鸟哥学习笔记---DNS

最新推荐文章于 2022-06-30 10:50:32 发布

weixin_33859504

最新推荐文章于 2022-06-30 10:50:32 发布

阅读量559

点赞数

原文链接：http://blog.51cto.com/2816056/1180789

版权

概要：

完整主机名：Fully Qualified Domain Name(FQDN)

Top Level Domains(TLDs)

1.一般顶级域名(Generric TLDs,gTLD)：.com、.org、.gov等

2.地区顶级域名(Country Code TLDs,ccTLD)：.uk、.jp、.cn等

#每一个上层的DNS服务器的记录的信息，其实只有其下一层的主机名而已

#每一台DNS的服务器都只管理自己的下一层主机名的转译而已

#DNS记录缓存通常为24小时

[root@Centosszm ~]# dig +trace www.163.com

DNS使用的Port为53：

[root@Centosszm ~]# vi /etc/services

通常DNS是以UDP这个较快速的数据传输协议来查询的，但是万一没有办法查询到完整的信息时，就会再次以TCP这个协议来重新查询。

全局DNS：

1.上层DNS授权区域查询权，让你自己设置DNS服务器

2.直接请上层DNS服务器来帮你设置主机名对应

1）记录服务器所在的NS（NameServer）标志；

2）记录主机名对应的A（Addrss）标志；

不管是正解还是反解，每个域的记录就是一个区域（Zone）

ISP才有权力设置反解，你向ISP取得的IP不能自己设置反解。除非你取得的是整个Class C以上等级的IP网段。

1）正解的标志

SOA(Start of Authority)：开始验证

NS(Name server)：

A(Address)：

2）反解的标志

PTR(PoinTeR):指向

.的Zone类型就是hint类型。

一台简单的正解DNS服务器，要有两个Zone：

1）hinit

2）自己的Zone；（.vbird.org）

需要正解成对需求的大概仅有Mail Server

配置文件：

1./etc/hosts

2./etc/resolv.conf

3./etc/nsswitch.conf

[root@Centosszm ~]# grep -v '[#]' /etc/nsswitch.conf

passwd: files

shadow: files

group: files

hosts: files dns #先查hosts文件，再查DNS（/etc/resolv.conf）

bootparams: nisplus [NOTFOUND=return] files

ethers: files

netmasks: files

networks: files

protocols: files

rpc: files

services: files

netgroup: nisplus

publickey: nisplus

automount: files nisplus

aliases: files nisplus

使得DHCP服务器不改变/etc/resolv.conf的设置值：

host [-a] FQDN [server]

host -l domain [server]

查看所有相关信息，包括IP、TTL与排错信息等：

[root@Centosszm ~]# host -a www.baidu.com

Trying "www.baidu.com"

;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 48990

;; flags: qr rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 4, ADDITIONAL: 4

;; QUESTION SECTION:

;www.baidu.com. IN ANY

;; ANSWER SECTION:

www.baidu.com. 5 IN CNAME www.a.shifen.com.

;; AUTHORITY SECTION:

baidu.com. 5 IN NS ns3.baidu.com.

baidu.com. 5 IN NS ns4.baidu.com.

baidu.com. 5 IN NS dns.baidu.com.

baidu.com. 5 IN NS ns2.baidu.com.

;; ADDITIONAL SECTION:

dns.baidu.com. 5 IN A 202.108.22.220

ns2.baidu.com. 5 IN A 61.135.165.235

ns3.baidu.com. 5 IN A 220.181.37.10

ns4.baidu.com. 5 IN A 220.181.38.10

Received 194 bytes from 192.168.179.2#53 in 21 ms

#因为这个域禁止区域查询：

[root@Centosszm ~]# host -l baidu.com

;; connection timed out; no servers could be reached

[root@Centosszm ~]# host www.baidu.com 172.16.2.1

Using domain server:

Name: 172.16.2.1

Address: 172.16.2.1#53

Aliases:

www.baidu.com is an alias for www.a.shifen.com.

www.a.shifen.com has address 61.135.169.105

www.a.shifen.com has address 61.135.169.125

;; connection timed out; no servers could be reached

#nslookup [FQDN] [server]

[root@Centosszm ~]# nslookup www.baidu.com

Server: 192.168.179.2

Address: 192.168.179.2#53

Non-authoritative answer:

www.baidu.com canonical name = www.a.shifen.com.

Name: www.a.shifen.com

Address: 61.135.169.125

Name: www.a.shifen.com

Address: 61.135.169.105

+trace:从.开始追踪；

-t type:MX、NS、SOA

-x:查询反解信息

[root@Centosszm ~]# dig www.baidu.com

; <<>> DiG 9.7.0-P2-RedHat-9.7.0-5.P2.el6 <<>> www.baidu.com

;; global options: +cmd

;; Got answer:

;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 33742

;; flags: qr rd ra; QUERY: 1, ANSWER: 3, AUTHORITY: 4, ADDITIONAL: 4

;; QUESTION SECTION: #问题

;www.baidu.com. IN A

;; ANSWER SECTION: #回答

www.baidu.com. 5 IN CNAME www.a.shifen.com.

www.a.shifen.com. 5 IN A 61.135.169.105

www.a.shifen.com. 5 IN A 61.135.169.125

;; AUTHORITY SECTION: #验证，那个5为缓存时间

a.shifen.com. 5 IN NS ns9.a.shifen.com.

a.shifen.com. 5 IN NS ns4.a.shifen.com.

a.shifen.com. 5 IN NS ns5.a.shifen.com.

a.shifen.com. 5 IN NS ns7.a.shifen.com.

;; ADDITIONAL SECTION:

ns4.a.shifen.com. 5 IN A 123.125.113.67

ns5.a.shifen.com. 5 IN A 220.181.3.178

ns7.a.shifen.com. 5 IN A 220.181.38.47

ns9.a.shifen.com. 5 IN A 61.135.166.226

;; Query time: 7 msec

;; SERVER: 192.168.179.2#53(192.168.179.2)

;; WHEN: Tue Apr 9 20:20:43 2013

;; MSG SIZE rcvd: 226

反向查询：

[root@Centosszm ~]# dig -x 120.114.100.20

; <<>> DiG 9.7.0-P2-RedHat-9.7.0-5.P2.el6 <<>> -x 120.114.100.20

;; global options: +cmd

;; Got answer:

;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 31029

;; flags: qr rd ra; QUERY: 1, ANSWER: 3, AUTHORITY: 3, ADDITIONAL: 0

;; QUESTION SECTION:

;20.100.114.120.in-addr.arpa. IN PTR

;; ANSWER SECTION:

20.100.114.120.in-addr.arpa. 5 IN PTR mail-smtp-proxy.ksu.edu.tw.

20.100.114.120.in-addr.arpa. 5 IN PTR mail.ksu.edu.tw.

20.100.114.120.in-addr.arpa. 5 IN PTR mail-out-r2.ksu.edu.tw.

;; AUTHORITY SECTION:

100.114.120.in-addr.arpa. 5 IN NS dns1.ksu.edu.tw.

100.114.120.in-addr.arpa. 5 IN NS dns2.ksu.edu.tw.

100.114.120.in-addr.arpa. 5 IN NS dns3.twaren.net.

;; Query time: 1684 msec

;; SERVER: 192.168.179.2#53(192.168.179.2)

;; WHEN: Tue Apr 9 20:31:41 2013

;; MSG SIZE rcvd: 197

查询域管理者的相关信息：whois(由jwhois)

[root@Centosszm ~]# whois baidu.com

[Querying whois.verisign-grs.com]

[Redirected to whois.markmonitor.com]

[Querying whois.markmonitor.com]

[whois.markmonitor.com]

MarkMonitor is the Global Leader in Online Brand Protection.

MarkMonitor Domain Management(TM)

MarkMonitor Brand Protection(TM)

MarkMonitor AntiPiracy(TM)

MarkMonitor AntiFraud(TM)

Professional and Managed Services

Visit MarkMonitor at www.markmonitor.com

In Europe, at +44 (0) 203 206 2220

The Data in MarkMonitor.com's WHOIS database is provided by MarkMonitor.com

for information purposes, and to assist persons in obtaining information

about or related to a domain name registration record. MarkMonitor.com

does not guarantee its accuracy. By submitting a WHOIS query, you agree

that you will use this Data only for lawful purposes and that, under no

circumstances will you use this Data to: (1) allow, enable, or otherwise

support the transmission of mass unsolicited, commercial advertising or

solicitations via e-mail (spam); or (2) enable high volume, automated,

electronic processes that apply to MarkMonitor.com (or its systems).

MarkMonitor.com reserves the right to modify these terms at any time.

By submitting this query, you agree to abide by this policy.

Registrant:

Zhiyong Duan

Beijing Baidu Netcom Science Technology Co., Ltd.

3F Baidu Campus No.10 Shangdi 10th Street Haidian District

Beijing Beijing 100085

domainmaster@baidu.com +86.1059924216 Fax: +86.1059927435 #联系方式

Domain Name: baidu.com

Registrar Name: Markmonitor.com

Registrar Whois: whois.markmonitor.com

Registrar Homepage: http://www.markmonitor.com

Administrative Contact:

Zhiyong Duan

Beijing Baidu Netcom Science Technology Co., Ltd.

3F Baidu Campus No.10 Shangdi 10th Street Haidian District

Beijing Beijing 100085

domainmaster@baidu.com +86.1059924216 Fax: +86.1059927435

Technical Contact, Zone Contact:

Zhiyong Duan

Beijing Baidu Netcom Science Technology Co., Ltd.

3F Baidu Campus No.10 Shangdi 10th Street Haidian District

Beijing Beijing 100085

domainmaster@baidu.com +86.1059924216 Fax: +86.1059927435

Created on..............: 1999-10-11.

Expires on..............: 2015-10-11. #过期时间

Record last updated on..: 2012-05-19.

Domain servers in listed order:

dns.baidu.com

ns4.baidu.com

ns2.baidu.com

ns3.baidu.com

MarkMonitor is the Global Leader in Online Brand Protection.

MarkMonitor Domain Management(TM)

MarkMonitor Brand Protection(TM)

MarkMonitor AntiPiracy(TM)

MarkMonitor AntiFraud(TM)

Professional and Managed Services

Visit MarkMonitor at www.markmonitor.com

In Europe, at +44 (0) 203 206 2220

DNS服务器要用到的软件：

[root@Centosszm ~]# rpm -qa | grep '^bind'

bind-utils-9.7.0-5.P2.el6.i686 #客户端查找主机名的相关命令

bind-libs-9.7.0-5.P2.el6.i686 #函数库

bind-9.7.0-5.P2.el6.i686 #主程序

bind-chroot-9.7.0-5.P2.el6.i686 #设置Bind的根（/var/named/chroot）

/etc/named.conf:

/etc/sysconfig/named: chroot等参数设置

/var/named/ ：数据库

/var/run/named： named这个程序执行时默认放置pid-file在此目录内。

[root@Centosszm ~]# grep -v "#" /etc/sysconfig/named

ROOTDIR=/var/named/chroot

因为上面的设置，Bind相关程序所需要的所有数据会变成这样：

/var/named/chroot/etc/named.vonf

/var/named/chroot/etc/sysconfig/named

/var/named/chroot/var/named/

/var/named/chroot/var/run/named

chroot所需要使用到的目录，通过mount --bind的功能进行目录连接了（/etc/init.d/named）

mount --bind /var/named /var/named/chroot/var/named

单纯的cahe-only DNS服务器与forwarding功能：

1）有个只需要.这个zone file的简单DNS服务器，我们称这种没有自己公开的DNS数据库的服务器为cache-only DNS Server。

2）将原本要往.查询的任务，丢给上层DNS服务器去处理就为forwarding

3）通常搭建cache-only DNS服务器大都是为了系统安全

[root@Centosszm ~]# cat /etc/named.conf

// 这个是注释，注意结尾要以;

// named.conf

// Provided by Red Hat bind package to configure the ISC BIND named(8) DNS

// server as a caching only nameserver (as a localhost DNS resolver only).

// See /usr/share/doc/bind*/sample/ for example named configuration files.

options {

listen-on port 53 { any; }; #会对所有IP进行监听

directory "/var/named";

dump-file "/var/named/data/cache_dump.db";

statistics-file "/var/named/data/named_stats.txt";

memstatistics-file "/var/named/data/named_mem_stats.txt";

allow-query { any; };

recursion yes;

forward only;

forwarders {

172.16.2.6;

};

953：远程名称解析服务控制功能（Remote Name Daemon Control，RNDC）

[root@Centosszm ~]# /etc/init.d/named start

Starting named: [ OK ]

[root@Centosszm ~]# netstat -tulnp | grep named

tcp 0 0 192.168.111.100:53 0.0.0.0:* LISTEN 3624/named

tcp 0 0 172.16.128.211:53 0.0.0.0:* LISTEN 3624/named

tcp 0 0 192.168.179.7:53 0.0.0.0:* LISTEN 3624/named

tcp 0 0 127.0.0.1:53 0.0.0.0:* LISTEN 3624/named

tcp 0 0 127.0.0.1:953 0.0.0.0:* LISTEN 3624/named

tcp 0 0 ::1:953 :::* LISTEN 3624/named

udp 0 0 192.168.111.100:53 0.0.0.0:* 3624/named

udp 0 0 172.16.128.211:53 0.0.0.0:* 3624/named

udp 0 0 192.168.179.7:53 0.0.0.0:* 3624/named

udp 0 0 127.0.0.1:53 0.0.0.0:* 3624/named

是否正确启动要看这里的内容才行：

[root@Centosszm ~]# tail -n 30 /var/log/messages | grep named

测试：

[root@Centosszm ~]# dig www.baidu.com @172.16.2.6

; <<>> DiG 9.7.0-P2-RedHat-9.7.0-5.P2.el6 <<>> www.baidu.com @172.16.2.6

;; global options: +cmd

;; Got answer:

;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 8412

;; flags: qr rd ra; QUERY: 1, ANSWER: 3, AUTHORITY: 4, ADDITIONAL: 4

;; QUESTION SECTION:

;www.baidu.com. IN A

;; ANSWER SECTION:

www.baidu.com. 89 IN CNAME www.a.shifen.com.

www.a.shifen.com. 90 IN A 61.135.169.125

www.a.shifen.com. 90 IN A 61.135.169.105

;; AUTHORITY SECTION:

a.shifen.com. 460 IN NS ns4.a.shifen.com.

a.shifen.com. 460 IN NS ns5.a.shifen.com.

a.shifen.com. 460 IN NS ns7.a.shifen.com.

a.shifen.com. 460 IN NS ns9.a.shifen.com.

;; ADDITIONAL SECTION:

ns4.a.shifen.com. 715 IN A 123.125.113.67

ns5.a.shifen.com. 715 IN A 220.181.3.178

ns7.a.shifen.com. 532 IN A 220.181.38.47

ns9.a.shifen.com. 715 IN A 61.135.166.226

;; Query time: 5 msec

;; SERVER: 172.16.2.6#53(172.16.2.6) #测试成功

;; WHEN: Tue Apr 9 22:05:49 2013

;; MSG SIZE rcvd: 226

正解文件资源记录（Resource Record，RR）格式：下面这个是dig的格式

[domain] [ttl] IN [RR type] [RR data]

主机名. A IPv4地址

主机名. AAAA IPv6地址

域名. NS DNS域名

域名. SOA 管理这个域名的七个重要参数

域名. MX 接收邮件的服务器主机名字

主机别名. IN 实际代表这个主机别名的主机名字

ttl是当这笔记录被其它DNS服务器查询到后，这个记录会在对方DNS服务器的缓存中，保持多少秒钟的意思。

A、AAAA查询IP：

[root@Centosszm ~]# dig -t a www.baidu.com

[root@Centosszm ~]# dig www.baidu.com

3.NS:查询管理区域名（Zone）的服务器主机名

[root@Centosszm ~]# dig -t ns baidu.com

; <<>> DiG 9.7.0-P2-RedHat-9.7.0-5.P2.el6 <<>> -t ns baidu.com

;; global options: +cmd

;; Got answer:

;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 24571

;; flags: qr rd ra; QUERY: 1, ANSWER: 4, AUTHORITY: 0, ADDITIONAL: 4

;; QUESTION SECTION:

;baidu.com. IN NS #查询NS记录

;; ANSWER SECTION:

baidu.com. 5 IN NS ns2.baidu.com.

baidu.com. 5 IN NS ns3.baidu.com.

baidu.com. 5 IN NS ns4.baidu.com.

baidu.com. 5 IN NS dns.baidu.com.

;; ADDITIONAL SECTION:

dns.baidu.com. 5 IN A 202.108.22.220

ns2.baidu.com. 5 IN A 61.135.165.235

ns3.baidu.com. 5 IN A 220.181.37.10

ns4.baidu.com. 5 IN A 220.181.38.10

;; Query time: 3 msec

;; SERVER: 192.168.179.2#53(192.168.179.2)

;; WHEN: Tue Apr 9 22:34:09 2013

;; MSG SIZE rcvd: 163

4.SOA：查询管理域名的服务器管理信息

[root@Centosszm ~]# dig -t SOA baidu.com

; <<>> DiG 9.7.0-P2-RedHat-9.7.0-5.P2.el6 <<>> -t SOA baidu.com

;; global options: +cmd

;; Got answer:

;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 9164

;; flags: qr rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 4, ADDITIONAL: 4

;; QUESTION SECTION:

;baidu.com. IN SOA #查询SOA记录

;; ANSWER SECTION:

baidu.com. 5 IN SOA dns.baidu.com. sa.baidu.com. 2012111456 300 300 2592000 7200

;; AUTHORITY SECTION:

baidu.com. 5 IN NS dns.baidu.com.

baidu.com. 5 IN NS ns2.baidu.com.

baidu.com. 5 IN NS ns3.baidu.com.

baidu.com. 5 IN NS ns4.baidu.com.

;; ADDITIONAL SECTION:

dns.baidu.com. 5 IN A 202.108.22.220

ns2.baidu.com. 5 IN A 61.135.165.235

ns3.baidu.com. 5 IN A 220.181.37.10

ns4.baidu.com. 5 IN A 220.181.38.10

;; Query time: 189 msec

;; SERVER: 192.168.179.2#53(192.168.179.2)

;; WHEN: Tue Apr 9 22:36:12 2013

;; MSG SIZE rcvd: 202

1.Master DNS

2.administrator Email因为@在数据库中是有特别意义的，所以用.取代

3.Serial序号，序号越大越新，Slave以这个序号来判断是否要更新

4.Refresh更新频率：Slave向Master要求数据更新。如果发现序号没有增大，那就不会下载数据库文件

5.Retry失败重新尝试时间：

6.Expire失效时间：

7.Minumum TTL缓存时间：

Refresh>=Retry*2

Refresh+Retry<Expire

Expire>=Retry*10

Expire>=7Days

6.CNAME:设置主机名的别名

如果只有一个主要主机名设置A，而其它的标志使用CNAME，当主机IP变更时，只要修订一个A的标志就可以了，其他的CNAME就跟着变动了，处理起来比较容易。

7.MX：查询某域名的邮件服务器主机名（Mail eXchanger）邮件交换

[root@Centosszm ~]# dig -t mx baidu.com

; <<>> DiG 9.7.0-P2-RedHat-9.7.0-5.P2.el6 <<>> -t mx baidu.com

;; global options: +cmd

;; Got answer:

;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 34841

;; flags: qr rd ra; QUERY: 1, ANSWER: 4, AUTHORITY: 4, ADDITIONAL: 7

;; QUESTION SECTION:

;baidu.com. IN MX

;; ANSWER SECTION:

baidu.com. 5 IN MX 10 mx.mailcdn.baidu.com.

#前面的数字为优先级

baidu.com. 5 IN MX 20 mx1.baidu.com. #越小越优先

baidu.com. 5 IN MX 20 jpmx.baidu.com.

baidu.com. 5 IN MX 20 mx50.baidu.com.

;; AUTHORITY SECTION:

baidu.com. 5 IN NS dns.baidu.com.

baidu.com. 5 IN NS ns2.baidu.com.

baidu.com. 5 IN NS ns3.baidu.com.

baidu.com. 5 IN NS ns4.baidu.com.

;; ADDITIONAL SECTION:

mx1.baidu.com. 5 IN A 61.135.163.61

jpmx.baidu.com. 5 IN A 61.208.132.13

mx50.baidu.com. 5 IN A 220.181.50.208

dns.baidu.com. 5 IN A 202.108.22.220

ns2.baidu.com. 5 IN A 61.135.165.235

ns3.baidu.com. 5 IN A 220.181.37.10

ns4.baidu.com. 5 IN A 220.181.38.10

;; Query time: 68 msec

;; SERVER: 192.168.179.2#53(192.168.179.2)

;; WHEN: Tue Apr 9 23:04:36 2013

;; MSG SIZE rcvd: 300

反解文件记录的RR数据

将IP反过来写，再在结尾加上.in-addr.arpa.（反过来写是为了和域名解析的过程相同）

[root@Centosszm ~]# dig -x 120.114.100.101

; <<>> DiG 9.7.0-P2-RedHat-9.7.0-5.P2.el6 <<>> -x 120.114.100.101

;; global options: +cmd

;; Got answer:

;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 3633

;; flags: qr rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 3, ADDITIONAL: 1

;; QUESTION SECTION:

;101.100.114.120.in-addr.arpa. IN PTR #反向记录

;; ANSWER SECTION:

101.100.114.120.in-addr.arpa. 5 IN PTR www.ksu.edu.tw.

;; AUTHORITY SECTION:

100.114.120.in-addr.arpa. 5 IN NS dns2.ksu.edu.tw.

100.114.120.in-addr.arpa. 5 IN NS dns3.twaren.net.

100.114.120.in-addr.arpa. 5 IN NS dns1.ksu.edu.tw.

;; ADDITIONAL SECTION:

dns3.twaren.net. 5 IN AAAA 2001:e10:5c00:1::47

;; Query time: 1138 msec

;; SERVER: 192.168.179.2#53(192.168.179.2)

;; WHEN: Tue Apr 9 23:14:31 2013

;; MSG SIZE rcvd: 169

例子：

[root@www ~]# hostname

www.Centosszm.com.

[root@www ~]# cat /etc/sysconfig/network

NETWORKING=yes

HOSTNAME=www.Centosszm.com. #主机名，记得加上.

NISDOMAIN=vbirdnis

YPSERV_ARGS="-p 1011"

1.设置配置文件：

[root@www ~]# cat /etc/named.conf

// named.conf

// Provided by Red Hat bind package to configure the ISC BIND named(8) DNS

// server as a caching only nameserver (as a localhost DNS resolver only).

// See /usr/share/doc/bind*/sample/ for example named configuration files.

options {

listen-on port 53 { any; }; #这里是要放行查询的IP

listen-on-v6 port 53 { ::1; };

directory "/var/named";

dump-file "/var/named/data/cache_dump.db";

statistics-file "/var/named/data/named_stats.txt";

memstatistics-file "/var/named/data/named_mem_stats.txt";

allow-query { any; };

recursion yes;

allow-transfer {none;} #不许另人进行Zone转移

};

zone "." IN {

type hint;

file "named.ca";

};

zone "Centosszm.com" IN { #Zone名称

type master; #类型：hint、master、slave

file "named.Centosszm.com"; #文件放在哪里

};

Zone "179.168.192.in-addr.arpa" IN { #Zone名称

type master;

file "named.192.168.179";

};

.DNS最新动态：

ftp://rs.internic.net/domain/named.root

2..数据库文件的设置

本地记录.的文件：

[root@www ~]# cat /var/named/named.ca

; <<>> DiG 9.5.0b2 <<>> +bufsize=1200 +norec NS . @a.root-servers.net

;; global options: printcmd

;; Got answer:

;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 34420

;; flags: qr aa; QUERY: 1, ANSWER: 13, AUTHORITY: 0, ADDITIONAL: 20

;; OPT PSEUDOSECTION:

; EDNS: version: 0, flags:; udp: 4096

;; QUESTION SECTION:

;. IN NS

;; ANSWER SECTION:

. 518400 IN NS M.ROOT-SERVERS.NET.

. 518400 IN NS A.ROOT-SERVERS.NET.

. 518400 IN NS B.ROOT-SERVERS.NET.

. 518400 IN NS C.ROOT-SERVERS.NET.

. 518400 IN NS D.ROOT-SERVERS.NET.

. 518400 IN NS E.ROOT-SERVERS.NET.

. 518400 IN NS F.ROOT-SERVERS.NET.

. 518400 IN NS G.ROOT-SERVERS.NET.

. 518400 IN NS H.ROOT-SERVERS.NET.

. 518400 IN NS I.ROOT-SERVERS.NET.

. 518400 IN NS J.ROOT-SERVERS.NET.

. 518400 IN NS K.ROOT-SERVERS.NET.

. 518400 IN NS L.ROOT-SERVERS.NET.

;; ADDITIONAL SECTION:

A.ROOT-SERVERS.NET. 3600000 IN A 198.41.0.4

A.ROOT-SERVERS.NET. 3600000 IN AAAA 2001:503:ba3e::2:30

B.ROOT-SERVERS.NET. 3600000 IN A 192.228.79.201

C.ROOT-SERVERS.NET. 3600000 IN A 192.33.4.12

D.ROOT-SERVERS.NET. 3600000 IN A 128.8.10.90

E.ROOT-SERVERS.NET. 3600000 IN A 192.203.230.10

F.ROOT-SERVERS.NET. 3600000 IN A 192.5.5.241

F.ROOT-SERVERS.NET. 3600000 IN AAAA 2001:500:2f::f

G.ROOT-SERVERS.NET. 3600000 IN A 192.112.36.4

H.ROOT-SERVERS.NET. 3600000 IN A 128.63.2.53

H.ROOT-SERVERS.NET. 3600000 IN AAAA 2001:500:1::803f:235

I.ROOT-SERVERS.NET. 3600000 IN A 192.36.148.17

J.ROOT-SERVERS.NET. 3600000 IN A 192.58.128.30

J.ROOT-SERVERS.NET. 3600000 IN AAAA 2001:503:c27::2:30

K.ROOT-SERVERS.NET. 3600000 IN A 193.0.14.129

K.ROOT-SERVERS.NET. 3600000 IN AAAA 2001:7fd::1

L.ROOT-SERVERS.NET. 3600000 IN A 199.7.83.42

M.ROOT-SERVERS.NET. 3600000 IN A 202.12.27.33

M.ROOT-SERVERS.NET. 3600000 IN AAAA 2001:dc3::35

;; Query time: 147 msec

;; SERVER: 198.41.0.4#53(198.41.0.4)

;; WHEN: Mon Feb 18 13:29:18 2008

;; MSG SIZE rcvd: 615

3.反向查找区域：

#所有设置数据一定要从行首开始，前面不可有空格符。若有空格符，代表延续前一个Doamin的意思。

#@：代表Zone的意思。这里体表（Centosszm.com下同体表179.168.192.in-addr.arpa）

#一个正解的数据库设置中，至少应该要有$TTL、SOA、NS、NS主要的A。

#$ORGIN:重新定义Zone而不是由named.conf来指定。

#如果主机名字后没有写点，主机的FQDN会变为+Zone的格式。

#前面的数据是IP地址的最后一位的意思

[root@www ~]# cat /var/named/named.192.168.179

$TTL 600

@ IN SOA master.Centosszm.com. www.Centosszm.com. (2013040901 3H 15M 1W 1D)

@ IN NS master.Centosszm.com.

7 IN PTR master.Centosszm.com.

7 IN PTR www.Centosszm.com.

10 IN PTR slave.centos.com.

4.正向查找区域：

[root@www ~]# cat /var/named/named.Centosszm.com

$TTL 600

@ IN SOA master.Centosszm.com. www.Centosszm.com. ( 2013040901 3H 15M 1W 1D )

@ IN NS master.Centosszm.com.

master.Centosszm.com. IN A 192.168.179.7

@ IN MX 10 www.Centosszm.com.

www.Centosszm.com. IN A 192.168.179.7

linux.Centosszm.com. IN CNAME www.Centosszm.com.

ftp.Centosszm.com. IN CNAME www.Centosszm.com.

forum.Centosszm.com. IN CNAME www.centosszm.com.

slave.Centosszm.com. IN A 192.168.179.7

clientlinux.Centosszm.com. IN A 192.168.179.7

5.防火墙设置：

[root@www ~]# iptables -A INPUT -p udp --dport 53 -j ACCEPT

[root@www ~]# iptables -A INPUT -p tcp --dport 53 -j ACCEPT

6.测试成功，如下：

[root@www ~]# vim /etc/resolv.conf

nameserver 192.168.179.7

[root@www ~]# dig master.Centosszm.com

master.Centosszm.com. 600 IN A 192.168.179.7

[root@www ~]# dig www.Centosszm.com

www.Centosszm.com. 600 IN A 192.168.179.7

[root@www ~]# dig ftp.Centosszm.com

ftp.Centosszm.com. 600 IN CNAME www.Centosszm.com.

www.Centosszm.com. 600 IN A 192.168.179.7

协同工作的DNS:Slave DNS及子域授权设定

[root@www ~]# cat /etc/named.conf

// named.conf

// Provided by Red Hat bind package to configure the ISC BIND named(8) DNS

// server as a caching only nameserver (as a localhost DNS resolver only).

// See /usr/share/doc/bind*/sample/ for example named configuration files.

options {

listen-on port 53 { any; };

listen-on-v6 port 53 { ::1; };

directory "/var/named";

dump-file "/var/named/data/cache_dump.db";

statistics-file "/var/named/data/named_stats.txt";

memstatistics-file "/var/named/data/named_mem_stats.txt";

allow-query { any; };

recursion yes;

allow-transfer {none;

};

zone "." IN {

type hint;

file "named.ca";

};

zone "Centosszm.com" IN {

type master;

file "named.Centosszm.com";

allow-transfer {192.168.179.10;}; #加上这一句

};

zone "179.168.192.in-addr.arpa" IN {

type master;

file "named.192.168.179";

allow-transfer {192.168.179.10;}; #加上这一句

};

[root@www ~]# cat /var/named/named.192.168.179

$TTL 600

@ IN SOA master.Centosszm.com. www.Centosszm.com. (2013040901 3H 15M 1W 1D)

@ IN NS master.Centosszm.com.

@ IN NS slave.Centosszm.com. #增加记录

7 IN PTR master.Centosszm.com.

7 IN PTR www.Centosszm.com.

10 IN PTR slave.Centosszm.com. #增加记录

[root@www ~]# cat /var/named/named.Centosszm.com

$TTL 600

@ IN SOA master.Centosszm.com. www.Centosszm.com. ( 2013040901 3H 15M 1W 1D )

@ IN NS master.Centosszm.com.

@ IN NS slave.Centosszm.com. #增加记录

master.Centosszm.com. IN A 192.168.179.7

@ IN MX 10 www.Centosszm.com.

www.Centosszm.com. IN A 192.168.179.7

linux.Centosszm.com. IN CNAME www.Centosszm.com.

ftp.Centosszm.com. IN CNAME www.Centosszm.com.

forum.Centosszm.com. IN CNAME www.centosszm.com.

slave.Centosszm.com. IN A 192.168.179.10 #增加记录

clientlinux.Centosszm.com. IN A 192.168.179.7

[root@www ~]# /etc/init.d/named restart

Stopping named: [ OK ]

Starting named: [ OK ]

Slave DNS的设置与数据库权限问题：

[root@wwwclient ~]# ll -dZ /var/named/slaves/

drwxrwx---. named named system_u:object_r:named_cache_t:s0 /var/named/slaves/

[root@wwwclient ~]# cat /etc/named.conf

// named.conf

// Provided by Red Hat bind package to configure the ISC BIND named(8) DNS

// server as a caching only nameserver (as a localhost DNS resolver only).

// See /usr/share/doc/bind*/sample/ for example named configuration files.

options {

listen-on port 53 { any; };

listen-on-v6 port 53 { ::1; };

directory "/var/named";

dump-file "/var/named/data/cache_dump.db";

statistics-file "/var/named/data/named_stats.txt";

memstatistics-file "/var/named/data/named_mem_stats.txt";

allow-query { any; };

allow-transfer { none;};

recursion yes;

};

logging {

channel default_debug {

file "data/named.run";

severity dynamic;

};

zone "." IN {

type hint;

file "named.ca";

};

zone "Centosszm.com" IN {

type slave;

file "slaves/named.centosszm.com";

masters {192.168.179.7;};

};

zone "179.168.192.in-addr-arpa" IN {

type slave;

file "slaves/named.192.168.179";

masters {192.168.179.7;};

};

[root@wwwclient ~]# /etc/init.d/named start

Generating /etc/rndc.key:^C

[root@wwwclient ~]# rndc-confgen -r /dev/urandom -a

wrote key file "/etc/rndc.key"

[root@wwwclient ~]# /etc/init.d/named start

Starting named: [ OK ]

客户端测试：

[root@wwwclient ~]# dig master.Centosszm.com @127.0.0.1

; <<>> DiG 9.8.2rc1-RedHat-9.8.2-0.17.rc1.el6_4.4 <<>> master.Centosszm.com @127.0.0.1

;; global options: +cmd

;; Got answer:

;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 4218

;; flags: qr aa rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 2, ADDITIONAL: 1

;; QUESTION SECTION:

;master.Centosszm.com. IN A

;; ANSWER SECTION:

master.Centosszm.com. 600 IN A 192.168.179.7

;; AUTHORITY SECTION:

Centosszm.com. 600 IN NS slave.Centosszm.com.

Centosszm.com. 600 IN NS master.Centosszm.com.

;; ADDITIONAL SECTION:

slave.Centosszm.com. 600 IN A 192.168.179.10

;; Query time: 2 msec

;; SERVER: 127.0.0.1#53(127.0.0.1)

;; WHEN: Thu Apr 11 10:01:55 2013

;; MSG SIZE rcvd: 104

[root@www ~]# ll -Z /var/named/named.*

-rw-r--r--. root root unconfined_u:object_r:etc_t:s0 /var/named/named.192.168 .179

[root@www ~]# restorecon /var/named/named.192.168.179

[root@www ~]# ll -Z /var/named/named.*

-rw-r--r--. root root system_u:object_r:named_zone_t:s0 /var/named/named.192.168.179

反向解析还是有问题，未果；

rndc stop

named -u named -g

http://benjamin.sonntag.fr/a37-named_zone_sonntag_eu_org_refused_notify_from_non-master.html

Slave似乎会把没有认证的信息过滤掉；

http://linux.m2osw.com/bind_errors

转载于:https://blog.51cto.com/2816056/1180789

weixin_33859504

关注

0
点赞
踩
1

收藏

觉得还不错? 一键收藏
0
评论
鸟哥学习笔记---DNS

概要：完整主机名：Fully Qualified Domain Name(FQDN)Top Level Domains(TLDs)1.一般顶级域名(Generric TLDs,gTLD)：.com、.org、.gov等2.地区顶级域名(Country Code TLDs,ccTLD)：.uk、.jp、.cn等#每一个上层的DNS服务器的记录的信...
复制链接

扫一扫

鸟哥学习笔记---DNS

“相关推荐”对你有帮助么？