshold time.Duration,
+) (appended []*proxy.UpstreamStatistics) {
+	for _, u := range us {
+		if threshold > 0 && u.Error == nil && u.QueryDuration >= threshold {
+			continue
+		}
+
+		stats = append(stats, u)
+	}
+
+	return stats
+}
+
+// handleOptimisticRefresh records the response times of an optimistic cache
+// refresh.  It implements [proxy.Config.OnOptimisticRefresh].  dctx must not be
+// nil.
+//
+// Such a refresh is performed in the background once an expired entry has
+// already been answered from the cache, so it reaches no request handler and
+// belongs to no client.  Without it the response times would only ever be
+// sampled from cache misses, and with the optimistic cache enabled the popular
+// names, which are exactly the ones kept warm, would never be sampled at all.
+//
+// See https://github.com/AdguardTeam/AdGuardHome/issues/8435.
+func (s *Server) handleOptimisticRefresh(dctx *proxy.DNSContext) {
+	qs := dctx.QueryStatistics()
+	if qs == nil || dctx.Req == nil || len(dctx.Req.Question) == 0 {
+		return
+	}
+
+	domain := aghnet.NormalizeDomain(dctx.Req.Question[0].Name)
+
+	// Synchronize access to s.stats so it won't be suddenly uninitialized while
+	// in use, the same way processQueryLogsAndStats does.
+	s.serverLock.RLock()
+	defer s.serverLock.RUnlock()
+
+	if s.stats == nil {
+		return
+	}
+
+	threshold := s.retryThreshold(dctx)
+	for _, u := range appendCountedUpstreams(nil, qs.Main(), threshold) {
+		if u.IsCached || u.Error != nil {
+			continue
+		}
+
+		s.stats.UpdateUpstream(&stats.UpstreamEntry{
+			Address:       u.Address,
+			Domain:        domain,
+			QueryDuration: u.QueryDuration,
+		})
+	}
+}
+
 // updateStats writes the request data into statistics.
 func (s *Server) updateStats(dctx *dnsContext, clientIP string, processingTime time.Duration) {
 	pctx := dctx.proxyCtx
 
-	// NOTE:  The upstream response times are not taken from
-	// [proxy.DNSContext.QueryStatistics] here, since they are collected for
-	// every exchange, including the background ones, see [statsUpstream].
+	var upstreamStats []*proxy.UpstreamStatistics
+	if qs := pctx.QueryStatistics(); qs != nil {
+		threshold := s.retryThreshold(pctx)
+		upstreamStats = appendCountedUpstreams(upstreamStats, qs.Main(), threshold)
+		upstreamStats = appendCountedUpstreams(upstreamStats, qs.Fallback(), threshold)
+	}
+
 	e := &stats.Entry{
+		UpstreamStats:  upstreamStats,
 		Domain:         aghnet.NormalizeDomain(pctx.Req.Question[0].Name),
 		Result:         stats.RNotFiltered,
 		ProcessingTime: processingTime,
diff --git a/internal/dnsforward/stats_internal_test.go b/internal/dnsforward/stats_internal_test.go
index 4277a200f97..e2e3c4ede49 100644
--- a/internal/dnsforward/stats_internal_test.go
+++ b/internal/dnsforward/stats_internal_test.go
@@ -1,19 +1,23 @@
 package dnsforward
 
 import (
+	"net"
 	"net/netip"
 	"slices"
 	"sync"
+	"sync/atomic"
 	"testing"
 	"time"
 
 	"github.com/AdguardTeam/AdGuardHome/internal/aghnet"
+	"github.com/AdguardTeam/AdGuardHome/internal/aghtest"
 	"github.com/AdguardTeam/AdGuardHome/internal/filtering"
 	"github.com/AdguardTeam/AdGuardHome/internal/querylog"
 	"github.com/AdguardTeam/AdGuardHome/internal/stats"
 	"github.com/AdguardTeam/dnsproxy/proxy"
 	"github.com/AdguardTeam/dnsproxy/upstream"
 	"github.com/AdguardTeam/golibs/testutil"
+	"github.com/AdguardTeam/golibs/timeutil"
 	"github.com/miekg/dns"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
@@ -38,15 +42,14 @@ func (l *testQueryLog) ShouldLog(string, uint16, uint16, []string) bool {
 	return true
 }
 
-// testStats is a simple [stats.Interface] implementation for tests.  It's safe
-// for concurrent use, since the upstream entries may be collected from the
-// background goroutines, e.g. the optimistic cache resolver's ones.
+// testStats is a simple [stats.Interface] implementation for tests.
 type testStats struct {
 	// Stats is embedded here simply to make testStats a [stats.Interface]
 	// without actually implementing all methods.
 	stats.Interface
 
-	// mu protects lastEntry and upsEntries.
+	// mu protects lastEntry and upsEntries, since an optimistic refresh reports
+	// from a background goroutine.
 	mu sync.Mutex
 
 	lastEntry *stats.Entry
@@ -57,18 +60,6 @@ type testStats struct {
 	onShouldCount func(host string, qt, cl uint16, ids []string) (ok bool)
 }
 
-// Update implements the [stats.Interface] interface for *testStats.
-func (l *testStats) Update(e *stats.Entry) {
-	if e.Domain == "" {
-		return
-	}
-
-	l.mu.Lock()
-	defer l.mu.Unlock()
-
-	l.lastEntry = e
-}
-
 // UpdateUpstream implements the [stats.Interface] interface for *testStats.
 func (l *testStats) UpdateUpstream(e *stats.UpstreamEntry) {
 	l.mu.Lock()
@@ -85,6 +76,18 @@ func (l *testStats) upstreamEntries() (entries []*stats.UpstreamEntry) {
 	return slices.Clone(l.upsEntries)
 }
 
+// Update implements the [stats.Interface] interface for *testStats.
+func (l *testStats) Update(e *stats.Entry) {
+	if e.Domain == "" {
+		return
+	}
+
+	l.mu.Lock()
+	defer l.mu.Unlock()
+
+	l.lastEntry = e
+}
+
 // ShouldCount implements the [stats.Interface] interface for *testStats.
 func (l *testStats) ShouldCount(host string, qt, cl uint16, ids []string) bool {
 	if l.onShouldCount != nil {
@@ -275,3 +278,153 @@ func TestServer_ProcessQueryLogsAndStats(t *testing.T) {
 		})
 	}
 }
+
+// TestServer_stats_upstreamTimes covers the collection of upstream response
+// times end to end, for the two ways it used to be wrong.
+func TestServer_stats_upstreamTimes(t *testing.T) {
+	const domain = "example.com."
+
+	t.Run("retried_not_counted", func(t *testing.T) {
+		// A retried exchange takes at least the whole upstream timeout even
+		// though its successful attempt took a millisecond, so counting it as an
+		// ordinary response makes the reported time bear no relation to the
+		// round-trip time, see
+		// https://github.com/AdguardTeam/AdGuardHome/issues/8457.
+		const upsTimeout = 1 * time.Second
+
+		for _, mode := range []UpstreamMode{
+			UpstreamModeLoadBalance,
+			UpstreamModeParallel,
+			UpstreamModeFastestAddr,
+		} {
+			t.Run(string(mode), func(t *testing.T) {
+				var dropFirst atomic.Bool
+				dropFirst.Store(true)
+
+				st := &testStats{}
+				addr := newStatsTestServer(t, st, mode, domain, upsTimeout, &dropFirst, false)
+
+				resp, err := dns.Exchange((&dns.Msg{}).SetQuestion(domain, dns.TypeA), addr)
+				require.NoError(t, err)
+				require.NotEmpty(t, resp.Answer)
+
+				require.NotNil(t, st.lastEntry)
+				assert.Empty(t, st.lastEntry.UpstreamStats)
+			})
+		}
+	})
+
+	t.Run("optimistic_refresh_counted", func(t *testing.T) {
+		// The refresh of an expired entry happens in the background, after the
+		// client has already been answered from the cache, so it reaches no
+		// request handler.  Leaving it out biases the average towards cache
+		// misses, see https://github.com/AdguardTeam/AdGuardHome/issues/8435.
+		var dropFirst atomic.Bool
+
+		st := &testStats{}
+		addr := newStatsTestServer(
+			t, st, UpstreamModeLoadBalance, domain, 10*time.Second, &dropFirst, true,
+		)
+
+		req := (&dns.Msg{}).SetQuestion(domain, dns.TypeA)
+
+		resp, err := dns.Exchange(req, addr)
+		require.NoError(t, err)
+		require.NotEmpty(t, resp.Answer)
+
+		// Nothing has been refreshed in the background yet.
+		require.Empty(t, st.upstreamEntries())
+
+		// Let the cached entry expire, then hit it again: the answer comes from
+		// the cache and the entry is refreshed behind it.
+		time.Sleep(testCacheTTL + 100*time.Millisecond)
+
+		resp, err = dns.Exchange(req, addr)
+		require.NoError(t, err)
+		require.NotEmpty(t, resp.Answer)
+
+		assert.Eventually(t, func() (ok bool) {
+			return len(st.upstreamEntries()) == 1
+		}, 10*time.Second, 100*time.Millisecond)
+
+		for _, e := range st.upstreamEntries() {
+			assert.Equal(t, "example.com", e.Domain)
+		}
+	})
+}
+
+// testCacheTTL is the TTL of the answers of the upstream started by
+// [newStatsTestServer], and the maximum TTL of its cache.
+const testCacheTTL = 1 * time.Second
+
+// newStatsTestServer starts a server whose only upstream answers domain, and
+// drops the very first query while dropFirst is set.  If optimistic is true,
+// the cache is enabled and refreshes expired entries in the background.
+func newStatsTestServer(
+	t *testing.T,
+	st stats.Interface,
+	mode UpstreamMode,
+	domain string,
+	upsTimeout time.Duration,
+	dropFirst *atomic.Bool,
+	optimistic bool,
+) (addr string) {
+	t.Helper()
+
+	var reqNum atomic.Uint32
+	upsAddr := aghtest.StartLocalhostUpstream(t, dns.HandlerFunc(func(
+		w dns.ResponseWriter,
+		r *dns.Msg,
+	) {
+		if reqNum.Add(1) == 1 && dropFirst.Load() {
+			return
+		}
+
+		resp := (&dns.Msg{}).SetReply(r)
+		resp.Answer = []dns.RR{&dns.A{
+			Hdr: dns.RR_Header{
+				Name:   domain,
+				Rrtype: dns.TypeA,
+				Class:  dns.ClassINET,
+				Ttl:    uint32(testCacheTTL.Seconds()),
+			},
+			A: net.IP{1, 2, 3, 4},
+		}}
+
+		require.NoError(testutil.PanicT{}, w.WriteMsg(resp))
+	})).String()
+
+	conf := Config{
+		UpstreamDNS:      []string{upsAddr},
+		UpstreamMode:     mode,
+		EDNSClientSubnet: &EDNSClientSubnet{Enabled: false},
+		ClientsContainer: EmptyClientsContainer{},
+	}
+
+	if optimistic {
+		conf.CacheEnabled = true
+		conf.CacheSize = 4096
+		conf.CacheMaxTTL = uint32(testCacheTTL.Seconds())
+		conf.CacheOptimistic = true
+		conf.CacheOptimisticAnswerTTL = timeutil.Duration(time.Minute)
+		conf.CacheOptimisticMaxAge = timeutil.Duration(time.Hour)
+	}
+
+	s := createTestServer(t, &filtering.Config{
+		Logger:            testLogger,
+		ProtectionEnabled: true,
+		BlockingMode:      filtering.BlockingModeDefault,
+	}, ServerConfig{
+		UDPListenAddrs:  []*net.UDPAddr{{}},
+		TCPListenAddrs:  []*net.TCPAddr{{}},
+		TLSConf:         &TLSConfig{},
+		Config:          conf,
+		UpstreamTimeout: upsTimeout,
+		ServePlainDNS:   true,
+	}, testTLSConfigProvider)
+	s.stats = st
+
+	startDeferStop(t, s)
+
+	return s.dnsProxy.Addr(proxy.ProtoUDP).String()
+}
diff --git a/internal/dnsforward/upstreamstats.go b/internal/dnsforward/upstreamstats.go
deleted file mode 100644
index a4bf6fde9d0..00000000000
--- a/internal/dnsforward/upstreamstats.go
+++ /dev/null
@@ -1,223 +0,0 @@
-package dnsforward
-
-import (
-	"time"
-
-	"github.com/AdguardTeam/AdGuardHome/internal/aghnet"
-	"github.com/AdguardTeam/AdGuardHome/internal/stats"
-	"github.com/AdguardTeam/dnsproxy/proxy"
-	"github.com/AdguardTeam/dnsproxy/upstream"
-	"github.com/miekg/dns"
-)
-
-// statsUpstream is an [upstream.Upstream] that records the duration of each
-// successful exchange in the statistics.
-//
-// The response times are collected here, and not from
-// [proxy.DNSContext.QueryStatistics], because the latter only describes the
-// exchanges performed for a client's request.  The optimistic cache replies
-// from the cache right away and refreshes the expired entry in a background
-// goroutine, so those exchanges would never be counted, and the average
-// upstream response time would only be based on cache misses, which are biased
-// towards rare and slow domain names.
-//
-// See https://github.com/AdguardTeam/AdGuardHome/issues/8435.
-type statsUpstream struct {
-	// upstream is the wrapped upstream DNS server.  It must not be nil.
-	upstream upstream.Upstream
-
-	// srv is used to access the statistics.  It must not be nil.
-	srv *Server
-
-	// timeout is the timeout of a single exchange attempt with the wrapped
-	// upstream, see [ServerConfig.UpstreamTimeout].  It is zero if there is no
-	// timeout.
-	timeout time.Duration
-}
-
-// type check
-var _ upstream.Upstream = (*statsUpstream)(nil)
-
-// Exchange implements the [upstream.Upstream] interface for *statsUpstream.
-func (u *statsUpstream) Exchange(req *dns.Msg) (resp *dns.Msg, err error) {
-	startTime := time.Now()
-	resp, err = u.upstream.Exchange(req)
-	if err != nil {
-		// Don't count the failed exchanges, since their duration is mostly
-		// defined by the timeout.
-		return resp, err
-	}
-
-	u.srv.updateUpstreamStats(u.upstream.Address(), req, time.Since(startTime), u.timeout)
-
-	return resp, nil
-}
-
-// markIgnoredReq records the request of dctx as one whose upstream exchanges
-// must not be counted, when the statistics ignore its client or its domain.  It
-// returns the function that undoes it, which must be called once the request
-// has been resolved.
-//
-// An upstream exchange carries no client identity, so [statsUpstream] cannot
-// consult [stats.Interface.ShouldCount] itself.  The decision is therefore made
-// here, where the client is still known, and left for the wrappers to find.
-// Exchanges that belong to no request at all, such as the background refreshes
-// of the optimistic cache, are never marked and so are always counted.
-//
-// dctx and its proxy context must not be nil.
-func (s *Server) markIgnoredReq(dctx *dnsContext) (unmark func()) {
-	pctx := dctx.proxyCtx
-	q := pctx.Req.Question[0]
-	_, _, ids := s.clientIdentity(dctx)
-
-	s.serverLock.RLock()
-	count := s.shouldCountStat(aghnet.NormalizeDomain(q.Name), q.Qtype, q.Qclass, ids)
-	s.serverLock.RUnlock()
-
-	if count {
-		return func() {}
-	}
-
-	req := pctx.Req
-	s.ignoredReqs.Store(req, struct{}{})
-
-	return func() { s.ignoredReqs.Delete(req) }
-}
-
-// isIgnoredReq returns true if req belongs to a query whose statistics are
-// ignored, see [Server.markIgnoredReq].
-func (s *Server) isIgnoredReq(req *dns.Msg) (ok bool) {
-	_, ok = s.ignoredReqs.Load(req)
-
-	return ok
-}
-
-// Address implements the [upstream.Upstream] interface for *statsUpstream.
-func (u *statsUpstream) Address() (addr string) {
-	return u.upstream.Address()
-}
-
-// Close implements the [upstream.Upstream] interface for *statsUpstream.
-func (u *statsUpstream) Close() (err error) {
-	return u.upstream.Close()
-}
-
-// updateUpstreamStats writes the response time of a single successful exchange
-// with the upstream server at addr into the statistics.  timeout is the timeout
-// of a single exchange attempt, if any.  req must not be nil.
-func (s *Server) updateUpstreamStats(addr string, req *dns.Msg, dur, timeout time.Duration) {
-	if len(req.Question) == 0 {
-		return
-	}
-
-	if s.isIgnoredReq(req) {
-		// The statistics ignore the client or the domain of the query this
-		// exchange was performed for, see [Server.markIgnoredReq].
-		return
-	}
-
-	if timeout > 0 && dur >= timeout {
-		// A single attempt cannot take longer than the timeout, so this
-		// exchange has retried at least once after an attempt that timed out.
-		//
-		// Such a duration describes the retry policy and the configured
-		// timeout, which defaults to ten seconds, rather than the speed of the
-		// upstream.  Averaging it in makes the reported response time an order
-		// of magnitude higher than the actual one: with a ten-second timeout,
-		// one retried query out of a hundred outweighs the other ninety-nine
-		// several times over.
-		//
-		// See https://github.com/AdguardTeam/AdGuardHome/issues/8457.
-		s.logger.Debug(
-			"upstream retried after timeout; not counting in stats",
-			"addr", addr,
-			"duration", dur,
-			"timeout", timeout,
-		)
-
-		return
-	}
-
-	// NOTE:  s.serverLock must not be acquired here, see [Server.upstreamStats].
-	if s.upstreamStats == nil {
-		return
-	}
-
-	s.upstreamStats.UpdateUpstream(&stats.UpstreamEntry{
-		Address:       addr,
-		Domain:        aghnet.NormalizeDomain(req.Question[0].Name),
-		QueryDuration: dur,
-	})
-}
-
-// WrapUpstreamConfig implements the [client.UpstreamConfigWrapper] interface
-// for *Server.  It returns a copy of uc with each upstream wrapped into
-// [*statsUpstream], or nil if uc is nil.  uc itself is not modified, but the
-// returned configuration shares the underlying upstreams with it, so only one
-// of the two should ever be closed.
-//
-// timeout must be the timeout that the upstreams of uc have actually been
-// constructed with, since it is what tells a retried exchange from a slow one,
-// see [Server.updateUpstreamStats].  It differs between configurations: the
-// private rDNS upstreams use [defaultLocalTimeout] rather than the configured
-// one.  It is taken as an argument rather than read from [Server.conf], which
-// is mutable and is written under serverLock while this method may be called
-// without it, from the client upstream manager.
-func (s *Server) WrapUpstreamConfig(
-	uc *proxy.UpstreamConfig,
-	timeout time.Duration,
-) (wrapped *proxy.UpstreamConfig) {
-	if uc == nil {
-		return nil
-	}
-
-	return &proxy.UpstreamConfig{
-		DomainReservedUpstreams:  s.wrapUpstreamsMap(uc.DomainReservedUpstreams, timeout),
-		SpecifiedDomainUpstreams: s.wrapUpstreamsMap(uc.SpecifiedDomainUpstreams, timeout),
-		SubdomainExclusions:      uc.SubdomainExclusions,
-		Upstreams:                s.wrapUpstreams(uc.Upstreams, timeout),
-	}
-}
-
-// wrapUpstreamsMap returns a copy of ups with each upstream wrapped into
-// [*statsUpstream], or nil if ups is nil.
-func (s *Server) wrapUpstreamsMap(
-	ups map[string][]upstream.Upstream,
-	timeout time.Duration,
-) (wrapped map[string][]upstream.Upstream) {
-	if ups == nil {
-		return nil
-	}
-
-	wrapped = make(map[string][]upstream.Upstream, len(ups))
-	for domain, u := range ups {
-		wrapped[domain] = s.wrapUpstreams(u, timeout)
-	}
-
-	return wrapped
-}
-
-// wrapUpstreams returns a copy of ups with each upstream wrapped into
-// [*statsUpstream], or nil if ups is nil.  A single upstream may be referenced
-// by several fields of a [proxy.UpstreamConfig], in which case it gets a
-// wrapper of its own for each reference, just like it gets closed once for each
-// of them, see [proxy.UpstreamConfig.Close].
-func (s *Server) wrapUpstreams(
-	ups []upstream.Upstream,
-	timeout time.Duration,
-) (wrapped []upstream.Upstream) {
-	if ups == nil {
-		return nil
-	}
-
-	wrapped = make([]upstream.Upstream, 0, len(ups))
-	for _, u := range ups {
-		wrapped = append(wrapped, &statsUpstream{
-			upstream: u,
-			srv:      s,
-			timeout:  timeout,
-		})
-	}
-
-	return wrapped
-}
diff --git a/internal/dnsforward/upstreamstats_internal_test.go b/internal/dnsforward/upstreamstats_internal_test.go
deleted file mode 100644
index 9acbc0125b2..00000000000
--- a/internal/dnsforward/upstreamstats_internal_test.go
+++ /dev/null
@@ -1,507 +0,0 @@
-package dnsforward
-
-import (
-	"net"
-	"sync"
-	"sync/atomic"
-	"testing"
-	"time"
-
-	"github.com/AdguardTeam/AdGuardHome/internal/aghtest"
-	"github.com/AdguardTeam/AdGuardHome/internal/filtering"
-	"github.com/AdguardTeam/AdGuardHome/internal/stats"
-	"github.com/AdguardTeam/dnsproxy/proxy"
-	"github.com/AdguardTeam/dnsproxy/upstream"
-	"github.com/AdguardTeam/golibs/container"
-	"github.com/AdguardTeam/golibs/errors"
-	"github.com/AdguardTeam/golibs/testutil"
-	"github.com/AdguardTeam/golibs/timeutil"
-	"github.com/miekg/dns"
-	"github.com/stretchr/testify/assert"
-	"github.com/stretchr/testify/require"
-)
-
-func TestStatsUpstream_Exchange(t *testing.T) {
-	const domain = "example.com."
-
-	req := (&dns.Msg{}).SetQuestion(domain, dns.TypeA)
-
-	testCases := []struct {
-		upsErr     error
-		req        *dns.Msg
-		name       string
-		wantDomain string
-	}{{
-		upsErr:     nil,
-		req:        req,
-		name:       "success",
-		wantDomain: "example.com",
-	}, {
-		upsErr:     errors.Error("network is unreachable"),
-		req:        req,
-		name:       "error",
-		wantDomain: "",
-	}, {
-		upsErr:     nil,
-		req:        &dns.Msg{},
-		name:       "no_question",
-		wantDomain: "",
-	}}
-
-	for _, tc := range testCases {
-		t.Run(tc.name, func(t *testing.T) {
-			assertExchangeSample(t, tc.req, tc.upsErr, tc.wantDomain)
-		})
-	}
-}
-
-// assertExchangeSample performs a single exchange through a [statsUpstream]
-// whose wrapped upstream fails with upsErr, if it is not nil, and asserts that
-// the statistics received a sample for wantDomain, or none at all if it is
-// empty.
-func assertExchangeSample(t *testing.T, req *dns.Msg, upsErr error, wantDomain string) {
-	t.Helper()
-
-	st := &testStats{}
-	ups := &statsUpstream{
-		upstream: aghtest.NewUpstreamMock(func(req *dns.Msg) (resp *dns.Msg, err error) {
-			if upsErr != nil {
-				return nil, upsErr
-			}
-
-			return (&dns.Msg{}).SetReply(req), nil
-		}),
-		srv: &Server{upstreamStats: st},
-	}
-
-	_, err := ups.Exchange(req)
-	if upsErr != nil {
-		assert.ErrorIs(t, err, upsErr)
-	} else {
-		assert.NoError(t, err)
-	}
-
-	entries := st.upstreamEntries()
-	if wantDomain == "" {
-		assert.Empty(t, entries)
-
-		return
-	}
-
-	require.Len(t, entries, 1)
-
-	assert.Equal(t, wantDomain, entries[0].Domain)
-	assert.Equal(t, ups.Address(), entries[0].Address)
-}
-
-// TestStatsUpstream_Exchange_timeoutRetry is a regression test for the upstream
-// response times being much higher than the actual network latency, see
-// https://github.com/AdguardTeam/AdGuardHome/issues/8457.
-//
-// A plain DNS upstream retries once when an attempt times out, e.g. when a UDP
-// datagram is lost, and the retried exchange succeeds.  Its duration is then at
-// least the whole upstream timeout, which defaults to ten seconds, so a single
-// such sample outweighs a hundred normal ones several times over.
-func TestStatsUpstream_Exchange_timeoutRetry(t *testing.T) {
-	const domain = "example.com."
-	const upsTimeout = 1 * time.Second
-
-	// dropFirst tells the upstream to ignore the very first query, the way a
-	// lossy network would.
-	var dropFirst atomic.Bool
-
-	var reqNum atomic.Uint32
-	upsAddr := aghtest.StartLocalhostUpstream(t, dns.HandlerFunc(func(
-		w dns.ResponseWriter,
-		r *dns.Msg,
-	) {
-		if reqNum.Add(1) == 1 && dropFirst.Load() {
-			return
-		}
-
-		resp := (&dns.Msg{}).SetReply(r)
-		resp.Answer = []dns.RR{&dns.A{
-			Hdr: dns.RR_Header{Name: domain, Rrtype: dns.TypeA, Class: dns.ClassINET, Ttl: 60},
-			A:   net.IP{1, 2, 3, 4},
-		}}
-
-		require.NoError(testutil.PanicT{}, w.WriteMsg(resp))
-	})).String()
-
-	testCases := []struct {
-		name      string
-		dropFirst bool
-		wantLen   int
-	}{{
-		name:      "normal_exchange_counted",
-		dropFirst: false,
-		wantLen:   1,
-	}, {
-		name:      "retried_exchange_not_counted",
-		dropFirst: true,
-		wantLen:   0,
-	}}
-
-	for _, tc := range testCases {
-		t.Run(tc.name, func(t *testing.T) {
-			reqNum.Store(0)
-			dropFirst.Store(tc.dropFirst)
-
-			ups, err := upstream.AddressToUpstream(upsAddr, &upstream.Options{
-				Logger:  testLogger,
-				Timeout: upsTimeout,
-			})
-			require.NoError(t, err)
-			testutil.CleanupAndRequireSuccess(t, ups.Close)
-
-			st := &testStats{}
-			wrapped := &statsUpstream{
-				upstream: ups,
-				srv:      &Server{upstreamStats: st, logger: testLogger},
-				timeout:  upsTimeout,
-			}
-
-			resp, err := wrapped.Exchange((&dns.Msg{}).SetQuestion(domain, dns.TypeA))
-			require.NoError(t, err)
-			require.NotEmpty(t, resp.Answer)
-
-			assert.Len(t, st.upstreamEntries(), tc.wantLen)
-		})
-	}
-}
-
-// testUpsTimeout is the upstream timeout used by the wrapper tests.
-const testUpsTimeout = 10 * time.Second
-
-func TestServer_WrapUpstreamConfig(t *testing.T) {
-	s := &Server{}
-
-	t.Run("nil", func(t *testing.T) {
-		assert.Nil(t, s.WrapUpstreamConfig(nil, testUpsTimeout))
-	})
-
-	t.Run("all_fields", func(t *testing.T) {
-		ups := aghtest.NewUpstreamMock(func(req *dns.Msg) (resp *dns.Msg, err error) {
-			panic(testutil.UnexpectedCall(req))
-		})
-		exclusions := container.NewMapSet("excluded.example.")
-
-		uc := &proxy.UpstreamConfig{
-			DomainReservedUpstreams: map[string][]upstream.Upstream{
-				"reserved.example.": {ups},
-			},
-			SpecifiedDomainUpstreams: map[string][]upstream.Upstream{
-				"specified.example.": {ups},
-			},
-			SubdomainExclusions: exclusions,
-			Upstreams:           []upstream.Upstream{ups},
-		}
-
-		wrapped := s.WrapUpstreamConfig(uc, testUpsTimeout)
-		require.NotNil(t, wrapped)
-
-		assert.Same(t, exclusions, wrapped.SubdomainExclusions)
-
-		// The original configuration must stay intact.
-		assert.Same(t, ups, uc.Upstreams[0])
-
-		for _, u := range [][]upstream.Upstream{
-			wrapped.Upstreams,
-			wrapped.DomainReservedUpstreams["reserved.example."],
-			wrapped.SpecifiedDomainUpstreams["specified.example."],
-		} {
-			require.Len(t, u, 1)
-
-			su, ok := u[0].(*statsUpstream)
-			require.True(t, ok)
-
-			assert.Same(t, ups, su.upstream)
-			assert.Same(t, s, su.srv)
-		}
-	})
-
-	t.Run("nil_fields", func(t *testing.T) {
-		wrapped := s.WrapUpstreamConfig(&proxy.UpstreamConfig{}, testUpsTimeout)
-		require.NotNil(t, wrapped)
-
-		assert.Nil(t, wrapped.Upstreams)
-		assert.Nil(t, wrapped.DomainReservedUpstreams)
-		assert.Nil(t, wrapped.SpecifiedDomainUpstreams)
-	})
-}
-
-// TestServer_updateStats_optimisticCache is a regression test for the biased
-// average upstream response time, see
-// https://github.com/AdguardTeam/AdGuardHome/issues/8435.
-//
-// The response served from the optimistic cache is refreshed in the background,
-// and that refresh must be counted in the upstream statistics as well.
-func TestServer_updateStats_optimisticCache(t *testing.T) {
-	const domain = "example.com."
-
-	// cacheTTL is the TTL that the upstream sets on its answers, and also the
-	// maximum TTL of the cache, so that the entry expires quickly.
-	const cacheTTL = 1 * time.Second
-
-	upsAddr := aghtest.StartLocalhostUpstream(t, dns.HandlerFunc(func(
-		w dns.ResponseWriter,
-		r *dns.Msg,
-	) {
-		resp := (&dns.Msg{}).SetReply(r)
-		resp.Answer = []dns.RR{&dns.A{
-			Hdr: dns.RR_Header{
-				Name:   domain,
-				Rrtype: dns.TypeA,
-				Class:  dns.ClassINET,
-				Ttl:    uint32(cacheTTL.Seconds()),
-			},
-			A: net.IP{1, 2, 3, 4},
-		}}
-
-		require.NoError(testutil.PanicT{}, w.WriteMsg(resp))
-	})).String()
-
-	st := &testStats{}
-	forwardConf := ServerConfig{
-		UDPListenAddrs: []*net.UDPAddr{{}},
-		TCPListenAddrs: []*net.TCPAddr{{}},
-		TLSConf:        &TLSConfig{},
-		Config: Config{
-			UpstreamDNS:              []string{upsAddr},
-			UpstreamMode:             UpstreamModeLoadBalance,
-			CacheEnabled:             true,
-			CacheSize:                4096,
-			CacheMaxTTL:              uint32(cacheTTL.Seconds()),
-			CacheOptimistic:          true,
-			CacheOptimisticAnswerTTL: timeutil.Duration(time.Minute),
-			CacheOptimisticMaxAge:    timeutil.Duration(time.Hour),
-			EDNSClientSubnet:         &EDNSClientSubnet{Enabled: false},
-			ClientsContainer:         EmptyClientsContainer{},
-		},
-		ServePlainDNS: true,
-	}
-
-	s := createTestServer(t, &filtering.Config{
-		Logger:            testLogger,
-		ProtectionEnabled: true,
-		BlockingMode:      filtering.BlockingModeDefault,
-	}, forwardConf, testTLSConfigProvider)
-	s.stats, s.upstreamStats = st, st
-
-	startDeferStop(t, s)
-	addr := s.dnsProxy.Addr(proxy.ProtoUDP).String()
-
-	req := (&dns.Msg{}).SetQuestion(domain, dns.TypeA)
-
-	// The first query is a cache miss, so it's resolved by the upstream.
-	resp, err := dns.Exchange(req, addr)
-	require.NoError(t, err)
-	require.NotEmpty(t, resp.Answer)
-
-	assert.Len(t, st.upstreamEntries(), 1)
-
-	// Let the cached entry expire.
-	time.Sleep(cacheTTL + 100*time.Millisecond)
-
-	// The second query is an optimistic cache hit, so it's answered right away
-	// while the entry is refreshed in the background.
-	resp, err = dns.Exchange(req, addr)
-	require.NoError(t, err)
-	require.NotEmpty(t, resp.Answer)
-
-	// Use a timeout that is generous enough for the background refresh to
-	// finish on a loaded machine.
-	const refreshTimeout = 10 * time.Second
-
-	assert.Eventually(t, func() (ok bool) {
-		return len(st.upstreamEntries()) == 2
-	}, refreshTimeout, refreshTimeout/100)
-
-	// NOTE:  Don't assert on QueryDuration, since an exchange with a localhost
-	// upstream may well finish within a single tick of a coarse system clock.
-	for _, e := range st.upstreamEntries() {
-		assert.Equal(t, "example.com", e.Domain)
-		assert.Equal(t, upsAddr, e.Address)
-	}
-}
-
-// type check
-var _ stats.Interface = (*testStats)(nil)
-
-// TestServer_updateStats_ignoredClient is a regression test for the statistics
-// ignore lists being bypassed by the upstream wrappers.
-//
-// An upstream exchange carries no client identity, so a wrapper that recorded
-// every exchange would count the queries of a client whose statistics are
-// ignored, which both contradicts the documented behaviour and biases the very
-// averages this collection exists to report.
-func TestServer_updateStats_ignoredClient(t *testing.T) {
-	const domain = "example.com."
-
-	upsAddr := aghtest.StartLocalhostUpstream(t, dns.HandlerFunc(func(
-		w dns.ResponseWriter,
-		r *dns.Msg,
-	) {
-		resp := (&dns.Msg{}).SetReply(r)
-		resp.Answer = []dns.RR{&dns.A{
-			Hdr: dns.RR_Header{Name: domain, Rrtype: dns.TypeA, Class: dns.ClassINET, Ttl: 60},
-			A:   net.IP{1, 2, 3, 4},
-		}}
-
-		require.NoError(testutil.PanicT{}, w.WriteMsg(resp))
-	})).String()
-
-	var countClient atomic.Bool
-	st := &testStats{
-		onShouldCount: func(_ string, _, _ uint16, _ []string) (ok bool) {
-			return countClient.Load()
-		},
-	}
-
-	forwardConf := ServerConfig{
-		UDPListenAddrs: []*net.UDPAddr{{}},
-		TCPListenAddrs: []*net.TCPAddr{{}},
-		TLSConf:        &TLSConfig{},
-		Config: Config{
-			UpstreamDNS:      []string{upsAddr},
-			UpstreamMode:     UpstreamModeLoadBalance,
-			EDNSClientSubnet: &EDNSClientSubnet{Enabled: false},
-			ClientsContainer: EmptyClientsContainer{},
-		},
-		ServePlainDNS: true,
-	}
-
-	s := createTestServer(t, &filtering.Config{
-		Logger:            testLogger,
-		ProtectionEnabled: true,
-		BlockingMode:      filtering.BlockingModeDefault,
-	}, forwardConf, testTLSConfigProvider)
-	s.stats, s.upstreamStats = st, st
-
-	startDeferStop(t, s)
-	addr := s.dnsProxy.Addr(proxy.ProtoUDP).String()
-
-	t.Run("ignored", func(t *testing.T) {
-		countClient.Store(false)
-
-		resp, err := dns.Exchange((&dns.Msg{}).SetQuestion(domain, dns.TypeA), addr)
-		require.NoError(t, err)
-		require.NotEmpty(t, resp.Answer)
-
-		assert.Empty(t, st.upstreamEntries())
-	})
-
-	t.Run("counted", func(t *testing.T) {
-		countClient.Store(true)
-
-		// Use a different name, so that the answer isn't served from the cache.
-		resp, err := dns.Exchange((&dns.Msg{}).SetQuestion("other."+domain, dns.TypeA), addr)
-		require.NoError(t, err)
-		require.NotNil(t, resp)
-
-		assert.Len(t, st.upstreamEntries(), 1)
-	})
-}
-
-// TestServer_WrapUpstreamConfig_race makes sure that wrapping does not read the
-// mutable [Server.conf], which is written under serverLock while the client
-// upstream manager may wrap a configuration without holding it.
-//
-// Run with -race.
-func TestServer_WrapUpstreamConfig_race(t *testing.T) {
-	t.Parallel()
-
-	s := &Server{}
-	uc := &proxy.UpstreamConfig{
-		Upstreams: []upstream.Upstream{
-			aghtest.NewUpstreamMock(func(req *dns.Msg) (resp *dns.Msg, err error) {
-				panic(testutil.UnexpectedCall(req))
-			}),
-		},
-	}
-
-	const iterations = 200
-
-	var wg sync.WaitGroup
-	wg.Add(2)
-
-	// A /control/dns_config update writing the timeout under the lock.
-	go func() {
-		defer wg.Done()
-
-		for i := range iterations {
-			s.serverLock.Lock()
-			s.conf.UpstreamTimeout = time.Duration(i+1) * time.Second
-			s.serverLock.Unlock()
-		}
-	}()
-
-	// The client upstream manager wrapping a configuration without the lock.
-	go func() {
-		defer wg.Done()
-
-		for range iterations {
-			assert.NotNil(t, s.WrapUpstreamConfig(uc, testUpsTimeout))
-		}
-	}()
-
-	wg.Wait()
-}
-
-// TestServer_prepareInternalDNS_privateTimeout is a regression test for the
-// private rDNS wrappers carrying the wrong retry threshold.
-//
-// Those upstreams are constructed with [defaultLocalTimeout], one second, while
-// the configured upstream timeout is normally ten.  A wrapper holding the
-// configured timeout would compare a one-second retried exchange against ten
-// seconds and record it as an ordinary response, reintroducing exactly the
-// inflated sample this collection is meant to exclude.
-func TestServer_prepareInternalDNS_privateTimeout(t *testing.T) {
-	const upsTimeout = 10 * time.Second
-
-	require.NotEqual(t, upsTimeout, defaultLocalTimeout)
-
-	upsAddr := aghtest.StartLocalhostUpstream(t, dns.HandlerFunc(func(
-		w dns.ResponseWriter,
-		r *dns.Msg,
-	) {
-		require.NoError(testutil.PanicT{}, w.WriteMsg((&dns.Msg{}).SetReply(r)))
-	})).String()
-
-	forwardConf := ServerConfig{
-		UDPListenAddrs: []*net.UDPAddr{{}},
-		TCPListenAddrs: []*net.TCPAddr{{}},
-		TLSConf:        &TLSConfig{},
-		Config: Config{
-			UpstreamDNS:      []string{upsAddr},
-			UpstreamMode:     UpstreamModeLoadBalance,
-			EDNSClientSubnet: &EDNSClientSubnet{Enabled: false},
-			ClientsContainer: EmptyClientsContainer{},
-		},
-		LocalPTRResolvers: []string{upsAddr},
-		UsePrivateRDNS:    true,
-		UpstreamTimeout:   upsTimeout,
-		ServePlainDNS:     true,
-	}
-
-	s := createTestServer(t, &filtering.Config{
-		Logger:            testLogger,
-		ProtectionEnabled: true,
-		BlockingMode:      filtering.BlockingModeDefault,
-	}, forwardConf, testTLSConfigProvider)
-
-	// wrapperTimeout returns the retry threshold stored in the first wrapper of
-	// uc.
-	wrapperTimeout := func(uc *proxy.UpstreamConfig) (d time.Duration) {
-		require.NotNil(t, uc)
-		require.NotEmpty(t, uc.Upstreams)
-
-		su, ok := uc.Upstreams[0].(*statsUpstream)
-		require.True(t, ok)
-
-		return su.timeout
-	}
-
-	assert.Equal(t, upsTimeout, wrapperTimeout(s.conf.UpstreamConfig))
-	assert.Equal(t, defaultLocalTimeout, wrapperTimeout(s.conf.PrivateRDNSUpstreamConfig))
-}
diff --git a/internal/stats/unit.go b/internal/stats/unit.go
index 479683a99e7..4930de7d888 100644
--- a/internal/stats/unit.go
+++ b/internal/stats/unit.go
@@ -10,6 +10,7 @@ import (
 	"time"
 
 	"github.com/AdguardTeam/AdGuardHome/internal/aghnet"
+	"github.com/AdguardTeam/dnsproxy/proxy"
 	"github.com/AdguardTeam/golibs/errors"
 	"github.com/AdguardTeam/golibs/logutil/slogutil"
 	"go.etcd.io/bbolt"
@@ -62,6 +63,10 @@ type Entry struct {
 	// Domain is the domain name requested.
 	Domain string
 
+	// UpstreamStats contains the DNS query statistics for both the upstream and
+	// fallback DNS servers.  Don't modify items in the slice.
+	UpstreamStats []*proxy.UpstreamStatistics
+
 	// Result is the result of processing the request.
 	Result Result
 
@@ -350,6 +355,16 @@ func (u *unit) add(e *Entry) {
 	pt := uint64(e.ProcessingTime.Microseconds())
 	u.timeSum += pt
 	u.nTotal++
+
+	for _, s := range e.UpstreamStats {
+		if s.IsCached || s.Error != nil {
+			continue
+		}
+
+		addr := s.Address
+		u.upstreamsResponses[addr]++
+		u.upstreamsTimeSum[addr] += uint64(s.QueryDuration.Microseconds())
+	}
 }
 
 // addUpstream adds the data about a single upstream exchange to u.  It's safe

From efd76680a60676f383d8f2ff8ec42785ac33333e Mon Sep 17 00:00:00 2001
From: Aditya Nugraha <vortexilation@gmail.com>
Date: Wed, 5 Aug 2026 03:53:18 +0700
Subject: [PATCH 6/6] stats: fix the global average over truncated upstream
 lists

Two defects from the review of the previous head.

The global upstream average divided one bounded list by another.
unit.serialize keeps only the top maxUpstreams entries of
upstreamsResponses and of upstreamsTimeSum, and it ranks each of them
independently, so a unit that has seen more upstreams than that persists
the counts of one set and the durations of another.
avgUpstreamResponseTime then summed the two as though they described the
same population.  With 100 upstreams answering often and quickly and 100
answering rarely and slowly, the true average of 0.5025us was reported as
0.99us, nearly twice over.

Count the exact totals as the responses arrive, before any truncation, and
average those.  They are persisted as two new unitDB fields; GOB decodes
them as zero in the records written before they existed, and for those the
bounded lists are still summed, which is what this used to do and remains
the best answer available for such a record.  The bounded lists keep their
present meaning, which is the per-upstream ranking on the dashboard.

The retry test also read testStats.lastEntry without holding the mutex
that Update writes it under.  The client is answered before the statistics
path has necessarily run, so the read raced.  Add a locked accessor and
wait for the entry rather than assuming it has arrived.

The truncation regression fails against the previous implementation with
exactly the reported numbers, and the race test passes under
-race -count=3.
---
 internal/dnsforward/stats_internal_test.go | 15 ++++-
 internal/stats/unit.go                     | 75 +++++++++++++++++++---
 internal/stats/unit_internal_test.go       | 63 ++++++++++++++++++
 3 files changed, 142 insertions(+), 11 deletions(-)

diff --git a/internal/dnsforward/stats_internal_test.go b/internal/dnsforward/stats_internal_test.go
index e2e3c4ede49..d25ab3c8d58 100644
--- a/internal/dnsforward/stats_internal_test.go
+++ b/internal/dnsforward/stats_internal_test.go
@@ -68,6 +68,14 @@ func (l *testStats) UpdateUpstream(e *stats.UpstreamEntry) {
 	l.upsEntries = append(l.upsEntries, e)
 }
 
+// entry returns the last entry the statistics received, or nil.
+func (l *testStats) entry() (e *stats.Entry) {
+	l.mu.Lock()
+	defer l.mu.Unlock()
+
+	return l.lastEntry
+}
+
 // upstreamEntries returns a copy of the collected upstream entries.
 func (l *testStats) upstreamEntries() (entries []*stats.UpstreamEntry) {
 	l.mu.Lock()
@@ -308,8 +316,11 @@ func TestServer_stats_upstreamTimes(t *testing.T) {
 				require.NoError(t, err)
 				require.NotEmpty(t, resp.Answer)
 
-				require.NotNil(t, st.lastEntry)
-				assert.Empty(t, st.lastEntry.UpstreamStats)
+				require.Eventually(t, func() (ok bool) {
+					return st.entry() != nil
+				}, testTimeout, testTimeout/20)
+
+				assert.Empty(t, st.entry().UpstreamStats)
 			})
 		}
 	})
diff --git a/internal/stats/unit.go b/internal/stats/unit.go
index 4930de7d888..ec149108302 100644
--- a/internal/stats/unit.go
+++ b/internal/stats/unit.go
@@ -151,6 +151,17 @@ type unit struct {
 	// nTotal stores the total number of requests.
 	nTotal uint64
 
+	// upstreamsResponsesTotal is the number of responses from all the upstream
+	// servers, and upstreamsTimeSumTotal is the sum of their durations in
+	// microseconds.
+	//
+	// They are kept apart from upstreamsResponses and upstreamsTimeSum because
+	// those are truncated to the top [maxUpstreams] entries independently of
+	// each other when serialized, so the two need not describe the same set of
+	// upstreams and cannot be summed against one another.
+	upstreamsResponsesTotal uint64
+	upstreamsTimeSumTotal   uint64
+
 	// timeSum stores the sum of processing time in microseconds of each request
 	// written by the unit.
 	timeSum uint64
@@ -203,6 +214,15 @@ type unitDB struct {
 	// NTotal is the total number of requests.
 	NTotal uint64
 
+	// UpstreamsResponsesTotal is the number of responses from all the upstream
+	// servers, and UpstreamsTimeSumTotal is the sum of their durations in
+	// microseconds, both before UpstreamsResponses and UpstreamsTimeSum are
+	// truncated.  They are absent from the records written by the versions that
+	// predate them, in which case they decode as zero, see
+	// [avgUpstreamResponseTime].
+	UpstreamsResponsesTotal uint64
+	UpstreamsTimeSumTotal   uint64
+
 	// TimeAvg is the average of processing times in microseconds of all the
 	// requests in the unit.
 	TimeAvg uint32
@@ -298,6 +318,9 @@ func (u *unit) serialize() (udb *unitDB) {
 		UpstreamsResponses: convertMapToSlice(u.upstreamsResponses, maxUpstreams),
 		UpstreamsTimeSum:   convertMapToSlice(u.upstreamsTimeSum, maxUpstreams),
 		TimeAvg:            timeAvg,
+
+		UpstreamsResponsesTotal: u.upstreamsResponsesTotal,
+		UpstreamsTimeSumTotal:   u.upstreamsTimeSumTotal,
 	}
 }
 
@@ -339,6 +362,7 @@ func (u *unit) deserialize(udb *unitDB) {
 	u.clients = convertSliceToMap(udb.Clients)
 	u.upstreamsResponses = convertSliceToMap(udb.UpstreamsResponses)
 	u.upstreamsTimeSum = convertSliceToMap(udb.UpstreamsTimeSum)
+	u.upstreamsTimeSumTotal, u.upstreamsResponsesTotal = upstreamTotals(udb)
 	u.timeSum = uint64(udb.TimeAvg) * udb.NTotal
 }
 
@@ -362,16 +386,24 @@ func (u *unit) add(e *Entry) {
 		}
 
 		addr := s.Address
+		dur := uint64(s.QueryDuration.Microseconds())
+
 		u.upstreamsResponses[addr]++
-		u.upstreamsTimeSum[addr] += uint64(s.QueryDuration.Microseconds())
+		u.upstreamsTimeSum[addr] += dur
+		u.upstreamsResponsesTotal++
+		u.upstreamsTimeSumTotal += dur
 	}
 }
 
 // addUpstream adds the data about a single upstream exchange to u.  It's safe
 // for concurrent use.
 func (u *unit) addUpstream(e *UpstreamEntry) {
+	dur := uint64(e.QueryDuration.Microseconds())
+
 	u.upstreamsResponses[e.Address]++
-	u.upstreamsTimeSum[e.Address] += uint64(e.QueryDuration.Microseconds())
+	u.upstreamsTimeSum[e.Address] += dur
+	u.upstreamsResponsesTotal++
+	u.upstreamsTimeSumTotal += dur
 }
 
 // flushUnitToDB puts udb to the database at id.
@@ -652,13 +684,9 @@ func topUpstreamsPairs(
 func avgUpstreamResponseTime(units []*unitDB) (avg float64) {
 	var timeSum, respNum uint64
 	for _, u := range units {
-		for _, cp := range u.UpstreamsTimeSum {
-			timeSum += cp.Count
-		}
-
-		for _, cp := range u.UpstreamsResponses {
-			respNum += cp.Count
-		}
+		t, n := upstreamTotals(u)
+		timeSum += t
+		respNum += n
 	}
 
 	if respNum == 0 {
@@ -668,6 +696,35 @@ func avgUpstreamResponseTime(units []*unitDB) (avg float64) {
 	return microsecondsToSeconds(float64(timeSum) / float64(respNum))
 }
 
+// upstreamTotals returns the total duration of the responses from all the
+// upstream servers of udb, in microseconds, and their number.  udb must not be
+// nil.
+//
+// [unitDB.UpstreamsResponses] and [unitDB.UpstreamsTimeSum] are each truncated
+// to the top [maxUpstreams] entries independently of each other, so on a unit
+// that has seen more upstreams than that they need not describe the same set,
+// and summing one against the other gives a ratio of two different populations.
+// The exact totals are therefore stored alongside them.
+//
+// Records written before those totals existed decode them as zero, and the
+// bounded slices are all such a record has; summing them is what this used to
+// do and remains the best available answer for it.
+func upstreamTotals(udb *unitDB) (timeSum, respNum uint64) {
+	if udb.UpstreamsResponsesTotal != 0 || udb.UpstreamsTimeSumTotal != 0 {
+		return udb.UpstreamsTimeSumTotal, udb.UpstreamsResponsesTotal
+	}
+
+	for _, cp := range udb.UpstreamsTimeSum {
+		timeSum += cp.Count
+	}
+
+	for _, cp := range udb.UpstreamsResponses {
+		respNum += cp.Count
+	}
+
+	return timeSum, respNum
+}
+
 // microsecondsToSeconds converts microseconds to seconds.
 //
 // NOTE:  Frontend expects time duration in seconds as floating-point number
diff --git a/internal/stats/unit_internal_test.go b/internal/stats/unit_internal_test.go
index c58a2e35e32..e22f5274bec 100644
--- a/internal/stats/unit_internal_test.go
+++ b/internal/stats/unit_internal_test.go
@@ -1,6 +1,7 @@
 package stats
 
 import (
+	"fmt"
 	"testing"
 
 	"github.com/stretchr/testify/assert"
@@ -57,6 +58,8 @@ func TestUnit_Deserialize(t *testing.T) {
 			upstreamsTimeSum: map[string]uint64{
 				"1.2.3.4": 246912,
 			},
+			upstreamsResponsesTotal: 2,
+			upstreamsTimeSumTotal:   246912,
 		},
 		db: &unitDB{
 			NResult: []uint64{0, 1, 1, 0, 0, 0},
@@ -208,3 +211,63 @@ func TestStatsCtx_dataFromUnits_avgProcessingTime(t *testing.T) {
 	assert.InDelta(t, wantAvg, resp.AvgProcessingTime, 1e-12)
 	assert.Equal(t, uint64(1010), resp.NumDNSQueries)
 }
+
+// TestAvgUpstreamResponseTime_truncation makes sure that the global average is
+// not computed from the two bounded per-upstream lists.
+//
+// [unit.serialize] truncates upstreamsResponses and upstreamsTimeSum to the top
+// [maxUpstreams] entries independently of each other, so on a unit that has
+// seen more upstreams than that the two need not describe the same set, and
+// dividing one total by the other compares two different populations.
+func TestAvgUpstreamResponseTime_truncation(t *testing.T) {
+	t.Parallel()
+
+	u := newUnit(0)
+
+	// Two groups, each maxUpstreams large, ranked oppositely: the first wins on
+	// response count, the second on total duration.  Truncation therefore keeps
+	// the counts of one and the durations of the other.
+	const (
+		countHeavyResponses, countHeavyTime = 100, 1
+		timeHeavyResponses, timeHeavyTime   = 99, 99
+	)
+
+	for i := range maxUpstreams {
+		countHeavy := fmt.Sprintf("count-heavy-%03d", i)
+		u.upstreamsResponses[countHeavy] = countHeavyResponses
+		u.upstreamsTimeSum[countHeavy] = countHeavyTime
+
+		timeHeavy := fmt.Sprintf("time-heavy-%03d", i)
+		u.upstreamsResponses[timeHeavy] = timeHeavyResponses
+		u.upstreamsTimeSum[timeHeavy] = timeHeavyTime
+	}
+
+	u.upstreamsResponsesTotal = maxUpstreams * (countHeavyResponses + timeHeavyResponses)
+	u.upstreamsTimeSumTotal = maxUpstreams * (countHeavyTime + timeHeavyTime)
+
+	udb := u.serialize()
+
+	// Both lists are bounded, and they hold different upstreams.
+	require.Len(t, udb.UpstreamsResponses, maxUpstreams)
+	require.Len(t, udb.UpstreamsTimeSum, maxUpstreams)
+
+	wantAvg := microsecondsToSeconds(
+		float64(u.upstreamsTimeSumTotal) / float64(u.upstreamsResponsesTotal),
+	)
+
+	assert.InDelta(t, wantAvg, avgUpstreamResponseTime([]*unitDB{udb}), 1e-15)
+}
+
+// TestAvgUpstreamResponseTime_oldRecord makes sure that a record written before
+// the exact totals existed still yields an average, from the bounded lists that
+// are all it has.
+func TestAvgUpstreamResponseTime_oldRecord(t *testing.T) {
+	t.Parallel()
+
+	udb := &unitDB{
+		UpstreamsResponses: []countPair{{Name: "1.2.3.4", Count: 4}},
+		UpstreamsTimeSum:   []countPair{{Name: "1.2.3.4", Count: 800}},
+	}
+
+	assert.InDelta(t, microsecondsToSeconds(200), avgUpstreamResponseTime([]*unitDB{udb}), 1e-15)
+}