本文详细介绍了DNS系统，包括其工作原理、域名结构、DNS查询类型和解析类型。重点讲解了DNS服务相关概念，如DNS服务器类型和互联网域名，并探讨了BIND软件的使用。此外，还介绍了DNS主服务器的搭建过程，包括正向和反向解析的实现，以及如何搭建容错DNS服务器。文章还涵盖了DNS的智能DNS服务和在Internet DNS架构中的应用。
DNS是什么？
域名系统（Domain Name System）是整个互联网的电话簿，它能够将可被人理解的域名翻译成可被机器理解 IP 地址，使得互联网的使用者不再需要直接接触很难阅读和理解的 IP 地址。
域名系统在现在的互联网中非常重要，因为服务器的 IP 地址可能会经常变动，如果没有了 DNS，那么可能 IP 地址一旦发生了更改，当前服务器的客户端就没有办法连接到目标的服务器了，如果我们为 IP 地址提供一个”别名“并在其发生变动时修改别名和 IP 地址的关系，那么我们就可以保证集群对外提供的服务能够相对稳定地被其他客户端访问。
DNS 其实就是一个分布式的树状命名系统，它就像一个去中心化的分布式数据库，存储着从域名到 IP 地址的映射。
本地名称解析配置文件：hosts
linux：/etc/hosts
windows：%WINDIR%/system32/drivers/etc/hosts
DNS基于C/S架构，服务器端：53/udp，53/tcp
FQDN：全称域名=主机名(别名) + 域名(组织，独立的名称空间)
BIND：Bekerley Internet Name Domain，由ISC提供的DNS软件实现
DNS域名结构
- 根域
- 一级域名：TOP Level Domain —— TLD
- com、edu、mil、gov、org…
- 三类：组织域、国家域(.cn .ca …)、反向域
- 二级域名：baidu.com
- 三级域名：img.baidu.com
- 最多可达到127级域名
DNS工作原理
简单来说：当你输入一个域名时，DNS会返回一个IP地址
虽然只需要返回一个IP地址，但是DNS的查询过程非常复杂，分成多个步骤。
- DNS客户端向DNS解析器发出解析
www.baidu.com域名请求 - DNS解析器首先会向就近的根DNS服务器
.请求顶级域名DNS服务器地址，每个DNS服务器都知道根服务器地址 - 拿到根域名DNS服务
com.的地址后会向.com域名服务器请求负责baidu.com.域名解析的命名服务得到baidu.com.地址信息 - 拿到
.baodu.com.域名服务器的地址后向域名服务器请求负责www.baidu.com.域名解析并返回结果给DNS解析器 - DNS解析器将解析的结果交给DNS客户端
- DNS解析器把解析结果缓存到DNS查询缓存中，之后如果再要查询同样的域名，就直接读取缓存内容(本机也有缓存)
- window：ipconfig/display
- Linux：默认没有缓存，只有本地hosts文件
完整的查询请求经过流程
Client——hosts文件——Client DNS Service Local Cache——DNS Server(recursion)——DNS Server Cache——Iteration——根——顶级域名DNS——二级域名DNS——...
# recursion 递归
# iteration 迭代
DNS 客户端接受到 IP 地址之后，整个 DNS 解析的过程就结束了，客户端接下来就会通过当前的 IP 地址直接向服务器发送请求。
对于 DNS 解析器，这里使用的 DNS 查询方式是迭代查询，每个 DNS 服务并不会直接返回 DNS 信息，而是会返回另一台 DNS 服务器的位置，由客户端依次询问不同级别的 DNS 服务直到查询得到了预期的结果；另一种查询方式叫做递归查询，也就是 DNS 服务器收到客户端的请求之后会直接返回准确的结果，如果当前服务器没有存储 DNS 信息，就会访问其他的服务器并将结果返回给客户端。
雪人计划(Yeti DNS Project)
根服务器是国际互联网最重要的战略基础设施，是互联网通信的“中枢”。由于种种原因，现有互联网根服务器数量一直被限定为13个。基于全新技术架构的全球下一代互联网（IPv6）根服务器测试和运营实验项目—— “雪人计划”。2015年6月23日正式发布，我国下一代互联网工程中心主任、“雪人计划”首任执行主席刘东认为，该计划将打破根服务器困局，全球互联网有望实现多边共治。
2017年11月，据相关报道由下一代互联网国家工程中心牵头发起的“雪人计划”已在全球完成25台IPv6（互联网协议第六版）根服务器架设，中国部署了其中的4台，打破了中国过去没有根服务器的困境。
DNS查询类型
- 递归查询：查询到返回最终结果
- 迭代查询：查询到部分结果，分布查询返回结果
解析类型
- FQDN——>IP 正向解析
- IP——>FQDN 反向解析
注意
正反向解析是两个不同的名称空间，通俗来讲是两颗不同的解析树
DNS服务相关概念与技术
DNS服务器的类型
-
主DNS服务器
-
从DNS服务器
-
缓存DNS服务器(转发器)
主DNS服务器
管理和维护所负责解析的域内解析库的服务器
从DNS服务器
从主服务器或从服务器“复制”（区域传输）解析库副本
序列号：解析库版本号，主服务器解析库变化是，其序列递增
刷新时间间隔：从服务器从主服务器请求同步解析的时间间隔
重试时间间隔：从服务器请求同步失败是，再次尝试时间间隔
过期时长：从服务器联系不到主服务时，多久后停止服务
通知机制：主服务器解析库发生变化时，会主动通知从服务器
互联网域名
域名注册：
- 万网：被阿里收购
- 新网：被腾讯收购
- godaddy
DNS搭建软件BIND
DNS服务器软件：bind，powerdns，unbound
BIND相关程序包
[root@localhost ~]# yum list all bind*
bind # 服务器
bind-libs # 相关库
bind-utils # 客户端
bind-chroot # 安全包，将DNS相关文件放至/var/named/chroot
[root@localhost ~]# rpm -qa bind*
bind-libs-lite-9.11.4-9.P2.el7.x86_64
bind-license-9.11.4-9.P2.el7.noarch
bind-export-libs-9.11.4-9.P2.el7.x86_64
bind-utils-9.11.4-9.P2.el7.x86_64
bind-libs-9.11.4-9.P2.el7.x86_64
安装bind、bind-utils
[root@localhost ~]# yum install bind bind-utils -y
[root@localhost ~]# systemctl enable --now named
Created symlink /etc/systemd/system/multi-user.target.wants/named.service → /usr/lib/systemd/system/named.service.
bind-utils常见的客户端测试工具
[root@localhost ~]# rpm -ql bind-utils
/etc/trusted-key.key
/usr/bin/delv
/usr/bin/dig
/usr/bin/host
/usr/bin/mdig
/usr/bin/nslookup
/usr/bin/nsupdate
...
bind文件列表
[root@localhost ~]# rpm -ql bind
/etc/logrotate.d/named
/etc/named
/etc/named.conf
# 主配置文件
/etc/named.iscdlv.key
/etc/named.rfc1912.zones
/etc/named.root.key
/etc/rndc.conf
/etc/rndc.key
/etc/rwtab.d/named
/etc/sysconfig/named
/run/named
/usr/bin/arpaname
/usr/bin/named-rrchecker
/usr/lib/python2.7/site-packages/isc
/usr/lib/python2.7/site-packages/isc-2.0-py2.7.egg-info
/usr/lib/python2.7/site-packages/isc/__init__.py
/usr/lib/python2.7/site-packages/isc/__init__.pyc
/usr/lib/python2.7/site-packages/isc/__init__.pyo
/usr/lib/python2.7/site-packages/isc/checkds.py
/usr/lib/python2.7/site-packages/isc/checkds.pyc
/usr/lib/python2.7/site-packages/isc/checkds.pyo
/usr/lib/python2.7/site-packages/isc/coverage.py
/usr/lib/python2.7/site-packages/isc/coverage.pyc
/usr/lib/python2.7/site-packages/isc/coverage.pyo
/usr/lib/python2.7/site-packages/isc/dnskey.py
/usr/lib/python2.7/site-packages/isc/dnskey.pyc
/usr/lib/python2.7/site-packages/isc/dnskey.pyo
/usr/lib/python2.7/site-packages/isc/eventlist.py
/usr/lib/python2.7/site-packages/isc/eventlist.pyc
/usr/lib/python2.7/site-packages/isc/eventlist.pyo
/usr/lib/python2.7/site-packages/isc/keydict.py
/usr/lib/python2.7/site-packages/isc/keydict.pyc
/usr/lib/python2.7/site-packages/isc/keydict.pyo
/usr/lib/python2.7/site-packages/isc/keyevent.py
/usr/lib/python2.7/site-packages/isc/keyevent.pyc
/usr/lib/python2.7/site-packages/isc/keyevent.pyo
/usr/lib/python2.7/site-packages/isc/keymgr.py
/usr/lib/python2.7/site-packages/isc/keymgr.pyc
/usr/lib/python2.7/site-packages/isc/keymgr.pyo
/usr/lib/python2.7/site-packages/isc/keyseries.py
/usr/lib/python2.7/site-packages/isc/keyseries.pyc
/usr/lib/python2.7/site-packages/isc/keyseries.pyo
/usr/lib/python2.7/site-packages/isc/keyzone.py
/usr/lib/python2.7/site-packages/isc/keyzone.pyc
/usr/lib/python2.7/site-packages/isc/keyzone.pyo
/usr/lib/python2.7/site-packages/isc/parsetab.py
/usr/lib/python2.7/site-packages/isc/parsetab.pyc
/usr/lib/python2.7/site-packages/isc/parsetab.pyo
/usr/lib/python2.7/site-packages/isc/policy.py
/usr/lib/python2.7/site-packages/isc/policy.pyc
/usr/lib/python2.7/site-packages/isc/policy.pyo
/usr/lib/python2.7/site-packages/isc/rndc.py
/usr/lib/python2.7/site-packages/isc/rndc.pyc
/usr/lib/python2.7/site-packages/isc/rndc.pyo
/usr/lib/python2.7/site-packages/isc/utils.py
/usr/lib/python2.7/site-packages/isc/utils.pyc
/usr/lib/python2.7/site-packages/isc/utils.pyo
/usr/lib/systemd/system/named-setup-rndc.service
/usr/lib/systemd/system/named.service
# 服务文件
/usr/lib/tmpfiles.d/named.conf
/usr/lib64/bind
/usr/libexec/generate-rndc-key.sh
/usr/sbin/ddns-confgen
/usr/sbin/dnssec-checkds
/usr/sbin/dnssec-coverage
/usr/sbin/dnssec-dsfromkey
/usr/sbin/dnssec-importkey
/usr/sbin/dnssec-keyfromlabel
/usr/sbin/dnssec-keygen
/usr/sbin/dnssec-keymgr
/usr/sbin/dnssec-revoke
/usr/sbin/dnssec-settime
/usr/sbin/dnssec-signzone
/usr/sbin/dnssec-verify
/usr/sbin/genrandom
/usr/sbin/isc-hmac-fixup
/usr/sbin/lwresd
/usr/sbin/named
# 主程序
/usr/sbin/named-checkconf
/usr/sbin/named-checkzone
/usr/sbin/named-compilezone
/usr/sbin/named-journalprint
/usr/sbin/nsec3hash
/usr/sbin/rndc
# 实现服务关闭或重新加载
/usr/sbin/rndc-confgen
/usr/sbin/tsig-keygen
/usr/share/doc/bind-9.11.4
/usr/share/doc/bind-9.11.4/Bv9ARM.ch01.html
/usr/share/doc/bind-9.11.4/Bv9ARM.ch02.html
/usr/share/doc/bind-9.11.4/Bv9ARM.ch03.html
/usr/share/doc/bind-9.11.4/Bv9ARM.ch04.html
/usr/share/doc/bind-9.11.4/Bv9ARM.ch05.html
/usr/share/doc/bind-9.11.4/Bv9ARM.ch06.html
/usr/share/doc/bind-9.11.4/Bv9ARM.ch07.html
/usr/share/doc/bind-9.11.4/Bv9ARM.ch08.html
/usr/share/doc/bind-9.11.4/Bv9ARM.ch09.html
/usr/share/doc/bind-9.11.4/Bv9ARM.ch10.html
/usr/share/doc/bind-9.11.4/Bv9ARM.ch11.html
/usr/share/doc/bind-9.11.4/Bv9ARM.ch12.html
/usr/share/doc/bind-9.11.4/Bv9ARM.ch13.html
/usr/share/doc/bind-9.11.4/Bv9ARM.html
/usr/share/doc/bind-9.11.4/Bv9ARM.pdf
/usr/share/doc/bind-9.11.4/CHANGES
/usr/share/doc/bind-9.11.4/README
/usr/share/doc/bind-9.11.4/isc-logo.pdf
/usr/share/doc/bind-9.11.4/man.arpaname.html
/usr/share/doc/bind-9.11.4/man.ddns-confgen.html
/usr/share/doc/bind-9.11.4/man.delv.html
/usr/share/doc/bind-9.11.4/man.dig.html
/usr/share/doc/bind-9.11.4/man.dnssec-checkds.html
/usr/share/doc/bind-9.11.4/man.dnssec-coverage.html
/usr/share/doc/bind-9.11.4/man.dnssec-dsfromkey.html
/usr/share/doc/bind-9.11.4/man.dnssec-importkey.html
/usr/share/doc/bind-9.11.4/man.dnssec-keyfromlabel.html
/usr/share/doc/bind-9.11.4/man.dnssec-keygen.html
/usr/share/doc/bind-9.11.4/man.dnssec-keymgr.html
/usr/share/doc/bind-9.11.4/man.dnssec-revoke.html
/usr/share/doc/bind-9.11.4/man.dnssec-settime.html
/usr/share/doc/bind-9.11.4/man.dnssec-signzone.html
/usr/share/doc/bind-9.11.4/man.dnssec-verify.html
/usr/share/doc/bind-9.11.4/man.dnstap-read.html
/usr/share/doc/bind-9.11.4/man.genrandom.html
/usr/share/doc/bind-9.11.4/man.host.html
/usr/share/doc/bind-9.11.4/man.isc-hmac-fixup.html
/usr/share/doc/bind-9.11.4/man.lwresd.html
/usr/share/doc/bind-9.11.4/man.mdig.html
/usr/share/doc/bind-9.11.4/man.named-checkconf.html
/usr/share/doc/bind-9.11.4/man.named-checkzone.html
/usr/share/doc/bind-9.11.4/man.named-journalprint.html
/usr/share/doc/bind-9.11.4/man.named-nzd2nzf.html
/usr/share/doc/bind-9.11.4/man.named-rrchecker.html
/usr/share/doc/bind-9.11.4/man.named.conf.html
/usr/share/doc/bind-9.11.4/man.named.html
/usr/share/doc/bind-9.11.4/man.nsec3hash.html
/usr/share/doc/bind-9.11.4/man.nslookup.html
/usr/share/doc/bind-9.11.4/man.nsupdate.html
/usr/share/doc/bind-9.11.4/man.pkcs11-destroy.html
/usr/share/doc/bind-9.11.4/man.pkcs11-keygen.html
/usr/share/doc/bind-9.11.4/man.pkcs11-list.html
/usr/share/doc/bind-9.11.4/man.pkcs11-tokens.html
/usr/share/doc/bind-9.11.4/man.rndc-confgen.html
/usr/share/doc/bind-9.11.4/man.rndc.conf.html
/usr/share/doc/bind-9.11.4/man.rndc.html
/usr/share/doc/bind-9.11.4/named.conf.default
/usr/share/doc/bind-9.11.4/notes.html
/usr/share/doc/bind-9.11.4/notes.pdf
/usr/share/doc/bind-9.11.4/sample
/usr/share/doc/bind-9.11.4/sample/etc
/usr/share/doc/bind-9.11.4/sample/etc/named.conf
/usr/share/doc/bind-9.11.4/sample/etc/named.rfc1912.zones
/usr/share/doc/bind-9.11.4/sample/var
/usr/share/doc/bind-9.11.4/sample/var/named
/usr/share/doc/bind-9.11.4/sample/var/named/data
/usr/share/doc/bind-9.11.4/sample/var/named/my.external.zone.db
/usr/share/doc/bind-9.11.4/sample/var/named/my.internal.zone.db
/usr/share/doc/bind-9.11.4/sample/var/named/named.ca
/usr/share/doc/bind-9.11.4/sample/var/named/named.empty
/usr/share/doc/bind-9.11.4/sample/var/named/named.localhost
/usr/share/doc/bind-9.11.4/sample/var/named/named.loopback
/usr/share/doc/bind-9.11.4/sample/var/named/slaves
/usr/share/doc/bind-9.11.4/sample/var/named/slaves/my.ddns.internal.zone.db
/usr/share/doc/bind-9.11.4/sample/var/named/slaves/my.slave.internal.zone.db
/usr/share/man/man1/arpaname.1.gz
/usr/share/man/man1/named-rrchecker.1.gz
/usr/share/man/man5/named.conf.5.gz
/usr/share/man/man5/rndc.conf.5.gz
/usr/share/man/man8/ddns-confgen.8.gz
/usr/share/man/man8/dnssec-checkds.8.gz
/usr/share/man/man8/dnssec-coverage.8.gz
/usr/share/man/man8/dnssec-dsfromkey.8.gz
/usr/share/man/man8/dnssec-importkey.8.gz
/usr/share/man/man8/dnssec-keyfromlabel.8.gz
/usr/share/man/man8/dnssec-keygen.8.gz
/usr/share/man/man8/dnssec-keymgr.8.gz
/usr/share/man/man8/dnssec-revoke.8.gz
/usr/share/man/man8/dnssec-settime.8.gz
/usr/share/man/man8/dnssec-signzone.8.gz
/usr/share/man/man8/dnssec-verify.8.gz
/usr/share/man/man8/genrandom.8.gz
/usr/share/man/man8/isc-hmac-fixup.8.gz
/usr/share/man/man8/lwresd.8.gz
/usr/share/man/man8/named-checkconf.8.gz
/usr/share/man/man8/named-checkzone.8.gz
/usr/share/man/man8/named-compilezone.8.gz
/usr/share/man/man8/named-journalprint.8.gz
/usr/share/man/man8/named.8.gz
/usr/share/man/man8/nsec3hash.8.gz
/usr/share/man/man8/rndc-confgen.8.gz
/usr/share/man/man8/rndc.8.gz
/usr/share/man/man8/tsig-keygen.8.gz
/var/log/named.log
/var/named
/var/named/data
/var/named/dynamic
/var/named/named.ca
/var/named/named.empty
/var/named/named.localhost
/var/named/named.loopback
/var/named/slaves
启动服务
[root@localhost ~]# systemctl start named
[root@localhost ~]# systemctl enable named
Created symlink from /etc/systemd/system/multi-user.target.wants/named.service to /usr/lib/systemd/system/named.service.
查看端口
[root@localhost ~]# ss -nutlp
Netid State Recv-Q Send-Q Local Address:Port Peer Address:Port
udp UNCONN 0 0 [::1]:53 [::]:* users:(("named",pid=67617,fd=513))
tcp LISTEN 0 128 [::1]:953 [::]:* users:(("named",pid=67617,fd=24))
tcp LISTEN 0 10 [::1]:53 [::]:* users:(("named",pid=67617,fd=22))
实现DNS主服务器搭建
准备工作
两台主机，一台作为DNS服务器，一台作为客户端
设置 DNS服务器的/etc/resolv.conf文件，将DNS指向自己IP
[root@localhost ~]# vim /etc/sysconfig/network-scripts/ifcfg-ens33
PROXY_METHOD=none
BROWSER_ONLY=no
BOOTPROTO=dhcp
DEFROUTE=yes
IPV4_FAILURE_FATAL=no
IPV6INIT=yes
IPV6_AUTOCONF=yes
IPV6_DEFROUTE=yes
IPV6_FAILURE_FATAL=no
IPV6_ADDR_GEN_MODE=stable-privacy
NAME=ens33
UUID=fc4d728c-858c-41f2-9a0f-8bcbcdfdb804
DEVICE=ens33
ONBOOT=yes
DNS1=127.0.0.1
DNS2=180.76.76.76
改完后，生效一下
nmcli connection reload
nmcli connection up ens33
生效完成后/etc/resolv.conf的DNS内容已经改变
[root@localhost ~]# nmcli connection reload
[root@localhost ~]# nmcli connection up ens33
Connection successfully activated (D-Bus active path: /org/freedesktop/NetworkManager/ActiveConnection/4)
[root@localhost ~]# cat /etc/resolv.conf
# Generated by NetworkManager
search localdomain CentOS8
nameserver 127.0.0.1
nameserver 180.76.76.76
使用测试工具host、dig、nslookup
host www.baidu.com DNSSERVER
dig www.baidu.com @DNSSERVER
nslookup可以做交互式
host
[root@localhost ~]# host www.baidu.com 127.0.0.1
Using domain server:
Name: 127.0.0.1
Address: 127.0.0.1#53
Aliases:
www.baidu.com is an alias for www.a.shifen.com.
www.a.shifen.com has address 14.215.177.38
www.a.shifen.com has address 14.215.177.39
dig
[root@localhost ~]# dig www.baidu.com @127.0.0.1
; <<>> DiG 9.11.13-RedHat-9.11.13-3.el8 <<>> www.baidu.com @127.0.0.1
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 46479
;; flags: qr rd ra; QUERY: 1, ANSWER: 3, AUTHORITY: 5, ADDITIONAL: 6
;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 4096
; COOKIE: 49986308e0fe172f521523215ee786b8e2cf8877826cd9f9 (good)
;; QUESTION SECTION:# 要求选项，将www.baidu.com解析成A
;www.baidu.com. IN A
;; ANSWER SECTION:# 返回结果
www.baidu.com. 1142 IN CNAME www.a.shifen.com.
www.a.shifen.com. 244 IN A 14.215.177.38
www.a.shifen.com. 244 IN A 14.215.177.39
;; AUTHORITY SECTION:
a.shifen.com. 1143 IN NS ns2.a.shifen.com.
a.shifen.com. 1143 IN NS ns1.a.shifen.com.
a.shifen.com. 1143 IN NS ns5.a.shifen.com.
a.shifen.com. 1143 IN NS ns4.a.shifen.com.
a.shifen.com. 1143 IN NS ns3.a.shifen.com.
;; ADDITIONAL SECTION:
ns1.a.shifen.com. 1143 IN A 61.135.165.224
ns4.a.shifen.com. 1143 IN A 14.215.177.229
ns5.a.shifen.com. 1143 IN A 180.76.76.95
ns3.a.shifen.com. 1143 IN A 112.80.255.253
ns2.a.shifen.com. 1143 IN A 220.181.33.32
;; Query time: 0 msec
;; SERVER: 127.0.0.1#53(127.0.0.1)
;; WHEN: Mon Jun 15 10:33:28 EDT 2020
;; MSG SIZE rcvd: 299
nslookup：windows和linux都支持且为交互式
[root@localhost ~]# nslookup
> server 127.0.0.1
Default server: 127.0.0.1
Address: 127.0.0.1#53
> www.baidu.com
Server: 127.0.0.1
Address: 127.0.0.1#53
Non-authoritative answer:# 非权威结果
www.baidu.com canonical name = www.a.shifen.com.
Name: www.a.shifen.com
Address: 14.215.177.38
Name: www.a.shifen.com
Address: 14.215.177.39
查询到的内容是否为权威结果
[root@localhost ~]# dig www.baidu.com @106.11.211.61
; <<>> DiG 9.11.13-RedHat-9.11.13-3.el8 <<>> www.baidu.com @106.11.211.61
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NXDOMAIN, id: 675
;; flags: qr aa rd; QUERY: 1, ANSWER: 0, AUTHORITY: 1, ADDITIONAL: 1
#此处有aa就为权威结果
;; WARNING: recursion requested but not available
;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 4096
;; QUESTION SECTION:
;www.baidu.com. IN A
;; AUTHORITY SECTION:
baidu.com. 600 IN SOA ns1.alidns.com. hostmaster.hichina.com. 2019090319 3600 1200 86400 360
;; Query time: 34 msec
;; SERVER: 106.11.211.61#53(106.11.211.61)
;; WHEN: Mon Jun 15 10:43:10 EDT 2020
;; MSG SIZE rcvd: 114
[root@localhost ~]# nslookup
> server 106.11.211.61
Default server: 106.11.211.61
Address: 106.11.211.61#53
> www.baidu.com
Server: 106.11.211.61
Address: 106.11.211.61#53
www.baidu.com canonical name = www.a.shifen.com.
Name: www.a.shifen.com
Address: 14.215.177.38
Name: www.a.shifen.com
Address: 14.215.177.39
将DNS服务监听所有地址
修改配置文件
[root@localhost ~]# rpm -qc bind
/etc/logrotate.d/named
/etc/named.conf
/etc/named.rfc1912.zones
/etc/named.root.key
/etc/rndc.conf
/etc/rndc.key
/etc/sysconfig/named
/var/named/named.ca
/var/named/named.empty
/var/named/named.localhost
/var/named/named.loopback
# /etc/named.conf
[root@localhost ~]# vim /etc/named.conf
//
// named.conf
//
//
// See /usr/share/doc/bind*/sample/ for example named configuration files.
//
listen-on port 53 {
127.0.0.1; };//修改配置localhost 或 0.0.0.0；注释这行效果一样
listen-on-v6 port 53 {
::1; };
directory "/var/named";//指定默认文件路径
dump-file "/var/named/data/cache_dump.db";
statistics-file "/var/named/data/named_stats.txt";
memstatistics-file "/var/named/data/named_mem_stats.txt";
secroots-file "/var/named/data/named.secroots";
recursing-file "/var/named/data/named.recursing";
allow-query {
localhost; };//允许谁查询，可以改成any；注释这行效果一样
/*
- If you are building an AUTHORITATIVE DNS server, do NOT enable recursion.
- If you are building a RECURSIVE (caching) DNS server, you need to enable
recursion.
control to limit queries to your legitimate users. Failing to do so will
cause your server to become part of large scale DNS amplification
attacks. Implementing BCP38 within your network would greatly
reduce such attack surface
*/
recursion yes;
dnssec-enable yes; //这两项最好改成no，加密选项
dnssec-validation yes;
managed-keys-directory "/var/named/dynamic";
pid-file "/run/named/named.pid";
session-keyfile "/run/named/session.key";
/* https://fedoraproject.org/wiki/Changes/CryptoPolicy */
include "/etc/crypto-policies/back-ends/bind.config";
};
logging {
channel default_debug {
file "data/named.run";
severity dynamic;
};
};
zone "." IN {
type hint;
file "named.ca";// 互联网上13ipv4个根服务器地址，文件路径在上方directory "/var/named"中
};
// 引用其他区域的配置文件，我们在添加自己域时也应该使用这种引用方法
include "/etc/named.rfc1912.zones";
include "/etc/named.root.key";
检查语法
[root@localhost ~]# named-checkconf
[root@localhost ~]# rndc reload
server reload successful
此时可以实现DNS转发器功能
最低0.47元/天 解锁文章
扫一扫
1万+
被折叠的 条评论
为什么被折叠?
到【灌水乐园】发言
