DNS实验

01实现基础DNS服务器

前言

实现简单的访问外部网络功能，只实现基础的DNS转发功能即DNS服务器去访问根服务器来获取URL对应的IP，当然此DNS服务器也具有缓存功能

CentOS

安装 bind DNS

环境说明

hostname	IP	service
DNS	10.0.0.8	bind9

修改 bind DNS 配置文件

修改方式一

[root@DNS ~]# vim /etc/named.conf 
options {
...
    listen-on port 53 { localhost; };  #BIND DNS 不支持 0.0.0.0表示所有IP地址，但提供了 localhost 这个内置关键子来表示所有IP，避免了DNS IP发生变化而导致的问题
...
    allow-query     { any; }; #any表示允许所有人使用此DNS，也可以写成10.0.0.0/24，表示哪个网段访问

修改方式二

将方式一的两行注释掉可以达到和方式一一样的效果

[root@DNS ~]# vim /etc/named.conf 
options {
//  listen-on port 53 { 127.0.0.1; };
...
//  allow-query     { localhost; };
...

启动 bind DNS

#检查配置文件语法是否有误，无报错即表示语法无误
[root@DNS ~]# named-checkconf

#启动bind DNS
[root@DNS ~]# systemctl enable --now named

#如果已经启动 bind DNS 可以用重新加载配置文件的方式来生效
[root@DNS ~]# rndc reload
server reload successful

测试访问

#测试机 DNS 指向 bind DNS
[root@18 ~]# cat /etc/resolv.conf 
# Generated by NetworkManager
nameserver 10.0.0.8

#测试访问
[root@18 ~]# ping -c1 www.baidu.com
PING www.a.shifen.com (39.156.66.18) 56(84) bytes of data.
64 bytes from 39.156.66.18 (39.156.66.18): icmp_seq=1 ttl=128 time=39.4 ms


#查看DNS详细信息，此工具需要安装 bind-utils 包
[root@18 ~]# dig www.baidu.com

; <<>> DiG 9.11.26-RedHat-9.11.26-6.el8 <<>> www.baidu.com
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 9678
;; flags: qr rd ra; QUERY: 1, ANSWER: 3, AUTHORITY: 5, ADDITIONAL: 6

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 1232
; COOKIE: 4f2d39d5cfa505fdd141c1bb61bbf6e6c9d1e28dc580c153 (good)
;; QUESTION SECTION:
;www.baidu.com.			IN	A

;; ANSWER SECTION:
www.baidu.com.		907	IN	CNAME	www.a.shifen.com.
www.a.shifen.com.	9	IN	A	39.156.66.18
www.a.shifen.com.	9	IN	A	39.156.66.14

;; AUTHORITY SECTION:
a.shifen.com.		908	IN	NS	ns4.a.shifen.com.
a.shifen.com.		908	IN	NS	ns1.a.shifen.com.
a.shifen.com.		908	IN	NS	ns5.a.shifen.com.
a.shifen.com.		908	IN	NS	ns2.a.shifen.com.
a.shifen.com.		908	IN	NS	ns3.a.shifen.com.

;; ADDITIONAL SECTION:
ns4.a.shifen.com.	908	IN	A	14.215.177.229
ns1.a.shifen.com.	908	IN	A	110.242.68.42
ns2.a.shifen.com.	908	IN	A	220.181.33.32
ns5.a.shifen.com.	908	IN	A	180.76.76.95
ns3.a.shifen.com.	908	IN	A	112.80.255.253

;; Query time: 0 msec
;; SERVER: 10.0.0.8#53(10.0.0.8)   #DNS SERVER
;; WHEN: Fri Dec 17 18:33:09 CST 2021
;; MSG SIZE  rcvd: 299

Ubuntu

安装 bind DNS

环境说明

hostname	IP	service
dns-server	10.0.0.103	bind9

修改 bind DNS 配置文件

root@dns-server:~# vim /etc/bind/named.conf.options
options {
	directory "/var/cache/bind";

	// If there is a firewall between you and nameservers you want
	// to talk to, you may need to fix the firewall to allow multiple
	// ports to talk.  See http://www.kb.cert.org/vuls/id/800113

	// If your ISP provided one or more IP addresses for stable 
	// nameservers, you probably want to use them as forwarders.  
	// Uncomment the following block, and insert the addresses replacing 
	// the all-0's placeholder.

	// forwarders {
	// 	0.0.0.0;
	// };

	//========================================================================
	// If BIND logs error messages about the root key being expired,
	// you will need to update your keys.  See https://www.isc.org/bind-keys
	//========================================================================
	dnssec-validation auto;

	listen-on-v6 { any; };
	#主要添加以下两行，以下两行所添加的内容和不添加起到一样的效果，但是添加后更便于管理，如修改allow-query可以实现允许指定的网段访问此 dns-server
    listen-on port 53 { localhost; };  #BIND DNS 不支持 0.0.0.0表示所有IP地址，但提供了 localhost 这个内置关键子来表示所有IP，避免了DNS IP发生变化而导致的问题
    allow-query     { any; }; #any表示允许所有人使用此DNS，也可以写成10.0.0.0/24，表示哪个网段访问
};

启动 bind DNS

#检查配置文件语法是否有误，无报错即表示语法无误
root@dns-server:~# named-checkconf

#启动bind DNS
root@dns-server:~# systemctl enable --now named

#如果已经启动 bind DNS 可以用重新加载配置文件的方式来生效
root@dns-server:~# rndc reload
server reload successful

测试访问

#测试机 DNS 指向 bind DNS
[root@client ~]# cat /etc/resolv.conf
# Generated by NetworkManager
nameserver 10.0.0.103


#测试访问
[root@client ~]# ping -c1 www.baidu.com
PING www.a.shifen.com (39.156.66.18) 56(84) bytes of data.
64 bytes from 39.156.66.18 (39.156.66.18): icmp_seq=1 ttl=128 time=39.4 ms

抓包详情

第一次递归查询

[root@client ~]# ping -c1 www.baidu.com
...


root@dns-server:~# tcpdump -nn -i eth0 -p udp port 53
tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
listening on eth0, link-type EN10MB (Ethernet), capture size 262144 bytes

13:55:49.188650 IP 10.0.0.201.48287 > 10.0.0.103.53: 30560+ A? www.baidu.com. (31)
13:55:49.188651 IP 10.0.0.201.48287 > 10.0.0.103.53: 17000+ AAAA? www.baidu.com. (31)
13:55:49.190212 IP 10.0.0.103.42460 > 192.36.148.17.53: 15295 [1au] A? _.com. (46)
13:55:49.204356 IP 192.36.148.17.53 > 10.0.0.103.42460: 15295-| 0/0/1 (62)
13:55:49.237893 IP 10.0.0.103.45329 > 192.55.83.30.53: 4614 [1au] A? _.baidu.com. (52)
13:55:50.033031 IP 10.0.0.103.43593 > 192.48.79.30.53: 53208 [1au] A? _.baidu.com. (52)
13:55:50.318281 IP 192.48.79.30.53 > 10.0.0.103.43593: 53208-| 0/8/2 (500)
13:55:50.903029 IP 10.0.0.103.60356 > 192.5.5.241.53: 18986% [1au] AAAA? ns2.baidu.com. (54)
13:55:50.903580 IP 10.0.0.103.53973 > 192.5.5.241.53: 28016% [1au] AAAA? ns3.baidu.com. (54)
13:55:50.903768 IP 10.0.0.103.60575 > 192.5.5.241.53: 54743% [1au] AAAA? ns4.baidu.com. (54)
13:55:50.905003 IP 10.0.0.103.56928 > 220.181.33.31.53: 31969 [1au] A? www.baidu.com. (54)
13:55:50.905754 IP 10.0.0.103.51524 > 220.181.33.31.53: 15714 [1au] AAAA? www.baidu.com. (54)
13:55:50.906277 IP 10.0.0.103.44491 > 192.5.5.241.53: 6173% [1au] AAAA? ns1.baidu.com. (54)
13:55:50.931898 IP 220.181.33.31.53 > 10.0.0.103.51524: 15714*- 1/0/1 CNAME www.a.shifen.com. (100)
13:55:50.933235 IP 10.0.0.103.34682 > 192.5.6.30.53: 3004 [1au] DS? baidu.com. (50)
13:55:50.937546 IP 220.181.33.31.53 > 10.0.0.103.56928: 31969*- 1/0/1 CNAME www.a.shifen.com. (100)
13:55:50.963119 IP 192.5.5.241.53 > 10.0.0.103.60575: 54743-| 0/0/1 (70)
13:55:50.963303 IP 192.5.5.241.53 > 10.0.0.103.60356: 18986-| 0/0/1 (70)
13:55:50.964550 IP 192.5.5.241.53 > 10.0.0.103.53973: 28016-| 0/0/1 (70)
13:55:50.980943 IP 192.5.5.241.53 > 10.0.0.103.44491: 6173-| 0/0/1 (70)
13:55:51.091720 IP 10.0.0.103.35854 > 192.5.6.30.53: 50414% [1au] AAAA? ns3.baidu.com. (54)
13:55:51.107569 IP 10.0.0.103.42219 > 192.5.6.30.53: 56652% [1au] AAAA? ns2.baidu.com. (54)
13:55:51.108739 IP 10.0.0.103.57578 > 192.5.6.30.53: 62867% [1au] AAAA? ns4.baidu.com. (54)
13:55:51.123836 IP 10.0.0.103.42918 > 192.5.6.30.53: 8029% [1au] AAAA? ns1.baidu.com. (54)
13:55:51.134272 IP 192.5.6.30.53 > 10.0.0.103.34682: 3004*-| 0/4/1 (465)
13:55:51.291901 IP 192.5.6.30.53 > 10.0.0.103.35854: 50414-| 0/8/2 (498)
13:55:51.309516 IP 192.5.6.30.53 > 10.0.0.103.57578: 62867-| 0/8/2 (498)
13:55:51.309516 IP 192.5.6.30.53 > 10.0.0.103.42219: 56652-| 0/8/2 (498)
13:55:51.324922 IP 192.5.6.30.53 > 10.0.0.103.42918: 8029-| 0/8/2 (498)
13:55:51.541271 IP 10.0.0.103.50299 > 192.43.172.30.53: 46317 [1au] DNSKEY? com. (44)
13:55:51.696584 IP 10.0.0.103.39241 > 112.80.248.64.53: 8235% [1au] AAAA? ns3.baidu.com. (54)
13:55:51.711748 IP 10.0.0.103.60378 > 112.80.248.64.53: 29278% [1au] AAAA? ns4.baidu.com. (54)
13:55:51.715616 IP 10.0.0.103.41438 > 112.80.248.64.53: 22620% [1au] AAAA? ns2.baidu.com. (54)
13:55:51.724785 IP 10.0.0.103.60401 > 112.80.248.64.53: 65008% [1au] AAAA? ns1.baidu.com. (54)
13:55:51.747583 IP 112.80.248.64.53 > 10.0.0.103.39241: 8235*- 0/1/1 (113)
13:55:51.756599 IP 192.43.172.30.53 > 10.0.0.103.50299: 46317*-| 2/0/1 DNSKEY, DNSKEY (486)
13:55:51.760245 IP 112.80.248.64.53 > 10.0.0.103.60378: 29278*- 0/1/1 (113)
13:55:51.771611 IP 112.80.248.64.53 > 10.0.0.103.60401: 65008*- 0/1/1 (113)
13:55:51.774317 IP 112.80.248.64.53 > 10.0.0.103.41438: 22620*- 0/1/1 (113)
13:55:52.192882 IP 10.0.0.103.51826 > 192.26.92.30.53: 32638 [1au] A? _.shifen.com. (53)
13:55:52.389703 IP 192.26.92.30.53 > 10.0.0.103.51826: 32638-| 0/7/2 (489)
13:55:52.790441 IP 10.0.0.103.40457 > 14.215.178.80.53: 46329 [1au] A? _.a.shifen.com. (55)
13:55:52.850753 IP 14.215.178.80.53 > 10.0.0.103.40457: 46329- 0/5/8 (297)
13:55:52.851940 IP 10.0.0.103.48320 > 199.9.14.201.53: 11835% [1au] AAAA? ns2.a.shifen.com. (57)
13:55:52.852652 IP 10.0.0.103.51493 > 199.9.14.201.53: 45087% [1au] AAAA? ns4.a.shifen.com. (57)
13:55:52.853212 IP 10.0.0.103.33541 > 14.215.177.229.53: 12398 [1au] A? www.a.shifen.com. (57)
13:55:52.853872 IP 10.0.0.103.48617 > 14.215.177.229.53: 22514 [1au] AAAA? www.a.shifen.com. (57)
13:55:52.854197 IP 10.0.0.103.37306 > 199.9.14.201.53: 21029% [1au] AAAA? ns1.a.shifen.com. (57)
13:55:52.854247 IP 10.0.0.103.38261 > 199.9.14.201.53: 11272% [1au] AAAA? ns3.a.shifen.com. (57)
13:55:52.920048 IP 14.215.177.229.53 > 10.0.0.103.48617: 22514*- 0/1/1 (139)
13:55:52.921197 IP 10.0.0.103.54172 > 192.52.178.30.53: 39310 [1au] DS? shifen.com. (51)
13:55:52.923155 IP 14.215.177.229.53 > 10.0.0.103.33541: 12398*- 2/0/1 A 39.156.66.14, A 39.156.66.18 (105)
13:55:53.192233 IP 192.52.178.30.53 > 10.0.0.103.54172: 39310*-| 0/4/1 (466)
13:55:53.648338 IP 10.0.0.103.39508 > 198.97.190.53.53: 16833% [1au] AAAA? ns2.a.shifen.com. (57)
13:55:53.648655 IP 10.0.0.103.56677 > 198.97.190.53.53: 394% [1au] AAAA? ns4.a.shifen.com. (57)
13:55:53.649193 IP 10.0.0.103.59192 > 198.97.190.53.53: 26688% [1au] AAAA? ns1.a.shifen.com. (57)
13:55:53.650391 IP 10.0.0.103.46140 > 198.97.190.53.53: 33898% [1au] AAAA? ns3.a.shifen.com. (57)
13:55:53.755130 IP 10.0.0.103.53 > 10.0.0.201.48287: 30560 3/0/0 CNAME www.a.shifen.com., A 39.156.66.14, A 39.156.66.18 (93)
13:55:53.755213 IP 10.0.0.103.53 > 10.0.0.201.48287: 17000 1/1/0 CNAME www.a.shifen.com. (118)
13:55:53.783146 IP 10.0.0.201.41854 > 10.0.0.103.53: 52709+ PTR? 14.66.156.39.in-addr.arpa. (43)
13:55:53.785435 IP 10.0.0.103.44809 > 198.97.190.53.53: 27680 [1au] A? _.arpa. (47)
13:55:54.048383 IP 198.97.190.53.53 > 10.0.0.103.39508: 16833-| 0/13/1 (269)
13:55:54.051159 IP 198.97.190.53.53 > 10.0.0.103.46140: 33898-| 0/13/1 (269)
13:55:54.052102 IP 198.97.190.53.53 > 10.0.0.103.56677: 394-| 0/13/1 (269)
13:55:54.187236 IP 198.97.190.53.53 > 10.0.0.103.44809: 27680 NXDomain*-| 0/2/1 (360)
13:55:54.450026 IP 10.0.0.103.43622 > 192.58.128.30.53: 18350% [1au] AAAA? ns1.a.shifen.com. (57)
13:55:54.478698 IP 192.58.128.30.53 > 10.0.0.103.43622: 18350-| 0/13/1 (269)
13:55:54.550722 IP 10.0.0.103.36639 > 192.42.93.30.53: 51022% [1au] AAAA? ns1.a.shifen.com. (57)
13:55:54.763749 IP 192.42.93.30.53 > 10.0.0.103.36639: 51022-| 0/7/2 (493)
13:55:55.197781 IP 10.0.0.103.53383 > 110.242.68.134.53: 56541% [1au] AAAA? ns1.a.shifen.com. (57)
13:55:55.238745 IP 110.242.68.134.53 > 10.0.0.103.53383: 56541- 0/5/8 (295)
13:55:55.240193 IP 10.0.0.103.59498 > 112.80.255.253.53: 49612% [1au] AAAA? ns1.a.shifen.com. (57)
13:55:55.292809 IP 112.80.255.253.53 > 10.0.0.103.59498: 49612*- 0/1/1 (135)
13:55:55.374488 IP 10.0.0.103.45433 > 192.58.128.30.53: 10770% [1au] AAAA? ns2.a.shifen.com. (57)
13:55:55.400054 IP 192.58.128.30.53 > 10.0.0.103.45433: 10770-| 0/13/1 (269)
13:55:55.453315 IP 10.0.0.103.51455 > 192.58.128.30.53: 11315% [1au] AAAA? ns3.a.shifen.com. (57)
13:55:55.469677 IP 10.0.0.103.55742 > 192.33.14.30.53: 19216% [1au] AAAA? ns2.a.shifen.com. (57)
13:55:55.482168 IP 192.58.128.30.53 > 10.0.0.103.51455: 11315-| 0/13/1 (269)
13:55:55.516239 IP 10.0.0.103.39363 > 192.58.128.30.53: 11597% [1au] AAAA? ns4.a.shifen.com. (57)
13:55:55.545765 IP 192.58.128.30.53 > 10.0.0.103.39363: 11597-| 0/13/1 (269)
13:55:55.560437 IP 10.0.0.103.33281 > 192.33.14.30.53: 30641% [1au] AAAA? ns3.a.shifen.com. (57)
13:55:55.617652 IP 10.0.0.103.43095 > 192.33.14.30.53: 55045% [1au] AAAA? ns4.a.shifen.com. (57)
13:55:55.698607 IP 10.0.0.103.50316 > 192.58.128.30.53: 38446 [1au] A? _.arpa. (47)
13:55:55.728648 IP 192.58.128.30.53 > 10.0.0.103.50316: 38446 NXDomain*-| 0/2/1 (360)
13:55:55.736730 IP 192.33.14.30.53 > 10.0.0.103.55742: 19216-| 0/7/2 (493)
13:55:55.799297 IP 10.0.0.103.57359 > 199.7.91.13.53: 27988 [1au] DNSKEY? arpa. (45)
13:55:55.825687 IP 192.33.14.30.53 > 10.0.0.103.33281: 30641-| 0/7/2 (493)
13:55:55.883678 IP 192.33.14.30.53 > 10.0.0.103.43095: 55045-| 0/7/2 (493)
13:55:56.034280 IP 199.7.91.13.53 > 10.0.0.103.57359: 27988*-| 0/0/1 (33)
13:55:56.275677 IP 10.0.0.103.50100 > 110.242.68.134.53: 18467% [1au] AAAA? ns2.a.shifen.com. (73)
13:55:56.317354 IP 110.242.68.134.53 > 10.0.0.103.50100: 18467- 0/5/8 (295)
13:55:56.318725 IP 10.0.0.103.54006 > 110.242.68.42.53: 18830% [1au] AAAA? ns2.a.shifen.com. (57)
13:55:56.358230 IP 110.242.68.42.53 > 10.0.0.103.54006: 18830*- 0/1/1 (139)
13:55:56.361710 IP 10.0.0.103.53852 > 220.181.33.31.53: 16690% [1au] AAAA? ns3.a.shifen.com. (73)
13:55:56.391307 IP 220.181.33.31.53 > 10.0.0.103.53852: 16690- 0/5/8 (295)
13:55:56.392702 IP 10.0.0.103.55955 > 220.181.33.32.53: 10139% [1au] AAAA? ns3.a.shifen.com. (57)
13:55:56.419419 IP 10.0.0.103.59885 > 14.215.178.80.53: 4778% [1au] AAAA? ns4.a.shifen.com. (73)
13:55:56.431985 IP 220.181.33.32.53 > 10.0.0.103.55955: 10139*- 0/1/1 (139)
13:55:56.480338 IP 10.0.0.103.47110 > 192.203.230.10.53: 16546 [1au] DS? arpa. (45)
13:55:56.484491 IP 14.215.178.80.53 > 10.0.0.103.59885: 4778- 0/5/8 (295)
13:55:56.485122 IP 10.0.0.103.34869 > 180.76.76.95.53: 31591% [1au] AAAA? ns4.a.shifen.com. (57)
13:55:56.520302 IP 180.76.76.95.53 > 10.0.0.103.34869: 31591*- 0/1/1 (139)
13:55:56.702334 IP 192.203.230.10.53 > 10.0.0.103.47110: 16546*- 3/0/1 DS, DS, RRSIG (404)
13:55:56.703663 IP 10.0.0.103.56113 > 192.33.4.12.53: 4886 [1au] A? _.in-addr.arpa. (55)
13:55:57.500518 IP 10.0.0.103.40776 > 199.7.83.42.53: 22996 [1au] A? _.in-addr.arpa. (55)
13:55:57.535806 IP 199.7.83.42.53 > 10.0.0.103.40776: 22996-| 0/9/1 (299)
13:55:57.605761 IP 10.0.0.103.42726 > 193.0.9.1.53: 53840 [1au] A? _.39.in-addr.arpa. (58)
13:55:57.912536 IP 193.0.9.1.53 > 10.0.0.103.42726: 53840- 0/6/1 (385)
13:55:57.913354 IP 10.0.0.103.42745 > 193.0.14.129.53: 7791% [1au] A? ns2.apnic.net. (54)
13:55:57.913912 IP 10.0.0.103.44117 > 193.0.14.129.53: 16224% [1au] A? rirns.arin.net. (55)
13:55:57.913974 IP 10.0.0.103.39509 > 193.0.14.129.53: 29658% [1au] AAAA? ns2.apnic.net. (54)
13:55:57.914025 IP 10.0.0.103.52994 > 193.0.14.129.53: 41781% [1au] A? ns3.lacnic.net. (55)
13:55:57.914555 IP 10.0.0.103.51150 > 193.0.14.129.53: 29175% [1au] AAAA? ns3.lacnic.net. (55)
13:55:57.914642 IP 10.0.0.103.47428 > 193.0.14.129.53: 62109% [1au] AAAA? rirns.arin.net. (55)
13:55:57.915014 IP 10.0.0.103.41616 > 193.0.14.129.53: 73% [1au] A? apnic.authdns.ripe.net. (63)
13:55:57.915027 IP 10.0.0.103.37848 > 193.0.14.129.53: 47004% [1au] AAAA? apnic.authdns.ripe.net. (63)
13:55:58.286563 IP 193.0.14.129.53 > 10.0.0.103.51150: 29175-| 0/14/1 (312)
13:55:58.286694 IP 193.0.14.129.53 > 10.0.0.103.44117: 16224-| 0/14/1 (312)
13:55:58.291536 IP 193.0.14.129.53 > 10.0.0.103.41616: 73-| 0/14/1 (320)
13:55:58.291537 IP 193.0.14.129.53 > 10.0.0.103.47428: 62109-| 0/13/1 (264)
13:55:58.291537 IP 193.0.14.129.53 > 10.0.0.103.42745: 7791-| 0/13/1 (263)
13:55:58.292438 IP 193.0.14.129.53 > 10.0.0.103.52994: 41781-| 0/0/1 (43)
13:55:58.294146 IP 193.0.14.129.53 > 10.0.0.103.39509: 29658-| 0/13/1 (263)
13:55:58.298987 IP 193.0.14.129.53 > 10.0.0.103.37848: 47004-| 0/13/1 (272)
13:55:58.787534 IP 10.0.0.201.41854 > 10.0.0.103.53: 52709+ PTR? 14.66.156.39.in-addr.arpa. (43)
13:55:59.036598 IP 10.0.0.103.55009 > 192.31.80.30.53: 61669% [1au] A? rirns.arin.net. (55)
13:55:59.037797 IP 10.0.0.103.56016 > 192.31.80.30.53: 20878% [1au] AAAA? ns3.lacnic.net. (55)
13:55:59.043571 IP 10.0.0.103.57319 > 192.31.80.30.53: 40654% [1au] AAAA? ns2.apnic.net. (54)
13:55:59.045637 IP 10.0.0.103.39322 > 192.31.80.30.53: 47663% [1au] A? ns2.apnic.net. (54)
13:55:59.046542 IP 10.0.0.103.52537 > 192.31.80.30.53: 28834% [1au] A? ns3.lacnic.net. (55)
13:55:59.050201 IP 10.0.0.103.36825 > 192.31.80.30.53: 63063% [1au] A? apnic.authdns.ripe.net. (63)
13:55:59.054191 IP 10.0.0.103.56563 > 192.31.80.30.53: 20970% [1au] AAAA? rirns.arin.net. (55)
13:55:59.057545 IP 10.0.0.103.54120 > 192.31.80.30.53: 35517% [1au] AAAA? apnic.authdns.ripe.net. (63)
13:55:59.235574 IP 192.31.80.30.53 > 10.0.0.103.56016: 20878-| 0/9/3 (486)
13:55:59.236651 IP 192.31.80.30.53 > 10.0.0.103.55009: 61669-| 0/6/8 (504)
13:55:59.241347 IP 192.31.80.30.53 > 10.0.0.103.57319: 40654-| 0/6/7 (503)
13:55:59.242984 IP 192.31.80.30.53 > 10.0.0.103.39322: 47663-| 0/6/7 (503)
13:55:59.244539 IP 192.31.80.30.53 > 10.0.0.103.52537: 28834-| 0/9/3 (486)
13:55:59.248573 IP 192.31.80.30.53 > 10.0.0.103.36825: 63063-| 0/7/5 (502)
13:55:59.254080 IP 192.31.80.30.53 > 10.0.0.103.56563: 20970-| 0/6/8 (504)
13:55:59.258508 IP 192.31.80.30.53 > 10.0.0.103.54120: 35517-| 0/7/5 (502)
13:55:59.631255 IP 10.0.0.103.42625 > 200.3.13.11.53: 3605% [1au] AAAA? ns3.lacnic.net. (55)
13:55:59.631656 IP 10.0.0.103.36502 > 202.12.27.33.53: 9023% [1au] A? a.lactld.org. (53)
13:55:59.631698 IP 10.0.0.103.46767 > 202.12.27.33.53: 20794% [1au] AAAA? a.lactld.org. (53)
13:55:59.633048 IP 10.0.0.103.53261 > 199.5.26.108.53: 37405% [1au] A? rirns.arin.net. (55)
13:55:59.633996 IP 10.0.0.103.49487 > 202.12.27.33.53: 64688% [1au] A? ns2.dns.br. (51)
13:55:59.635261 IP 10.0.0.103.34290 > 202.12.27.33.53: 55259% [1au] AAAA? ns2.dns.br. (51)
13:55:59.639356 IP 10.0.0.103.60875 > 202.12.31.53.53: 8861% [1au] AAAA? ns2.apnic.net. (54)
13:55:59.640207 IP 10.0.0.103.59101 > 202.12.31.53.53: 2486% [1au] A? ns2.apnic.net. (54)
13:55:59.644084 IP 10.0.0.103.44917 > 202.12.31.53.53: 8572% [1au] A? ns3.lacnic.net. (55)
13:55:59.647413 IP 10.0.0.103.55250 > 202.12.31.53.53: 24768% [1au] A? apnic.authdns.ripe.net. (63)
13:55:59.656910 IP 10.0.0.103.50589 > 200.3.13.14.53: 60380% [1au] AAAA? apnic.authdns.ripe.net. (63)
13:55:59.659445 IP 10.0.0.103.43429 > 204.61.216.50.53: 35384% [1au] AAAA? rirns.arin.net. (55)
13:55:59.726539 IP 202.12.27.33.53 > 10.0.0.103.49487: 64688- 0/8/3 (504)
13:55:59.726652 IP 202.12.27.33.53 > 10.0.0.103.46767: 20794-| 0/0/1 (41)
13:55:59.727819 IP 10.0.0.103.42923 > 200.219.159.10.53: 58506% [1au] A? ns2.dns.br. (51)
13:55:59.729879 IP 10.0.0.103.48915 > 192.36.148.17.53: 43442% [1au] A? a.dns.br. (65)
13:55:59.730332 IP 10.0.0.103.54019 > 192.36.148.17.53: 61276% [1au] AAAA? a.dns.br. (65)
13:55:59.730607 IP 10.0.0.103.42868 > 192.36.148.17.53: 21644% [1au] A? c.dns.br. (65)
13:55:59.730769 IP 10.0.0.103.35475 > 192.36.148.17.53: 47763% [1au] AAAA? c.dns.br. (65)
13:55:59.741643 IP 192.36.148.17.53 > 10.0.0.103.48915: 43442- 0/8/13 (760)
13:55:59.742430 IP 192.36.148.17.53 > 10.0.0.103.54019: 61276- 0/8/13 (760)
13:55:59.746003 IP 192.36.148.17.53 > 10.0.0.103.42868: 21644- 0/8/13 (760)
13:55:59.746004 IP 192.36.148.17.53 > 10.0.0.103.35475: 47763- 0/8/13 (760)
13:55:59.746004 IP 202.12.27.33.53 > 10.0.0.103.36502: 9023-| 0/0/1 (41)
13:55:59.749738 IP 202.12.27.33.53 > 10.0.0.103.34290: 55259- 0/8/3 (504)
13:55:59.774862 IP 204.61.216.50.53 > 10.0.0.103.43429: 35384*- 2/0/1 AAAA 2620:38:2000::53, RRSIG (267)
13:55:59.786719 IP 10.0.0.103.53 > 10.0.0.201.41854: 52709 ServFail 0/0/0 (43)
13:55:59.855567 IP 199.5.26.108.53 > 10.0.0.103.53261: 37405*- 2/0/1 A 199.253.249.53, RRSIG (255)
13:55:59.864364 IP 202.12.31.53.53 > 10.0.0.103.44917: 8572*- 2/0/1 A 200.3.13.14, RRSIG (385)
13:55:59.878843 IP 200.219.159.10.53 > 10.0.0.103.42923: 58506*- 2/0/1 A 200.192.232.53, RRSIG (195)
13:55:59.947950 IP 202.12.31.53.53 > 10.0.0.103.59101: 2486*- 2/0/1 A 203.119.95.53, RRSIG (191)
13:55:59.947950 IP 202.12.31.53.53 > 10.0.0.103.60875: 8861*- 2/0/1 AAAA 2001:ddd::53, RRSIG (203)
13:55:59.959106 IP 202.12.31.53.53 > 10.0.0.103.55250: 24768*- 2/0/1 A 193.0.9.9, RRSIG (199)
13:56:00.001078 IP 200.3.13.11.53 > 10.0.0.103.42625: 3605*- 2/0/1 AAAA 2001:13c7:7002:3000::14, RRSIG (397)
13:56:00.087116 IP 200.3.13.14.53 > 10.0.0.103.50589: 60380*- 2/0/1 AAAA 2001:67c:e0::9, RRSIG (211)

第二次递归查询

[root@client ~]# ping -c1 www.baidu.com
...


root@dns-server:~# tcpdump -nn -i eth0 -p udp port 53
tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
listening on eth0, link-type EN10MB (Ethernet), capture size 262144 bytes
13:57:43.598476 IP 10.0.0.201.51413 > 10.0.0.103.53: 41698+ A? www.baidu.com. (31)
13:57:43.598477 IP 10.0.0.201.51413 > 10.0.0.103.53: 39913+ AAAA? www.baidu.com. (31)
13:57:43.599050 IP 10.0.0.103.53 > 10.0.0.201.51413: 41698 3/0/0 CNAME www.a.shifen.com., A 39.156.66.14, A 39.156.66.18 (93)
13:57:43.599285 IP 10.0.0.103.53 > 10.0.0.201.51413: 39913 1/1/0 CNAME www.a.shifen.com. (118)
13:57:43.626930 IP 10.0.0.201.48905 > 10.0.0.103.53: 34917+ PTR? 14.66.156.39.in-addr.arpa. (43)
13:57:43.628728 IP 10.0.0.103.43522 > 199.253.249.53.53: 4513 [1au] A? _.156.39.in-addr.arpa. (62)
13:57:43.856101 IP 199.253.249.53.53 > 10.0.0.103.43522: 4513- 0/4/1 (333)
13:57:43.857201 IP 10.0.0.103.39909 > 192.35.51.30.53: 55324% [1au] A? ns.cnmobile.net. (56)
13:57:43.857894 IP 10.0.0.103.59854 > 192.35.51.30.53: 60693% [1au] AAAA? ns.cnmobile.net. (56)
13:57:43.858423 IP 10.0.0.103.34463 > 192.35.51.30.53: 63720% [1au] A? ns2.cnmobile.net. (57)
13:57:43.859129 IP 10.0.0.103.53343 > 192.35.51.30.53: 13966% [1au] AAAA? ns2.cnmobile.net. (57)
13:57:44.077201 IP 192.35.51.30.53 > 10.0.0.103.59854: 60693-| 0/6/2 (464)
13:57:44.077334 IP 192.35.51.30.53 > 10.0.0.103.39909: 55324-| 0/6/2 (464)
13:57:44.078971 IP 192.35.51.30.53 > 10.0.0.103.34463: 63720-| 0/6/2 (464)
13:57:44.081748 IP 192.35.51.30.53 > 10.0.0.103.53343: 13966-| 0/6/2 (464)
13:57:44.518233 IP 10.0.0.103.53628 > 211.136.17.105.53: 20711% [1au] A? ns.cnmobile.net. (56)
13:57:44.519003 IP 10.0.0.103.60766 > 211.136.20.201.53: 5911% [1au] A? ns2.cnmobile.net. (57)
13:57:44.520353 IP 10.0.0.103.34705 > 211.136.20.201.53: 41680% [1au] AAAA? ns.cnmobile.net. (56)
13:57:44.521041 IP 10.0.0.103.36711 > 211.136.20.201.53: 37507% [1au] AAAA? ns2.cnmobile.net. (57)
13:57:44.545306 IP 211.136.17.105.53 > 10.0.0.103.53628: 20711*- 1/3/8 A 211.136.17.105 (270)
13:57:44.546336 IP 10.0.0.103.34313 > 211.136.20.201.53: 49460 [1au] A? _.66.156.39.in-addr.arpa. (65)
13:57:44.546963 IP 211.136.20.201.53 > 10.0.0.103.34705: 41680*- 1/3/8 AAAA 2409:8080::3 (270)
13:57:44.547524 IP 211.136.20.201.53 > 10.0.0.103.60766: 5911*- 1/3/8 A 211.136.20.201 (270)
13:57:44.549216 IP 211.136.20.201.53 > 10.0.0.103.36711: 37507*- 1/3/8 AAAA 2409:8080::4 (270)
13:57:44.576806 IP 211.136.20.201.53 > 10.0.0.103.34313: 49460- 0/2/1 (111)
13:57:44.578022 IP 10.0.0.103.37901 > 192.12.94.30.53: 27782% [1au] A? dns01.bj.chinamobile.com. (65)
13:57:44.578125 IP 10.0.0.103.41004 > 192.12.94.30.53: 9303% [1au] A? dns02.bj.chinamobile.com. (65)
13:57:44.578261 IP 10.0.0.103.55326 > 192.12.94.30.53: 17839% [1au] AAAA? dns02.bj.chinamobile.com. (65)
13:57:44.578692 IP 10.0.0.103.58728 > 192.12.94.30.53: 21605% [1au] AAAA? dns01.bj.chinamobile.com. (65)
13:57:44.779946 IP 192.12.94.30.53 > 10.0.0.103.55326: 17839-| 0/6/1 (472)
13:57:44.780190 IP 192.12.94.30.53 > 10.0.0.103.41004: 9303-| 0/6/1 (472)
13:57:44.781414 IP 192.12.94.30.53 > 10.0.0.103.37901: 27782-| 0/6/1 (472)
13:57:44.785049 IP 192.12.94.30.53 > 10.0.0.103.58728: 21605-| 0/6/1 (472)
13:57:45.185912 IP 10.0.0.103.37699 > 211.136.17.105.53: 63840% [1au] A? dns01.bj.chinamobile.com. (65)
13:57:45.186488 IP 10.0.0.103.52392 > 211.136.17.105.53: 8215% [1au] AAAA? dns02.bj.chinamobile.com. (65)
13:57:45.187021 IP 10.0.0.103.46850 > 211.136.17.105.53: 29486% [1au] A? dns02.bj.chinamobile.com. (65)
13:57:45.187747 IP 10.0.0.103.49596 > 211.136.17.105.53: 37957% [1au] AAAA? dns01.bj.chinamobile.com. (65)
13:57:45.213871 IP 211.136.17.105.53 > 10.0.0.103.46850: 29486- 0/2/3 (119)
13:57:45.213871 IP 211.136.17.105.53 > 10.0.0.103.52392: 8215- 0/2/3 (119)
13:57:45.214432 IP 10.0.0.103.51175 > 221.130.33.132.53: 1617% [1au] AAAA? dns02.bj.chinamobile.com. (65)
13:57:45.214795 IP 10.0.0.103.35258 > 221.130.33.132.53: 41758% [1au] A? dns02.bj.chinamobile.com. (65)
13:57:45.216473 IP 211.136.17.105.53 > 10.0.0.103.37699: 63840- 0/2/3 (119)
13:57:45.216473 IP 211.136.17.105.53 > 10.0.0.103.49596: 37957- 0/2/3 (119)
13:57:45.217225 IP 10.0.0.103.50497 > 221.130.33.132.53: 39647% [1au] AAAA? dns01.bj.chinamobile.com. (65)
13:57:45.217962 IP 10.0.0.103.53569 > 221.130.33.132.53: 49580% [1au] A? dns01.bj.chinamobile.com. (65)
13:57:45.240150 IP 221.130.33.132.53 > 10.0.0.103.35258: 41758*- 1/0/1 A 221.130.33.132 (69)
13:57:45.241208 IP 10.0.0.103.32849 > 211.136.25.4.53: 12136 [1au] PTR? 14.66.156.39.in-addr.arpa. (66)
13:57:45.242740 IP 221.130.33.132.53 > 10.0.0.103.50497: 39647*- 1/0/1 AAAA 2409:8000:2000:0:190::1 (81)
13:57:45.242740 IP 221.130.33.132.53 > 10.0.0.103.51175: 1617*- 1/0/1 AAAA 2409:8000:2000:0:90::1 (81)
13:57:45.245123 IP 221.130.33.132.53 > 10.0.0.103.53569: 49580*- 1/0/1 A 211.136.25.4 (69)
13:57:45.270223 IP 211.136.25.4.53 > 10.0.0.103.32849: 12136 NXDomain*- 0/1/1 (119)
13:57:45.271254 IP 10.0.0.103.46081 > 200.10.60.53.53: 32696 [1au] DNSKEY? in-addr.arpa. (53)
13:57:46.072082 IP 10.0.0.103.49221 > 196.216.169.10.53: 26782 [1au] DNSKEY? in-addr.arpa. (53)
13:57:46.565312 IP 196.216.169.10.53 > 10.0.0.103.49221: 26782*-| 0/0/1 (41)
13:57:47.537772 IP 10.0.0.103.55198 > 193.0.9.9.53: 57661 [1au] DS? 156.39.in-addr.arpa. (60)
13:57:47.841369 IP 193.0.9.9.53 > 10.0.0.103.55198: 57661*- 0/4/1 (440)
13:57:47.842158 IP 10.0.0.103.44032 > 203.119.95.53.53: 11916 [1au] DNSKEY? 39.in-addr.arpa. (56)
13:57:48.112424 IP 203.119.95.53.53 > 10.0.0.103.44032: 11916*-| 0/0/1 (72)
13:57:48.635369 IP 10.0.0.201.48905 > 10.0.0.103.53: 34917+ PTR? 14.66.156.39.in-addr.arpa. (43)
13:57:48.670464 IP 10.0.0.103.53 > 10.0.0.201.48905: 34917 NXDomain 0/0/0 (43)

第三次查询，缓存返回结果

[root@client ~]# ping -c1 www.baidu.com
...

root@dns-server:~# tcpdump -nn -i eth0 -p udp port 53
14:00:17.303198 IP 10.0.0.201.50477 > 10.0.0.103.53: 18013+ A? www.baidu.com. (31)
14:00:17.303198 IP 10.0.0.201.50477 > 10.0.0.103.53: 40801+ AAAA? www.baidu.com. (31)
14:00:17.303534 IP 10.0.0.103.53 > 10.0.0.201.50477: 18013 3/0/0 CNAME www.a.shifen.com., A 39.156.66.14, A 39.156.66.18 (93)
14:00:17.303665 IP 10.0.0.103.53 > 10.0.0.201.50477: 40801 1/1/0 CNAME www.a.shifen.com. (118)
14:00:17.331653 IP 10.0.0.201.59444 > 10.0.0.103.53: 29256+ PTR? 14.66.156.39.in-addr.arpa. (43)
14:00:17.332677 IP 10.0.0.103.47508 > 211.136.25.4.53: 30955 [1au] PTR? 14.66.156.39.in-addr.arpa. (66)
14:00:17.359647 IP 211.136.25.4.53 > 10.0.0.103.47508: 30955 NXDomain*- 0/1/1 (119)
14:00:17.360714 IP 10.0.0.103.53 > 10.0.0.201.59444: 29256 NXDomain 0/0/0 (43)

dig 采集详情

此工具需要安装 bind-utils 包

[root@client ~]# dig www.baidu.com

; <<>> DiG 9.11.36-RedHat-9.11.36-3.el8 <<>> www.baidu.com
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 4028
;; flags: qr rd ra; QUERY: 1, ANSWER: 3, AUTHORITY: 0, ADDITIONAL: 1

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 4096
; COOKIE: 32e41ffe022a1e5c0100000062c3d5c133d8f1d7b25804d4 (good)
;; QUESTION SECTION:
;www.baidu.com.			IN	A

;; ANSWER SECTION:
www.baidu.com.		343	IN	CNAME	www.a.shifen.com.
www.a.shifen.com.	240	IN	A	39.156.66.18
www.a.shifen.com.	240	IN	A	39.156.66.14

;; Query time: 1 msec
;; SERVER: 10.0.0.103#53(10.0.0.103)
;; WHEN: Tue Jul 05 14:10:09 CST 2022
;; MSG SIZE  rcvd: 132

02实现正向主DNS服务器

实现正向主DNS服务器

正向则表示将域名解析成IP
管理和维护所负责解析的域内解析库的服务器

环境说明

hostname	IP	service
dns-server	10.0.0.103	bind9

创建区域数据库

每个域名对应一个区域数据库
区域数据库由众多资源记录（Resource Record, RR）组成
数据库名称没有要求，但为了区分建议见名知意

查看区域数据库存放位置

# /etc/bind/named.conf
options {
	directory "/var/cache/bind"; # 区域数据库应该存放的位置，centos默认为/var/named
...

创建区域数据库

# CentOS
# 拷贝区域数据库模板文件（也可以直接创建）
[root@DNS ~]# cd /var/named/
[root@DNS named]# cp -a named.localhost xiangzheng.com.zone


# Ubuntu
#创建区域数据库（Ubuntu 以 bind 结尾会有着色功能）
root@dns-server:~# touch /var/cache/bind/xiangzheng.com.zone.bind

更改区域数据库权限

每个Linux发行版的默认权限不一样，最好参考其他区域数据库的默认权限来进行配置，下面以Ubuntu举例

# 查看默认权限
root@dns-server:~# ll /var/cache/bind/
total 28
drwxrwxr-x  4 root bind 4096 Jul  5 16:13 ./
drwxr-xr-x 16 root root 4096 Jul  4 23:52 ../
drwxrwx---  2 root bind 4096 Feb 28  2020 dynamic/
drwxrwx---  2 root bind 4096 Feb 28  2020 dyndb-ldap/
-rw-r--r--  1 bind bind  821 Jul  5 13:54 managed-keys.bind
-rw-r--r--  1 bind bind 3041 Jul  5 13:54 managed-keys.bind.jnl
-rw-r--r--  1 root root  267 Jul  5 16:10 xiangzheng.com.zone.bind


# 修改权限
root@dns-server:~# chown bind.bind /var/cache/bind/xiangzheng.com.zone.bind

配置基础区域数据库

root@dns-server:~# vim /var/cache/bind/xiangzheng.com.zone.bind
$TTL 600
@   IN    SOA    ns1    mail.xiangzheng.com. (
            2015042201 ;
            1H ;
            10M ;
            1D ;
            12H ;
            )
@         NS   ns1
ns1       A    10.0.0.103

修改主配置文件

Ubuntu

# 查看子配置文件位置
root@dns-server:~# cat /etc/bind/named.conf
...
include "/etc/bind/named.conf.options";
include "/etc/bind/named.conf.local";
include "/etc/bind/named.conf.default-zones"; #写到这里



# 将配置写到子配置文件中
root@dns-server:~# vim /etc/bind/named.conf.default-zones
// prime the server with knowledge of the root servers
zone "." {
    type hint;
    file "/usr/share/dns/root.hints";
};

zone "xiangzheng.com" { #因为是域名，所以无需加www，www表示主机名
    type master;
    file "/var/cache/bind/xiangzheng.com.zone.bind";
};



// be authoritative for the localhost forward and reverse zones, and for
// broadcast zones as per RFC 1912
...

CentOS

/etc/named.conf

	allow-transfer { none; }; # 安全加固，不允许任何人来抓取数据
zone "." IN {
    type hint;
    file "named.ca";
};

include "/etc/named.rfc1912.zones"; # 通常都是写到子配置文件中，便于管理↓
include "/etc/named.root.key";

/etc/named.rfc1912.zones

...
zone "xiangzheng.com" IN { # 域名，所以不用加www
    type master;
    file "xiangzheng.com.zone"; # 配置文件直接写相对路径即可，不用写绝对路径（相对于/var/named/）
};

检查配置文件语法后启动DNS

# 检查配置文件语法
named-checkconf 

# 检查区域数据库的语法，第一个xiangzheng.com表示在配置文件中定义的名称，第三段表示区域数据库文件路径
named-checkzone xiangzheng.com /var/cache/bind/xiangzheng.com.zone.bind


# 语法无误后 重启name服务
rndc reload

测试

[root@client ~]# cat /etc/resolv.conf 
# Generated by NetworkManager
nameserver 10.0.0.103


[root@client ~]# ping ns1.xiangzheng.com
PING ns1.xiangzheng.com (10.0.0.103) 56(84) bytes of data.
64 bytes from 10.0.0.103 (10.0.0.103): icmp_seq=1 ttl=64 time=0.520 ms


[root@client ~]# dig ns1.xiangzheng.com

; <<>> DiG 9.11.36-RedHat-9.11.36-3.el8 <<>> ns1.xiangzheng.com
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 59413
#flags中的aa表示信息来自权威DNS服务器
;; flags: qr aa rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 1

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 4096
; COOKIE: 6f8ee524a76f31070100000062c40605d1daf16b0f690b20 (good)
;; QUESTION SECTION:
;ns1.xiangzheng.com.		IN	A #查询的问题，ns1.xiangzheng.com.对应的A记录是多少

;; ANSWER SECTION:
ns1.xiangzheng.com.	600	IN	A	10.0.0.103 #查询的结果，ns1.xiangzheng.com.对应的A记录是10.0.0.103，TTL为600秒

;; Query time: 1 msec
;; SERVER: 10.0.0.103#53(10.0.0.103) #向哪个DNS服务器查询的
;; WHEN: Tue Jul 05 17:36:05 CST 2022
;; MSG SIZE  rcvd: 91

区域数据库添加其它记录

准备测试web

此处仅作演示，生产中页面应该都是统一的

[root@18 ~]# yum -y install nginx
[root@28 ~]# yum -y install nginx
[root@18 ~]# echo '10.0.0.18 page' > /usr/share/nginx/html/index.html
[root@28 ~]# echo '10.0.0.28 page' > /usr/share/nginx/html/index.html
[root@18 ~]# systemctl enable --now nginx
[root@28 ~]# systemctl enable --now nginx

www A 记录

目前情况

# 目前记录
root@dns-server:~# cat /var/cache/bind/xiangzheng.com.zone.bind
$TTL 600
@   IN    SOA    ns1    mail.xiangzheng.com. (
            2015042201 ;
            1H ;
            10M ;
            1D ;
            12H ;
            )
@         NS   ns1
ns1       A    10.0.0.103


# 目前记录的解析情况
[root@client ~]# host www.xiangzheng.com
Host www.xiangzheng.com not found: 3(NXDOMAIN) #找不到，因为没有 www 记录
[root@client ~]# ping www.xiangzheng.com
ping: www.xiangzheng.com: Name or service not known #找不到，因为没有 www 记录
[root@client ~]# host ns1.xiangzheng.com #找得到，因为有 ns1 这个主机记录
ns1.xiangzheng.com has address 10.0.0.103
[root@client ~]# ping ns1.xiangzheng.com
PING ns1.xiangzheng.com (10.0.0.103) 56(84) bytes of data.
64 bytes from 10.0.0.103 (10.0.0.103): icmp_seq=1 ttl=64 time=0.484 ms #找得到，因为有 ns1 这个主机记录

添加记录

# 添加 www 的 A 记录
root@dns-server:~# cat /var/cache/bind/xiangzheng.com.zone.bind
$TTL 600
@   IN    SOA    ns1    mail.xiangzheng.com. (
            2015042201 ;
            1H ;
            10M ;
            1D ;
            12H ;
            )
@         NS   ns1
ns1       A    10.0.0.103
www       A    10.0.0.18 #添加 www 记录


root@dns-server:~# named-checkzone xiangzheng.com /var/cache/bind/xiangzheng.com.zone.bind
zone xiangzheng.com/IN: loaded serial 2015042201
OK


root@dns-server:~# rndc reload
server reload successful

测试

[root@client ~]# host www.xiangzheng.com
www.xiangzheng.com has address 10.0.0.18 #找得到，因为有 www 记录

[root@client ~]# ping www.xiangzheng.com
PING www.xiangzheng.com (10.0.0.18) 56(84) bytes of data. #找得到，因为有 www 记录

* A 记录

泛域名解析

目前情况

# 目前区域数据得记录
root@dns-server:~# cat /var/cache/bind/xiangzheng.com.zone.bind
$TTL 600
@   IN    SOA    ns1    mail.xiangzheng.com. (
            2015042201 ;
            1H ;
            10M ;
            1D ;
            12H ;
            )
@         NS   ns1
ns1       A    10.0.0.103
www       A    10.0.0.18


[root@client ~]# host moewqomewqoewq.xiangzheng.com
Host moewqomewqoewq.xiangzheng.com not found: 3(NXDOMAIN) #找不到，因为没有 * 记录

[root@client ~]# ping dsaoewqo.xiangzheng.com
ping: dsaoewqo.xiangzheng.com: Name or service not known #找不到，因为没有 * 记录

添加记录

# 添加 www 的 A 记录
root@dns-server:~# cat /var/cache/bind/xiangzheng.com.zone.bind
$TTL 600
@   IN    SOA    ns1    mail.xiangzheng.com. (
            2015042201 ;
            1H ;
            10M ;
            1D ;
            12H ;
            )
@         NS   ns1
ns1       A    10.0.0.103
www       A    10.0.0.18
*         A    10.0.0.18 #添加 * 记录


root@dns-server:~# named-checkzone xiangzheng.com /var/cache/bind/xiangzheng.com.zone.bind
zone xiangzheng.com/IN: loaded serial 2015042201
OK


root@dns-server:~# rndc reload
server reload successful

测试

[root@client ~]# host moewqomewqoewq.xiangzheng.com
moewqomewqoewq.xiangzheng.com has address 10.0.0.18 #找得到，因为有 * 记录

[root@client ~]# ping dsaoewqo.xiangzheng.com
PING dsaoewqo.xiangzheng.com (10.0.0.18) 56(84) bytes of data. #找得到，因为有 * 记录

@ A 记录

泛域名解析

目前情况

# 目前区域数据得记录
root@dns-server:~# cat /var/cache/bind/xiangzheng.com.zone.bind
$TTL 600
@   IN    SOA    ns1    mail.xiangzheng.com. (
            2015042201 ;
            1H ;
            10M ;
            1D ;
            12H ;
            )
@         NS   ns1
ns1       A    10.0.0.103
www       A    10.0.0.18
*         A    10.0.0.18


[root@client ~]# host xiangzheng.com
   #无内容，因为没有 @ 记录
[root@client ~]# ping xiangzheng.com
ping: xiangzheng.com: Name or service not known #找不到，因为没有 @ 记录

添加记录

# 添加 www 的 A 记录
root@dns-server:~# cat /var/cache/bind/xiangzheng.com.zone.bind
$TTL 600
@   IN    SOA    ns1    mail.xiangzheng.com. (
            2015042201 ;
            1H ;
            10M ;
            1D ;
            12H ;
            )
@         NS   ns1
ns1       A    10.0.0.103
www       A    10.0.0.18
*         A    10.0.0.18
@         A    10.0.0.18 #添加 @ 记录


root@dns-server:~# named-checkzone xiangzheng.com /var/cache/bind/xiangzheng.com.zone.bind
zone xiangzheng.com/IN: loaded serial 2015042201
OK


root@dns-server:~# rndc reload
server reload successful

测试

[root@client ~]# host xiangzheng.com
xiangzheng.com has address 10.0.0.18 #找得到，因为有 @ 记录
[root@client ~]# ping xiangzheng.com
PING xiangzheng.com (10.0.0.18) 56(84) bytes of data. #找得到，因为有 @ 记录

CNAME

添加记录

# 修改区域数据库文件
root@dns-server:~# vim /var/cache/bind/xiangzheng.com.zone.bind
$TTL 600
@   IN    SOA    ns1    mail.xiangzheng.com. (
            2015042201 ;
            1H ;
            10M ;
            1D ;
            12H ;
            )
@         NS   ns1
ns1       A    10.0.0.103
www       CNAME websrv #添加CNAME
#添加下面两行以实现泛域名解析是错误得，只能将上面得 www 改为 * 或 @
#*         CNAME websrv
#@         CNAME websrv
websrv    A    10.0.0.18 #指向第一个webserver
websrv    A    10.0.0.28 #指向第二个webserver


#检查区域数据库的语法
named-checkzone xiangzheng.com /var/cache/bind/xiangzheng.com.zone.bind


#语法无误后 重启name服务
rndc reload

测试

#配置DNS
[root@client ~]# cat /etc/resolv.conf 
# Generated by NetworkManager
nameserver 10.0.0.103


#可以实现一定程度的负载均衡
[root@client ~]]# curl www.xiangzheng.com
10.0.0.18 page
[root@client ~]# curl www.xiangzheng.com
10.0.0.28 page
[root@client ~]# curl www.xiangzheng.com
10.0.0.18 page


#使用 ping 测试
[root@client ~]# ping www.xiangzheng.com
PING websrv.xiangzheng.com (10.0.0.28) 56(84) bytes of data.
...
[root@client ~]# ping www.xiangzheng.com
PING websrv.xiangzheng.com (10.0.0.28) 56(84) bytes of data.
...
[root@client ~]# ping www.xiangzheng.com
PING websrv.xiangzheng.com (10.0.0.18) 56(84) bytes of data.
...


#查看对应的DNS解析记录
[root@client ~]# host www.xiangzheng.com
www.xiangzheng.com is an alias for websrv.xiangzheng.com.
websrv.xiangzheng.com has address 10.0.0.18
websrv.xiangzheng.com has address 10.0.0.28



#专业工具查看对应的DNS解析记录
[root@client ~]# dig www.xiangzheng.com
...
;; flags: qr aa rd ra; QUERY: 1, ANSWER: 3, AUTHORITY: 0, ADDITIONAL: 1

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 4096
; COOKIE: fed522b6041d059f0100000062c40c2f4c2304eaed63f3a9 (good)
;; QUESTION SECTION: #请求的
;www.xiangzheng.com.		IN	A #www.xiangzheng.com.对应的A记录是什么？

;; ANSWER SECTION: #解析出来的
www.xiangzheng.com.	600	IN	CNAME	websrv.xiangzheng.com. #www.xiangzheng.com.是一个CNAME，也就是别名，这个别名是 websrv.xiangzheng.com.
websrv.xiangzheng.com.	600	IN	A	10.0.0.18 #websrv.xiangzheng.com.对应的第一个记录
websrv.xiangzheng.com.	600	IN	A	10.0.0.28 #websrv.xiangzheng.com.对应的第二个记录

;; Query time: 1 msec
;; SERVER: 10.0.0.103#53(10.0.0.103)
;; WHEN: Tue Jul 05 18:02:23 CST 2022
;; MSG SIZE  rcvd: 128

MX

添加记录

root@dns-server:~# vim /var/cache/bind/xiangzheng.com.zone.bind
$TTL 600
@   IN    SOA    ns1    mail.xiangzheng.com. (
            2015042201 ;
            1H ;
            10M ;
            1D ;
            12H ;
            )
@         NS   ns1
@         NS   ns2
ns1       A    10.0.0.103
ns2       A    10.0.0.104
@         MX   10  mailsrv #MX记录，10表示优先级 数字越小优先级越高
@         MX   20  mailsrv2 #MX记录冗余
mailsrv   A    10.0.0.66 #mailsrv对应的A记录
mailsrv2  A    10.0.0.88 #mailsrv2对应的A记录

测试

[root@client ~]# host xiangzheng.com
xiangzheng.com mail is handled by 20 mailsrv2.xiangzheng.com.
xiangzheng.com mail is handled by 10 mailsrv.xiangzheng.com.


#查看域名或IP对应的邮件服务器地址
[root@client ~]# dig -t mx xiangzheng.com

; <<>> DiG 9.11.36-RedHat-9.11.36-3.el8 <<>> -t mx xiangzheng.com
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 7628
;; flags: qr aa rd ra; QUERY: 1, ANSWER: 2, AUTHORITY: 0, ADDITIONAL: 3

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 4096
; COOKIE: 8b0749eac4a760580100000062c419dc8a7cd04843820d01 (good)
;; QUESTION SECTION:
;xiangzheng.com.			IN	MX

;; ANSWER SECTION:
xiangzheng.com.		600	IN	MX	10 mailsrv.xiangzheng.com.
xiangzheng.com.		600	IN	MX	20 mailsrv2.xiangzheng.com.

;; ADDITIONAL SECTION:
mailsrv.xiangzheng.com.	600	IN	A	10.0.0.66
mailsrv2.xiangzheng.com. 600	IN	A	10.0.0.88

;; Query time: 0 msec
;; SERVER: 10.0.0.103#53(10.0.0.103)
;; WHEN: Tue Jul 05 19:00:44 CST 2022
;; MSG SIZE  rcvd: 152

DNS 冗余

是这样解决吗？

root@dns-server:~# vim /var/cache/bind/xiangzheng.com.zone.bind
$TTL 600
@   IN    SOA    ns1    mail.xiangzheng.com. (
            2015042201 ;
            1H ;
            10M ;
            1D ;
            12H ;
            )
@         NS   ns1
@         NS   ns2
ns1       A    10.0.0.103
ns2       A    10.0.0.104


[root@client ~]# host ns1.xiangzheng.com
ns1.xiangzheng.com has address 10.0.0.103
[root@client ~]# host ns2.xiangzheng.com
ns2.xiangzheng.com has address 10.0.0.104

03实现正向主从DNS服务器

环境说明

hostname	IP	service
dns-master	10.0.0.103	bind9
dns-slave	10.0.0.104	bind9

主DNS配置

主DNS注意事项：

与从DNS时间同步
与从DNS bind 版本一致
设置只允许从服务器进行区域传输（否则默认任何人都可以从DNS数据库中抓取内容或同步区域数据库）
主服务器的区域解析库文件中必须有一条NS记录指向从服务器

# 区域数据库文件
# /var/cache/bind/xiangzheng.com.zone.bind
$TTL 600
@   IN    SOA    ns1    mail.xiangzheng.com. (
            2015042201 ;
            1H ;
            10M ;
            1D ;
            12H ;
            )
@         NS   ns1
@         NS   ns2 #主服务器的区域解析库文件中必须有一条NS记录指向从服务器
ns1       A    10.0.0.103
ns2       A    10.0.0.104 #主服务器的区域解析库文件中必须有一条NS记录指向从服务器
@         A    10.0.0.66


# named 配置文件
# /etc/bind/named.conf
include "/etc/bind/named.conf.options";
include "/etc/bind/named.conf.local";
include "/etc/bind/named.conf.default-zones";


# named 子配置文件
# /etc/bind/named.conf.options
options {
	directory "/var/cache/bind";
...
	dnssec-validation auto;

	listen-on-v6 { any; };
    listen-on port 53 { localhost; };
    allow-query     { any; };
    allow-transfer { 10.0.0.104; }; #设置只允许从服务器进行区域传输
};


# 区域数据库配置文件
# /etc/bind/named.conf.default-zones 
// prime the server with knowledge of the root servers
zone "." {
	type hint;
	file "/usr/share/dns/root.hints";
};

zone "xiangzheng.com" {
    type master; #类型为master
    file "/var/cache/bind/xiangzheng.com.zone.bind";
};
...

从DNS配置

从DNS注意事项：

04实现反向主DNS服务器

前言

反向则表示将IP解析成域名
应用场景有邮件服务等（通过反向解析来判断是否是一个合法的邮件服务器，从而避免垃圾邮件）

建立反向解析数据库

[root@DNS ~]# vim /var/named/10.0.0.reverse.zone
$TTL 1D
@   IN   SOA    ns1.xiangzheng.org.  rootroot25.163.com. ( 1 12H 10M 3D 1D )
         NS     ns1.xiangzheng.org.
7        PTR      websrv.xiangzheng.org.
123      PTR      mailsrv.xiangzheng.org.

在配置文件中添加

#子配置文件添加，方便管理
[root@DNS named]# cat /etc/named.conf |grep -i include
include "/etc/named.rfc1912.zones";

[root@DNS ~]# vim /etc/named.rfc1912.zones 
zone "0.0.10.in-addr.arpa" IN {
    type master;
    file "10.0.0.reverse.zone";
};


#检查数据库语法是否错误
[root@DNS ~]# named-checkzone 0.0.10.in-addr.arpa /var/named/10.0.0.reverse.zone 
zone 0.0.10.in-addr.arpa/IN: loaded serial 1
OK

#检查配置文件是否有误
[root@DNS ~]# named-checkconf 

#检查无误后重新加载配置文件
[root@DNS ~]# rndc reload
server reload successful

测试反向解析

#-t ptr 表示指定类型为ptr记录，或者也可用使用dig -x 10.0.0.7 这样就不用反着写了
[root@18 ~]# dig -t ptr 7.0.0.10.in-addr.arpa

; <<>> DiG 9.11.26-RedHat-9.11.26-6.el8 <<>> -t ptr 7.0.0.10.in-addr.arpa
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 14810
;; flags: qr aa rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 1, ADDITIONAL: 2

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 1232
; COOKIE: 511665a682ca568baa4c296c61bce6bd2167747f82432afd (good)
;; QUESTION SECTION:
;7.0.0.10.in-addr.arpa.		IN	PTR

;; ANSWER SECTION:
7.0.0.10.in-addr.arpa.	86400	IN	PTR	websrv.xiangzheng.org.

;; AUTHORITY SECTION:
0.0.10.in-addr.arpa.	86400	IN	NS	ns1.xiangzheng.org.

;; ADDITIONAL SECTION:
ns1.xiangzheng.org.	86400	IN	A	10.0.0.8

;; Query time: 1 msec
;; SERVER: 10.0.0.8#53(10.0.0.8)
;; WHEN: Sat Dec 18 03:36:29 CST 2021
;; MSG SIZE  rcvd: 147

05实现子域

子域概述

假设子域 sh.xiangzheng.com（上海子域），那么：

com 为根的子域
xiangzheng.com， xiangzheng 为 com 的子域
sh.xiangzheng.com，sh 为 xiangzheng 的子域

子域范例

将子域委派给其它主机管理，实现分布式DNS数据库
定义两个自愈

#定义两个子域区域
shanghai.magedu.org.     IN NS ns1.shanghai.magedu.org.
shanghai.magedu.org.     IN NS ns2.shanghai.magedu.org.
shenzhen.magedu.org.     IN NS ns1.shenzhen.magedu.org.
shenzhen.magedu.org.     IN NS ns2.shenzhen.magedu.org.
ns1.shanghai.magedu.org. IN A  1.1.1.1
ns2.shanghai.magedu.org. IN A  1.1.1.2
ns1.shenzhen.magedu.org. IN A  1.1.1.3
ns2.shenzhen.magedu.org. IN A  1.1.1.4


#上面内容 可简写成：
shanghai     IN NS ns1.shanghai
shanghai     IN NS ns2.shanghai
shenzhen     IN NS ns1.shenzhen
shenzhen     IN NS ns2.shenzhen
ns1.shanghai IN A  1.1.1.1
ns2.shanghai IN A  1.1.1.2
ns1.shenzhen IN A  1.1.1.3
ns2.shenzhen IN A  1.1.1.4

环境说明

hostname	IP	service	role	OS
dns-master	10.0.0.103	bind9	主DNS	Ubuntu
dns-slave	10.0.0.104	bind9	从DNS	Ubuntu
sh-dns-master	10.0.0.18	bind9	上海子域主DNS	CentOS
sh-dns-slave	10.0.0.28	bind9	上海子域从DNS	CentOS

主DNS配置

主DNS上配置子域（也就是在父域上设置）

# 区域数据库文件
# /var/cache/bind/xiangzheng.com.zone.bind
$TTL 600
@   IN    SOA    ns1    mail.xiangzheng.com. (
            2015042202 ;
            1H ;
            10M ;
            1D ;
            12H ;
            )
@         NS   ns1
@         NS   ns2
sh        NS   ns3 #加一条NS记录设置sh为新的子域，并命名为ns3（sh的完整写法其实是 sh.xiangzheng.com.）
ns1       A    10.0.0.103
ns2       A    10.0.0.104
ns3       A    10.0.0.18 #将ns3设为A记录，并指向IP地址，即sh子域的IP地址
@         A    10.0.0.77




# named 配置文件
# /etc/bind/named.conf
include "/etc/bind/named.conf.options";
include "/etc/bind/named.conf.local";
include "/etc/bind/named.conf.default-zones";


# named 子配置文件
# /etc/bind/named.conf.options
options {
	directory "/var/cache/bind";
...
	dnssec-validation auto;

	listen-on-v6 { any; };
    listen-on port 53 { localhost; };
    allow-query     { any; };
    allow-transfer { 10.0.0.104; }; #设置只允许从服务器进行区域传输
};


# 区域数据库配置文件
# /etc/bind/named.conf.default-zones 
// prime the server with knowledge of the root servers
zone "." {
	type hint;
	file "/usr/share/dns/root.hints";
};

zone "xiangzheng.com" {
    type master; #类型为master
    file "/var/cache/bind/xiangzheng.com.zone.bind";
};
...

从DNS配置

# named 配置文件
# /etc/bind/named.conf
include "/etc/bind/named.conf.options";
include "/etc/bind/named.conf.local";
include "/etc/bind/named.conf.default-zones";


# named 子配置文件
# /etc/bind/named.conf.options
options {
	directory "/var/cache/bind";
...
	dnssec-validation auto;

	listen-on-v6 { any; };
    listen-on port 53 { localhost; };
    allow-query     { any; };
    allow-transfer {  none; }; #设置不允许其它主机进行区域传输
};


# 区域数据库配置文件
# /etc/bind/named.conf.default-zones 
// prime the server with knowledge of the root servers
zone "." {
	type hint;
	file "/usr/share/dns/root.hints";
};

zone "xiangzheng.com" {
    type slave; #类型为slave
    masters {10.0.0.103;}; #指向主DNS的IP
    file "/var/cache/bind/xiangzheng.com.zone.bind.slave"; #此文件无需创建，会自动生成，为加以区分最后可以加个.slave，
};
...

上海子域主DNS配置

# named 子配置文件
# /etc/named.conf
...
options {
    listen-on port 53 { localhost; };
...
    allow-query     { any; };
    allow-transfer { 10.0.0.28; }; #设置只允许从服务器进行区域传输
...



# 区域数据库文件
# /var/named/sh.xiangzheng.com.zone
$TTL 600
@   IN    SOA    ns1    mail.xiangzheng.com. (
            2015042202 ;
            1H ;
            10M ;
            1D ;
            12H ;
            )
@         NS   ns1
@         NS   ns2
ns1       A    10.0.0.18
ns2       A    10.0.0.28
@         A    10.0.0.123




# 区域数据库配置文件
# /etc/named.rfc1912.zones
...
zone "sh.xiangzheng.com" { #定义为sh子域
    type master; #类型为master
    file "sh.xiangzheng.com.zone";

};
...


# 修改区域数据库权限
chgrp named /var/named/sh.xiangzheng.com.zone

#检查区域数据库的语法，第一个xiangzheng.org表示在配置文件中定义的名称
named-checkzone sh.xiangzheng.com /var/named/sh.xiangzheng.com.zone


#检查配置文件语法
named-checkconf 


#语法无误后 启动name服务
systemctl enable --now named
#或
#语法无误后 重启name服务
rndc reload

上海子域从DNS配置

# named 子配置文件
# /etc/named.conf
...
options {
    listen-on port 53 { localhost; };
...
    allow-query     { any; };
    allow-transfer { none; }; #设置不允许其它主机进行区域传输
...



# 区域数据库文件
不用配置，因为会自动向主DNS拉取




# 区域数据库配置文件
# /etc/named.rfc1912.zones
...
zone "sh.xiangzheng.com" {
    type slave; #类型为slave
    masters {10.0.0.18;}; #指向主DNS的IP
    file "slaves/sh.xiangzheng.com.zone.slave";

};
...




#检查配置文件语法
named-checkconf 


#语法无误后 启动name服务
systemctl enable --now named
#或
#语法无误后 重启name服务
rndc reload

客户端测试

[root@client ~]# dig sh.xiangzheng.com @10.0.0.18

; <<>> DiG 9.11.36-RedHat-9.11.36-3.el8 <<>> sh.xiangzheng.com @10.0.0.18
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 38203
;; flags: qr aa rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 2, ADDITIONAL: 3

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 1232
; COOKIE: bbdca7534c3c6d51455adee362c46dc32bea62fa4ede9f07 (good)
;; QUESTION SECTION:
;sh.xiangzheng.com.		IN	A

;; ANSWER SECTION:
sh.xiangzheng.com.	600	IN	A	10.0.0.123

;; AUTHORITY SECTION:
sh.xiangzheng.com.	600	IN	NS	ns1.sh.xiangzheng.com.
sh.xiangzheng.com.	600	IN	NS	ns2.sh.xiangzheng.com.

;; ADDITIONAL SECTION:
ns1.sh.xiangzheng.com.	600	IN	A	10.0.0.18
ns2.sh.xiangzheng.com.	600	IN	A	10.0.0.28

;; Query time: 0 msec
;; SERVER: 10.0.0.18#53(10.0.0.18)
;; WHEN: Wed Jul 06 00:58:43 CST 2022
;; MSG SIZE  rcvd: 158



[root@client ~]# host sh.xiangzheng.com 10.0.0.18
Using domain server:
Name: 10.0.0.18
Address: 10.0.0.18#53
Aliases: 

sh.xiangzheng.com has address 10.0.0.123
[root@client ~]# host sh.xiangzheng.com 10.0.0.28
Using domain server:
Name: 10.0.0.28
Address: 10.0.0.28#53
Aliases: 

sh.xiangzheng.com has address 10.0.0.123

子域授权

每个域的名称服务器，都是通过其上级名称服务器在解析库进行授权,类似根域授权tld glue record：粘合记录，父域授权子域的记录

06实现DNS转发(缓存）

前言

利用DNS转发，可以将用户的DNS请求，转发至指定的DNS服务，而非默认的根DNS服务器，并将指定服务器查询的返回结果进行缓存，提高效率。

注意事项

被转发的服务器需要能够为请求者做递归，否则转发请求不予进行
在全局配置块中，关闭dnssec功能
```
dnssec-enable no;
dnssec-validation no;
```

转发方式

first：先转发至指定DNS服务器，如果无法解析查询请求，则本服务器再去根服务器查询
only：先转发至指定DNS服务器，如果无法解析查询请求，则本服务器将不再去根服务器查询

全局转发

对非本机所负责解析区域的请求，全转发给指定的服务器
常用
在全局配置块中实现：

Options {
...
   forward first|only;
   forwarders { ip;};
...
};

特定区域转发

仅转发对特定的区域的请求，比全局转发优先级高
不常用
在区域数据库配置文件中实现：

zone "ZONE_NAME" IN {
   type forward;
   forward first|only;
   forwarders { ip;};
};

实现 DNS 转发

环境说明

dns-forward 服务器也应该实现高可用，具体实现方法？？？

hostname	IP	service	role	OS
dns-forward	10.0.0.18	bind9	dns转发服务器	CentOS
dns-master	10.0.0.103	bind9	主DNS	Ubuntu

dns-master 配置

# 区域数据库文件
root@dns-master:~# cat /var/cache/bind/xiangzheng.com.zone.bind
$TTL 600
@   IN    SOA    ns1    mail.xiangzheng.com. (
            2015042204 ;
            1H ;
            10M ;
            1D ;
            12H ;
            )
@         NS   ns1
@         NS   ns2
ns1       A    10.0.0.103
ns2       A    10.0.0.104
@         A    10.0.0.77

实现前客户端测试

# 使用公网的公共DNS测试是否能实现解析自己的网站
[root@client ~]# host xiangzheng.vip 223.5.5.5
Using domain server:
Name: 223.5.5.5
Address: 223.5.5.5#53
Aliases: 

xiangzheng.vip has address 8.140.166.135


# xiangzheng.com 直接从根服务器迭代查询了
[root@client ~]# host xiangzheng.com 10.0.0.18
Using domain server:
Name: 10.0.0.18
Address: 10.0.0.18#53
Aliases: 

xiangzheng.com is an alias for overdue.aliyun.com.
overdue.aliyun.com has address 170.33.9.230

dns-forward 实现转发

以全局转发的方式实现转发

# 只需在全局配置块添加以下配置即可
[root@dns-forward ~]# vim /etc/named.conf 
options {
    listen-on port 53 { localhost; }; #或者注释也许
...
    allow-query     { any; }; #或者注释也行
    forward first; #first表示转发的服务器如果查询不到则去根服务器查询
    forwarders { 10.0.0.103;}; #转发的DNS服务器IP
...
    dnssec-enable no; #no
    dnssec-validation no; #no
...


#检查配置文件
[root@dns-forward ~]# named-checkconf 


#重新加载配置文件
[root@dns-forward ~]# rndc reload
server reload successful

实现后客户端测试

# 如果目标DNS服务器有记录，则会直接返回结果
[root@client ~]# host xiangzheng.com 10.0.0.18
Using domain server:
Name: 10.0.0.18
Address: 10.0.0.18#53
Aliases: 

xiangzheng.com has address 10.0.0.77


# 如果目标DNS服务器没有记录，则转发服务器会向根服务器发起迭代查询
[root@client ~]# host xiangzheng.vip 10.0.0.18
Using domain server:
Name: 10.0.0.18
Address: 10.0.0.18#53
Aliases: 

xiangzheng.vip has address 8.140.166.135

---------------------------------

#当主dns服务器停掉
root@dns-master:~# poweroff 


#还是可以解析，因为 forward-dns 会有缓存
[root@client ~]# host xiangzheng.com 10.0.0.18
Using domain server:
Name: 10.0.0.18
Address: 10.0.0.18#53
Aliases: 

xiangzheng.com has address 10.0.0.77

---------------------

#当 forward-dns 清理掉缓存
[root@dns-forward ~]# rndc flush

# 又会去根服务器迭代查询
[root@client ~]# host xiangzheng.com 10.0.0.18
Using domain server:
Name: 10.0.0.18
Address: 10.0.0.18#53
Aliases: 

xiangzheng.com is an alias for overdue.aliyun.com.
overdue.aliyun.com has address 170.33.9.230

07实现Internet的DNS服务架构

实验环境

10.0.0.7  #客户端
10.0.0.17 #本地DNS(只缓存)
10.0.0.8  #转发DNS(forward)
10.0.0.18 #根DNS
10.0.0.28 #父域(org)DNS
10.0.0.38 #子域DNS(主)
10.0.0.48 #子域DNS(从)
10.0.0.58 #web服务器

选择从下到上的方式搭建方便测试
从上到下搭建没有办法进行测试，因为假如先搭建了转发服务器而其他服务器没有搭建将没有办法测试转发

前期准备

关闭SElinux
关闭防火墙
时间同步

web服务器配置

[root@web-server ~]# yum -y install nginx ; systemctl enable --now nginx ; echo 10.0.0.58 page > /usr/share/nginx/html/index.html

测试：

#因为没有配置域名和IP间的记录，所以只能用IP来测试
[root@client ~]#curl 10.0.0.58
10.0.0.58 page

主DNS配置

#安装bind dns
[root@master-dns ~]# yum -y install bind

#修改主配置文件
[root@master-dns ~]# vim /etc/named.conf 
...
options {
//  listen-on port 53 { 127.0.0.1; };
...
//  allow-query     { localhost; };
	allow-transfer { 10.0.0.48; }; #安全加固，只允许从节点10.0.0.48来抓取数据
...

#修改子配置文件，设置域名和区域数据库位置
[root@master-dns ~]# vim /etc/named.rfc1912.zones 
zone "xiangzheng.org" IN { #设置xiangzheng.org的域名
    type master;
    file "xiangzheng.org.zone"; #指定区域数据库的名称
};

#创建数据库内容
[root@master-dns ~]# cd /var/named/
[root@master-dns named]# cp -a named.localhost xiangzheng.org.zone
[root@master-dns named]# vim xiangzheng.org.zone
$TTL 1D
@   IN SOA  master rootroot25.163.com. (
                    1   ; serial
                    1D  ; refresh
                    1H  ; retry
                    1W  ; expire
                    3H )    ; minimum
@       NS   master
@       NS   slave
master  A    10.0.0.38
slave   A    10.0.0.48
www     A    10.0.0.58

#检查语法（named-checkzone 命令需要安装 bind-utils包）
[root@master-dns named]# named-checkzone xiangzheng.org xiangzheng.org.zone 
zone xiangzheng.org/IN: loaded serial 1
OK
[root@master-dns named]# named-checkconf

#生效
systemctl enable --now named #第一次启动服务
rndc reload                  #不是第一次启动服务

测试：

[root@client ~]#host www.xiangzheng.org 10.0.0.38
Using domain server:
Name: 10.0.0.38
Address: 10.0.0.38#53
Aliases: 

www.xiangzheng.org has address 10.0.0.58

从DNS配置

[root@slave-dns ~]# yum -y install bind bind-utils

#修改主配置文件
[root@slave-dns ~]# vim /etc/named.conf
...
options {
//  listen-on port 53 { 127.0.0.1; };
...
//  allow-query     { localhost; };
	allow-transfer { none; }; #安全加固，不允许任何人来抓取数据
...

#修改子配置文件
[root@slave-dns ~]# vim /etc/named.rfc1912.zones
zone "xiangzheng.org" IN {
    type slave;
    masters { 10.0.0.38; };
    file "slaves/xiangzheng.org.zone.slave";
};

#检查语法
[root@slave-dns ~]# named-checkconf

#生效
systemctl enable --now named #第一次启动服务
rndc reload                  #不是第一次启动服务

#更新主库数据库版本，并重新加载配置文件
[root@master-dns named]# vim xiangzheng.org.zone
...
                    2   ; serial
...
[root@master-dns named]# rndc reload
server reload successful

#查看从库文件是否出现
[root@slave-dns ~]# ll /var/named/slaves/
total 4
-rw-r--r-- 1 named named 353 Dec 19 10:45 xiangzheng.org.zone.slave

测试：

[root@client ~]#host www.xiangzheng.org 10.0.0.48
Using domain server:
Name: 10.0.0.48
Address: 10.0.0.48#53
Aliases: 

www.xiangzheng.org has address 10.0.0.58

[root@client ~]#dig  www.xiangzheng.org @10.0.0.48

; <<>> DiG 9.11.4-P2-RedHat-9.11.4-26.P2.el7_9.8 <<>> www.xiangzheng.org @10.0.0.48
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 33573
;; flags: qr aa rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 2, ADDITIONAL: 3

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 1232
;; QUESTION SECTION:
;www.xiangzheng.org.		IN	A

;; ANSWER SECTION:
www.xiangzheng.org.	86400	IN	A	10.0.0.58

;; AUTHORITY SECTION:
xiangzheng.org.		86400	IN	NS	slave.xiangzheng.org.
xiangzheng.org.		86400	IN	NS	master.xiangzheng.org.

;; ADDITIONAL SECTION:
master.xiangzheng.org.	86400	IN	A	10.0.0.38
slave.xiangzheng.org.	86400	IN	A	10.0.0.48

;; Query time: 1 msec
;; SERVER: 10.0.0.48#53(10.0.0.48)
;; WHEN: Sun Dec 19 11:17:33 CST 2021
;; MSG SIZE  rcvd: 136

父域(org)DNS配置

[root@org-dns ~]# yum -y install bind bind-utils

#修改主配置文件
[root@org-dns ~]# vim /etc/named.conf
...
options {
//  listen-on port 53 { 127.0.0.1; };
...
//  allow-query     { localhost; };
	allow-transfer { none; }; #安全加固，不允许任何人来抓取数据
...

#修改子配置文件
[root@org-dns ~]# vim /etc/named.rfc1912.zones
...
zone "org" IN {
    type master;
    file "org.zone";
};
...

#创建数据库内容
[root@org-dns ~]# cd /var/named/   
[root@org-dns named]# cp -a named.localhost org.zone
[root@org-dns named]# vim org.zone
$TTL 1D
@   IN        SOA   master rootroot25.163.com. (
                    0   ; serial
                    1D  ; refresh
                    1H  ; retry
                    1W  ; expire
                    3H )    ; minimum
@             NS   master
xiangzheng    NS xiangzhengns1
xiangzheng    NS xiangzhengns2
master        A    10.0.0.28
xiangzhengns1 A 10.0.0.38
xiangzhengns2 A 10.0.0.48

#检查语法
[root@org-dns named]# named-checkzone org /var/named/org.zone 
zone org/IN: loaded serial 0
OK
[root@org-dns named]# named-checkconf

#生效
systemctl enable --now named #第一次启动服务
rndc reload                  #不是第一次启动服务

测试：

[root@client ~]#host www.xiangzheng.org 10.0.0.28
Using domain server:
Name: 10.0.0.28
Address: 10.0.0.28#53
Aliases: 

www.xiangzheng.org has address 10.0.0.58
[root@client ~]#dig  www.xiangzheng.org @10.0.0.28

; <<>> DiG 9.11.4-P2-RedHat-9.11.4-26.P2.el7_9.8 <<>> www.xiangzheng.org @10.0.0.28
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 46852
;; flags: qr rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 2, ADDITIONAL: 3

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 1232
;; QUESTION SECTION:
;www.xiangzheng.org.		IN	A

;; ANSWER SECTION:
www.xiangzheng.org.	86385	IN	A	10.0.0.58

;; AUTHORITY SECTION:
xiangzheng.org.		86400	IN	NS	xiangzhengns1.org.
xiangzheng.org.		86400	IN	NS	xiangzhengns2.org.

;; ADDITIONAL SECTION:
xiangzhengns1.org.	86400	IN	A	10.0.0.38
xiangzhengns2.org.	86400	IN	A	10.0.0.48

;; Query time: 0 msec
;; SERVER: 10.0.0.28#53(10.0.0.28)
;; WHEN: Sun Dec 19 11:15:30 CST 2021
;; MSG SIZE  rcvd: 151

根DNS配置

[root@root-dns ~]# yum -y install bind bind-utils

#修改主配置文件
root@root-dns ~]# vim /etc/named.conf
...
options {
//  listen-on port 53 { 127.0.0.1; };
...
//  allow-query     { localhost; };
...
zone "." IN {
    type master; #修改根为主
    file "root.zone"; #指定根DNS区域数据库文件
};
...

#修改区域数据库文件
[root@root-dns ~]# cd /var/named/
[root@root-dns named]# vim root.zone 
$TTL 1D  
@           IN  SOA master rootroot25.163.com.  ( 1 1D 1H 1W 3D )
@               NS  master
org             NS  orgns
master          A   10.0.0.18
orgns           A   10.0.0.28

#检查语法
[root@root-dns named]# named-checkzone . root.zone 
zone ./IN: loaded serial 1
OK
[root@root-dns named]# named-checkconf

#生效
systemctl enable --now named #第一次启动服务
rndc reload                  #不是第一次启动服务

测试：

[root@client ~]#host www.xiangzheng.org 10.0.0.18
Using domain server:
Name: 10.0.0.18
Address: 10.0.0.18#53
Aliases: 

www.xiangzheng.org has address 10.0.0.58

[root@client ~]#dig www.xiangzheng.org @10.0.0.18

; <<>> DiG 9.11.4-P2-RedHat-9.11.4-26.P2.el7_9.8 <<>> www.xiangzheng.org @10.0.0.18
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 52622
;; flags: qr rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 2, ADDITIONAL: 3

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 1232
;; QUESTION SECTION:
;www.xiangzheng.org.		IN	A

;; ANSWER SECTION:
www.xiangzheng.org.	86378	IN	A	10.0.0.58

;; AUTHORITY SECTION:
xiangzheng.org.		86378	IN	NS	xiangzhengns2.org.
xiangzheng.org.		86378	IN	NS	xiangzhengns1.org.

;; ADDITIONAL SECTION:
xiangzhengns1.org.	86378	IN	A	10.0.0.38
xiangzhengns2.org.	86378	IN	A	10.0.0.48

;; Query time: 0 msec
;; SERVER: 10.0.0.18#53(10.0.0.18)
;; WHEN: Sun Dec 19 11:41:49 CST 2021
;; MSG SIZE  rcvd: 151

转发DNS配置

[root@forward-dns ~]# yum -y install bind bind-utils

#修改主配置文件
[root@forward-dns ~]#vim /etc/named.conf
options {
//      listen-on port 53 { 127.0.0.1; }; #注释掉
...
//      allow-query     { localhost; }; #注释掉
...
		#关闭dnsec功能，否则会影响转发，此功能和安全加密有关，生产环境不常用
        dnssec-enable no;
        dnssec-validation no;
...
};

#修改区域数据库文件
[root@forward-dns ~]# vim /var/named/named.ca
.           518400  IN  NS  a.root-servers.net.
a.root-servers.net. 518400  IN  A   10.0.0.18

#检查语法
[root@root-dns named]# named-checkconf

#生效
systemctl enable --now named #第一次启动服务
rndc reload                  #不是第一次启动服务

测试：

[root@client ~]#host www.xiangzheng.org 10.0.0.8
Using domain server:
Name: 10.0.0.8
Address: 10.0.0.8#53
Aliases: 

www.xiangzheng.org has address 10.0.0.58

[root@client ~]#dig www.xiangzheng.org @10.0.0.8

; <<>> DiG 9.11.4-P2-RedHat-9.11.4-26.P2.el7_9.8 <<>> www.xiangzheng.org @10.0.0.8
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 38906
;; flags: qr rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 2, ADDITIONAL: 3

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 1232
;; QUESTION SECTION:
;www.xiangzheng.org.		IN	A

;; ANSWER SECTION:
www.xiangzheng.org.	86384	IN	A	10.0.0.58

;; AUTHORITY SECTION:
xiangzheng.org.		86384	IN	NS	xiangzhengns1.org.
xiangzheng.org.		86384	IN	NS	xiangzhengns2.org.

;; ADDITIONAL SECTION:
xiangzhengns1.org.	86384	IN	A	10.0.0.38
xiangzhengns2.org.	86384	IN	A	10.0.0.48

;; Query time: 1 msec
;; SERVER: 10.0.0.8#53(10.0.0.8)
;; WHEN: Sun Dec 19 12:01:24 CST 2021
;; MSG SIZE  rcvd: 151

本地只缓存DNS配置

[root@local-dns ~]#yum -y install bind bind-utils

#修改主配置文件
[root@forward-dns ~]#vim /etc/named.conf
options {
//      listen-on port 53 { 127.0.0.1; }; #注释掉
...
//      allow-query     { localhost; }; #注释掉
...

        forward only; #设置转发类型为only
        forwarders { 10.0.0.8;}; #设置转发的主DNS服务IP
		#关闭dnsec功能
        dnssec-enable no;
        dnssec-validation no;
...
};

#检查语法
[root@root-dns named]# named-checkconf

#生效
systemctl enable --now named #第一次启动服务
rndc reload                  #不是第一次启动服务

客户端测试

[root@client ~]#cat /etc/resolv.conf
# Generated by NetworkManager
nameserver 10.0.0.17
[root@client ~]#curl www.xiangzheng.org
10.0.0.58 page

[root@client ~]#host www.xiangzheng.org 10.0.0.17
Using domain server:
Name: 10.0.0.17
Address: 10.0.0.17#53
Aliases: 

www.xiangzheng.org has address 10.0.0.58

[root@client ~]#dig www.xiangzheng.org @10.0.0.17

; <<>> DiG 9.11.4-P2-RedHat-9.11.4-26.P2.el7_9.8 <<>> www.xiangzheng.org @10.0.0.17
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 39117
;; flags: qr rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 2, ADDITIONAL: 3

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 4096
;; QUESTION SECTION:
;www.xiangzheng.org.		IN	A

;; ANSWER SECTION:
www.xiangzheng.org.	85684	IN	A	10.0.0.58

;; AUTHORITY SECTION:
xiangzheng.org.		85684	IN	NS	xiangzhengns2.org.
xiangzheng.org.		85684	IN	NS	xiangzhengns1.org.

;; ADDITIONAL SECTION:
xiangzhengns2.org.	85684	IN	A	10.0.0.48
xiangzhengns1.org.	85684	IN	A	10.0.0.38

;; Query time: 0 msec
;; SERVER: 10.0.0.17#53(10.0.0.17)
;; WHEN: Sun Dec 19 12:13:04 CST 2021
;; MSG SIZE  rcvd: 151

测试2

#停掉主节点，并在前面的DNS服务器清理缓存测试是否能访问
[root@master-dns named]# systemctl stop named
[root@local-dns ~]#rndc flush
[root@forward-dns ~]# rndc flush
[root@root-dns named]# rndc flush
[root@org-dns named]# rndc flush
#测试访问
[root@client ~]#curl www.xiangzheng.org
10.0.0.58 page
[root@client ~]#dig www.xiangzheng.org @10.0.0.17

; <<>> DiG 9.11.4-P2-RedHat-9.11.4-26.P2.el7_9.8 <<>> www.xiangzheng.org @10.0.0.17
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 30583
;; flags: qr rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 1

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 4096
;; QUESTION SECTION:
;www.xiangzheng.org.		IN	A

;; ANSWER SECTION:
www.xiangzheng.org.	86397	IN	A	10.0.0.58

;; Query time: 1 msec
;; SERVER: 10.0.0.17#53(10.0.0.17)
;; WHEN: Sun Dec 19 12:17:42 CST 2021
;; MSG SIZE  rcvd: 63

CDN与智能DNS

GSLB

GSLB：Global Server Load Balance全局负载均衡
GSLB是对服务器和链路进行综合判断来决定由哪个地点的服务器来提供服务，实现异地服务器群服务质量的保证
GSLB主要的目的是在整个网络范围内将用户的请求定向到最近的节点（或者区域）
GSLB分为基于DNS实现、基于重定向实现、基于路由协议实现，其中最通用的是基于DNS解析方式

CDN 概述

Content distribution network 内容分发网络
CDN 的实现主要就是依赖了智能 DNS

CDN工作原理

用户向浏览器输入www.a.com这个域名，浏览器第一次发现本地没有dns缓存，则向网站的DNS服务器请求
网站的DNS域名解析器设置了CNAME，指向了www.a.tbcdn.com,请求指向了CDN网络中的智能DNS负载均衡系统
智能DNS负载均衡系统解析域名，把对用户响应速度最快的IP节点返回给用户；
用户向该IP节点（CDN服务器）发出请求
由于是第一次访问，CDN服务器会通过Cache内部专用DNS解析得到此域名的原web站点IP，向原站点服务器发起请求，并在CDN服务器上缓存内容
请求结果发给用户

CDN 服务商

服务商：阿里，腾讯，蓝汛，网宿，帝联等
智能DNS: dnspod dns.la

范例：京东使用的CDN

# 使用谷歌的DNS服务器来查询京东的DNS解析信息
# dig www.jd.com @8.8.8.8

; <<>> DiG 9.11.36-RedHat-9.11.36-3.el8 <<>> www.jd.com @8.8.8.8
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 65152
;; flags: qr rd ra; QUERY: 1, ANSWER: 4, AUTHORITY: 0, ADDITIONAL: 1

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 512
;; QUESTION SECTION:
;www.jd.com.			IN	A

;; ANSWER SECTION:
www.jd.com.		61	IN	CNAME	www.jd.com.gslb.qianxun.com. #指向了CDN的CNAME
www.jd.com.gslb.qianxun.com. 55	IN	CNAME	jd-abroad.cdn20.com. #指向了CDN的CNAME
jd-abroad.cdn20.com.	32	IN	A	222.34.55.166 #分配的就近CDN节点，吉林省四平市 铁通
jd-abroad.cdn20.com.	32	IN	A	111.43.178.111 #分配的就近CDN节点，黑龙江省哈尔滨市 移动

;; Query time: 65 msec
;; SERVER: 8.8.8.8#53(8.8.8.8)
;; WHEN: Wed Jul 06 18:31:36 CST 2022
;; MSG SIZE  rcvd: 139

实现智能DNS（CDN）

详参PDF
生成中我们只需将域名指向CDN服务商的CNAME即可，掏钱就行了

DNS排错

DNS 排错工具

以下工具全部来自 bind9-utils 包

host

简单的 dns 检测工具

语法

host [-t type] name [SERVER]

范例

# 测试否能实现 DNS 解析
# host www.baidu.com
www.baidu.com is an alias for www.a.shifen.com.
www.a.shifen.com has address 39.156.66.18
www.a.shifen.com has address 39.156.66.14


#测试140.205.41.21这个DNS服务器能否直接将xiangzheng.vip的IP解析出来
# host xiangzheng.vip 140.205.41.21
Using domain server:
Name: 140.205.41.21
Address: 140.205.41.21#53
Aliases: 

xiangzheng.vip has address 8.140.166.135



host -t NS magedu.org 172.16.0.1
host -t soa magedu.org
host -t mx magedu.org
host -t axfr magedu.org
host 1.2.3.4

dig

专业的 dns 检测工具
dig只用于测试dns系统，不会查询hosts文件进行解析

语法

dig [-t type] name [@SERVER] [query options]
query options：
 +[no]trace：跟踪解析过程 : dig +trace magedu.org
 +[no]recurse：进行递归解析

范例

# 测试否能实现 DNS 解析
dig xiangzheng.vip


#测试140.205.41.21这个DNS服务器能否直接将xiangzheng.vip的IP解析出来，aa表示可以(权威DNS服务器)
dig xiangzheng.vip @140.205.41.21


#查看域名或IP对应的邮件服务器地址
dig -t mx 邮件服务器的域名或IP


#抓取目标DNS的所有记录（对安全加固的DNS服务器无效）
[root@client ~]# dig -t axfr xiangzheng.com @10.0.0.103

; <<>> DiG 9.11.36-RedHat-9.11.36-3.el8 <<>> -t axfr xiangzheng.com @10.0.0.103
;; global options: +cmd
xiangzheng.com.		600	IN	SOA	ns1.xiangzheng.com. mail.xiangzheng.com. 2015042201 3600 600 86400 43200
xiangzheng.com.		600	IN	NS	ns1.xiangzheng.com.
xiangzheng.com.		600	IN	NS	ns2.xiangzheng.com.
ns1.xiangzheng.com.	600	IN	A	10.0.0.103
ns2.xiangzheng.com.	600	IN	A	10.0.0.104
xiangzheng.com.		600	IN	SOA	ns1.xiangzheng.com. mail.xiangzheng.com. 2015042201 3600 600 86400 43200
;; Query time: 1 msec
;; SERVER: 10.0.0.103#53(10.0.0.103)
;; WHEN: Tue Jul 05 20:49:42 CST 2022
;; XFR size: 6 records (messages 1, bytes 216)



#测试反向解析
dig -x IP = dig –t ptr reverseip.in-addr.arpa

#模拟区域传送
dig -t axfr ZONE_NAME @SERVER
dig -t axfr magedu.org @10.10.10.11
dig –t axfr 100.1.10.in-addr.arpa @172.16.1.1
dig -t NS . @114.114.114.114
dig -t NS . @a.root-servers.net

nslookup

dns 检测工具
此工具 Windows 也支持

语法

#命令格式
nslookup [-option] [name | -] [server]


#交互模式
 nslookup>
 server IP: 指明使用哪个DNS server进行查询
 set q=RR_TYPE: 指明查询的资源记录类型
 NAME: 要查询的名称

范例

# 测试否能实现 DNS 解析
# nslookup xiangzheng.vip
Server:		223.5.5.5 #DNS服务器的地址
Address:	223.5.5.5#53

Non-authoritative answer:
Name:	xiangzheng.vip
Address: 8.140.166.135


#测试140.205.41.21这个DNS服务器能否直接将xiangzheng.vip的IP解析出来
# nslookup xiangzheng.vip 140.205.41.21
Server:		140.205.41.21 #DNS服务器的地址
Address:	140.205.41.21#53

Name:	xiangzheng.vip
Address: 8.140.166.135

rndc

利用rndc工具可以实现管理DNS功能
rndc 监听端口: 953/tcp

语法

# 语法
rndc COMMAND


# COMMAND:
 status #查看状态
 reload #重载主配置文件和区域解析库文件
 reload zonename #重载区域解析库文件
 retransfer zonename #手动启动区域传送，而不管序列号是否增加
 notify zonename #重新对区域传送发通知
 reconfig #重载主配置文件
 querylog #开启或关闭查询日志文件/var/log/message
 trace #递增debug一个级别
 trace LEVEL #指定使用的级别
 notrace #将调试级别设置为 0
 flush#清空DNS服务器的所有缓存记录

Ubuntu查看DNS

resolvectl status
#或
systemd-resolve --status

-

DNS排错

范例1

dig A example.com

; <<>> DiG 9.9.4-RedHat-9.9.4-14.el7 <<>> A example.com
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 30523

...

SERVFAIL:The nameserver encountered a problem while processing the query.

DNS综合架构实验

环境说明

生成中DNS服务器需要做高可用，下面以单机作为演示

hostname	IP	service	role	OS
client	10.0.0.103		客户端	Ubuntu
dns-local	10.0.0.8	bind9	本地 DNS（只缓存）	CentOS
dns-forward	10.0.0.18	bind9	转发 DNS（转发到自建的根域DNS）	CentOS
dns-xiangzheng	10.0.0.28	bind9	xiangzheng 子域 DNS	CentOS
dns-com	10.0.0.38	bind9	com 子域 DNS	CentOS
dns-root	10.0.0.48	bind9	根域 DNS	CentOS
webserver	10.0.0.58	nginx	web服务器	CentOS

注意事项

虽然部署顺序没有要求，但还是要部署一步测试一步以便出现问题好排错

部署 dns-xiangzheng

配置

# 修改 named 配置文件
[root@dns-xiangzheng ~]# vim /etc/named.conf 
options {
	listen-on port 53 { localhost; }; # 53端口监听在本机所有IP
...
    directory 	"/var/named";
...
	allow-query     { any; }; # 允许所有主机来查询
...
	dnssec-enable no; # 建议改为no
	dnssec-validation no; # 建议改为no
...

include "/etc/named.rfc1912.zones";
include "/etc/named.root.key";



# 区域数据库文件
# /var/named/xiangzheng.com.zone
$TTL 600
@   IN    SOA    ns1    mail.xiangzheng.com. (
            2015042201 ;
            1H ;
            10M ;
            1D ;
            12H ;
            )
          NS   ns1
ns1       A    10.0.0.103
@         A    10.0.0.58
# 注意修改权限
# chgrp named /var/named/com.zone




# 区域数据库配置文件
# /etc/named.rfc1912.zones 
...
zone "xiangzheng.com" {
    type master;
    file "xiangzheng.com.zone";
};
...

测试

root@client:~# host xiangzheng.com 10.0.0.28
Using domain server:
Name: 10.0.0.28
Address: 10.0.0.28#53
Aliases: 
xiangzheng.com has address 10.0.0.58


# 向 10.0.0.28 发起DNS请求，查询 xiangzheng.com 对应的IP
root@client:~# dig xiangzheng.com @10.0.0.28
; <<>> DiG 9.16.1-Ubuntu <<>> xiangzheng.com @10.0.0.28
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 5457
;; flags: qr aa rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 1, ADDITIONAL: 2

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 1232
; COOKIE: 7e723cb438d5c4181041841862c584d5eb323ef2dd5b6092 (good)
;; QUESTION SECTION:
;xiangzheng.com.			IN	A # xiangzheng.com 对应的A记录是多少？

;; ANSWER SECTION:
xiangzheng.com.		600	IN	A	10.0.0.58 # xiangzheng.com 对应的A记录是10.0.0.58

;; AUTHORITY SECTION:
xiangzheng.com.		600	IN	NS	ns1.xiangzheng.com. #额外的DNS从节点信息

;; ADDITIONAL SECTION:
ns1.xiangzheng.com.	600	IN	A	10.0.0.103 #额外的DNS从节点对应的IP

;; Query time: 0 msec
;; SERVER: 10.0.0.28#53(10.0.0.28)
;; WHEN: Wed Jul 06 20:49:25 CST 2022
;; MSG SIZE  rcvd: 121

部署 dns-com

配置

# 修改 named 配置文件
[root@dns-com ~]# vim /etc/named.conf 
options {
	listen-on port 53 { localhost; }; # 53端口监听在本机所有IP
...
    directory 	"/var/named";
...
	allow-query     { any; }; # 允许所有主机来查询
...
	dnssec-enable no; # 建议改为no
	dnssec-validation no; # 建议改为no
...

include "/etc/named.rfc1912.zones";
include "/etc/named.root.key";



# 区域数据库文件
# /var/named/com.zone
$TTL 600
@   IN    SOA    ns1  mail.xiangzheng.com. (
            2015042201 ;
            1H ;
            10M ;
            1D ;
            12H ;
            )
               NS  ns1
xiangzheng     NS  xiangzhengns1 #xiangzheng子域对应的NS域名
ns1            A   10.0.0.104
xiangzhengns1  A   10.0.0.28 #NS域名对应的IP
# 注意修改权限
# chgrp named /var/named/com.zone




# 区域数据库配置文件
# /etc/named.rfc1912.zones 
...
zone "com" {
    type master;
    file "com.zone";
};
...

测试

root@client:~# host xiangzheng.com 10.0.0.38
Using domain server:
Name: 10.0.0.38
Address: 10.0.0.38#53
Aliases: 

xiangzheng.com has address 10.0.0.58


# 向 10.0.0.28 发起DNS请求，查询 xiangzheng.com 对应的IP
root@client:~# dig xiangzheng.com @10.0.0.38

; <<>> DiG 9.16.1-Ubuntu <<>> xiangzheng.com @10.0.0.38
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 17527
;; flags: qr rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 1, ADDITIONAL: 2

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 1232
; COOKIE: 6f00ea6cc4dc92fd843578f762c5fde40f176586ef3f2e1e (good)
;; QUESTION SECTION:
;xiangzheng.com.			IN	A

;; ANSWER SECTION:
xiangzheng.com.		592	IN	A	10.0.0.58

;; AUTHORITY SECTION:
xiangzheng.com.		600	IN	NS	xiangzhengns1.com.

;; ADDITIONAL SECTION:
xiangzhengns1.com.	600	IN	A	10.0.0.28

;; Query time: 0 msec
;; SERVER: 10.0.0.38#53(10.0.0.38)
;; WHEN: Wed Jul 06 21:25:55 CST 2022
;; MSG SIZE  rcvd: 131

部署 dns-root

配置

# 修改 named 配置文件
[root@dns-root ~]# vim /etc/named.conf 
options {
	listen-on port 53 { localhost; }; # 53端口监听在本机所有IP
...
    directory 	"/var/named";
...
	allow-query     { any; }; # 允许所有主机来查询
...
	dnssec-enable no; # 建议改为no
	dnssec-validation no; # 建议改为no
...

include "/etc/named.rfc1912.zones";
include "/etc/named.root.key";



# 区域数据库文件
# /var/named/root.zone
$TTL 600
@   IN    SOA    ns1  mail.xiangzheng.com. (
            2015042201 ;
            1H ;
            10M ;
            1D ;
            12H ;
            )
            NS    ns1
com         NS    comns1 #com子域对应的NS域名
ns1         A     10.0.0.105
comns1      A     10.0.0.38 #NS域名对应的IP
# 注意修改权限
# chgrp named /var/named/root.zone




# 区域数据库配置文件
# /etc/named.rfc1912.zones 
...
zone "." {
    type master;
    file "root.zone";
};
...

测试

root@client:~# host xiangzheng.com 10.0.0.48
Using domain server:
Name: 10.0.0.48
Address: 10.0.0.48#53
Aliases: 

xiangzheng.com has address 10.0.0.58


root@client:~# dig xiangzheng.com @10.0.0.48

; <<>> DiG 9.16.1-Ubuntu <<>> xiangzheng.com @10.0.0.48
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 26385
;; flags: qr rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 1, ADDITIONAL: 2

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 1232
; COOKIE: c84f317b9b348d15b70e581562c603010a6c79a93ab3bf61 (good)
;; QUESTION SECTION:
;xiangzheng.com.			IN	A

;; ANSWER SECTION:
xiangzheng.com.		596	IN	A	10.0.0.58

;; AUTHORITY SECTION:
xiangzheng.com.		596	IN	NS	xiangzhengns1.com.

;; ADDITIONAL SECTION:
xiangzhengns1.com.	596	IN	A	10.0.0.28

;; Query time: 4 msec
;; SERVER: 10.0.0.48#53(10.0.0.48)
;; WHEN: Wed Jul 06 21:47:44 CST 2022
;; MSG SIZE  rcvd: 131

部署 dns-forward

只指向自建的根DNS，即dns-root

配置

# 修改 named 配置文件
[root@dns-forward ~]# vim /etc/named.conf 
options {
	listen-on port 53 { localhost; }; # 53端口监听在本机所有IP
...
    directory 	"/var/named";
...
	allow-query     { any; }; # 允许所有主机来查询
...
	dnssec-enable no; # 建议改为no
	dnssec-validation no; # 建议改为no
...

include "/etc/named.rfc1912.zones";
include "/etc/named.root.key";



# 修改指向的根DNS
# /var/named/named.ca
.           518400  IN  NS  a.root-servers.net.
a.root-servers.net. 518400  IN  A   10.0.0.48

测试

root@client:~# host xiangzheng.com 10.0.0.18
Using domain server:
Name: 10.0.0.18
Address: 10.0.0.18#53
Aliases: 

xiangzheng.com has address 10.0.0.58



root@client:~# dig xiangzheng.com @10.0.0.18

; <<>> DiG 9.16.1-Ubuntu <<>> xiangzheng.com @10.0.0.18
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 47454
;; flags: qr rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 1, ADDITIONAL: 2

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 1232
; COOKIE: 1d782f0fc152cd7187c2c5f262c595127ad14f1f87e9dbbc (good)
;; QUESTION SECTION:
;xiangzheng.com.			IN	A

;; ANSWER SECTION:
xiangzheng.com.		592	IN	A	10.0.0.58

;; AUTHORITY SECTION:
xiangzheng.com.		592	IN	NS	xiangzhengns1.com.

;; ADDITIONAL SECTION:
xiangzhengns1.com.	592	IN	A	10.0.0.28

;; Query time: 0 msec
;; SERVER: 10.0.0.18#53(10.0.0.18)
;; WHEN: Wed Jul 06 21:58:42 CST 2022
;; MSG SIZE  rcvd: 131

部署 dns-local

配置

# 修改 named 配置文件
[root@dns-local ~]# vim /etc/named.conf 
options {
	listen-on port 53 { localhost; }; # 53端口监听在本机所有IP
...
    directory 	"/var/named";
...
	allow-query     { any; }; # 允许所有主机来查询
...
    forward only; #only表示转发的服务器如果查询不到则直接返回查询不到的结果
    forwarders { 10.0.0.18;}; #转发的DNS服务器IP
...
	dnssec-enable no; # 建议改为no
	dnssec-validation no; # 建议改为no
...

include "/etc/named.rfc1912.zones";
include "/etc/named.root.key";

测试

root@client:~# host xiangzheng.com 10.0.0.8
Using domain server:
Name: 10.0.0.8
Address: 10.0.0.8#53
Aliases: 

xiangzheng.com has address 10.0.0.58


root@client:~# dig xiangzheng.com @10.0.0.8

; <<>> DiG 9.16.1-Ubuntu <<>> xiangzheng.com @10.0.0.8
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 1374
;; flags: qr rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 1

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 1232
; COOKIE: bc40a75cf7036a146d2491c362c5984287bb9d93e7e1efe3 (good)
;; QUESTION SECTION:
;xiangzheng.com.			IN	A

;; ANSWER SECTION:
xiangzheng.com.		579	IN	A	10.0.0.58

;; Query time: 0 msec
;; SERVER: 10.0.0.8#53(10.0.0.8)
;; WHEN: Wed Jul 06 22:12:18 CST 2022
;; MSG SIZE  rcvd: 87

DNS实验

01实现基础DNS服务器

前言

CentOS

安装 bind DNS

环境说明

修改 bind DNS 配置文件

修改方式一

修改方式二

启动 bind DNS

测试访问

Ubuntu

安装 bind DNS

环境说明

修改 bind DNS 配置文件

启动 bind DNS

测试访问

抓包详情

第一次递归查询

第二次递归查询

第三次查询，缓存返回结果

dig 采集详情

02实现正向主DNS服务器

实现正向主DNS服务器

环境说明

创建区域数据库

查看区域数据库存放位置

创建区域数据库

更改区域数据库权限

配置基础区域数据库

修改主配置文件

Ubuntu

CentOS

检查配置文件语法后启动DNS

测试

区域数据库添加其它记录

准备测试web

www A 记录

目前情况

添加记录

测试

* A 记录

目前情况

添加记录

测试

@ A 记录

目前情况

添加记录

测试

CNAME

添加记录

测试

MX

添加记录

测试

DNS 冗余

03实现正向主从DNS服务器

环境说明

主DNS配置

从DNS配置

04实现反向主DNS服务器

前言

建立反向解析数据库

在配置文件中添加

测试反向解析

05实现子域

子域概述

子域范例

环境说明

主DNS配置

从DNS配置

上海子域 主DNS配置

上海子域 从DNS配置

客户端测试

子域授权

06实现DNS转发(缓存）

前言

注意事项

转发方式

全局转发

上海子域主DNS配置

上海子域从DNS配置