一、功能變數名稱解析過程 DNS功能變數名稱完整解析過程 1、查詢本地 hosts文件 解析記錄 2、查詢客戶端本地DNS緩存記錄 3、訪問DNS轉發（緩存）伺服器本地緩存記錄 4、轉發到權威伺服器查詢本地緩存記錄 5、訪問權威伺服器解析記錄 6、權威伺服器迭代查詢 6.1、訪問子域權威伺服器查詢本地緩存記錄 6. ...
一、功能變數名稱解析過程
DNS功能變數名稱完整解析過程
1、查詢本地 hosts文件 解析記錄
2、查詢客戶端本地DNS緩存記錄
3、訪問DNS轉發（緩存）伺服器本地緩存記錄
4、轉發到權威伺服器查詢本地緩存記錄
5、訪問權威伺服器解析記錄
6、權威伺服器迭代查詢
6.1、訪問子域權威伺服器查詢本地緩存記錄
6.2、訪問子域解析記錄
7、訪問根伺服器解析記錄
8、訪問一級功能變數名稱伺服器解析記錄
.......
二、DNS解析記錄類型
1、DNS伺服器類型
主DNS伺服器
管理和維護所負責解析的域內解析庫的伺服器
從DNS伺服器
從主伺服器或從伺服器複製（區域傳輸）解析庫副本
緩存DNS伺服器（轉發器）
將客戶端請求轉發到指定的DNS伺服器上，並將指定DNS伺服器返回結果緩存到本地DNS緩存記錄中，緩存DNS伺服器自身不保存解析庫數據，不使用自身進行功能變數名稱解析。
2、解析結果類型
- 肯定答案：存在對應的查詢結果
- 否定答案：請求的條目不存在等原因導致無法返回結果
- 權威答案：直接由存在此查詢結果的DNS伺服器（權威伺服器）返回的結果
- 非權威答案：有其他非權威伺服器返回的查詢結果
3、資源記錄RR（Resource Record）
區域解析庫
有眾多資源記錄RR（Resource Record）組成
記錄類型：SOA、A、AAAA、NS、CNAME、MX、TXT、PTR
- SOA：Start Of Authority，起始授權記錄；一個區域解析庫有且僅能有一個SOA記錄，且必須位於解析庫的第一條
- A：IPv4 正向解析資源記錄
- AAAA：IPv6正向解析資源記錄
- NS：用於標註當前區域的DNS伺服器
- CNAME：別名記錄
- MX：郵件交換器
- TXT：對功能變數名稱進行標識說明的一種方式，一般做驗證記錄會使用此項，如SPF（反垃圾郵件）記錄，https驗證 登
- PTR：
3.1、資源記錄定義格式
name [TTL] IN rr_type value
使用@符號可引用當前區功能變數名稱字
TTL 可以從全局繼承
IN值可以通過繼承上一條記錄忽略不寫
同一個名字可以通過多條記錄定義多個值，此時DNS伺服器會以輪詢方式響應
同一個值也可能有多個不同定義的名字，通過多個名字指向同一個值進行定義，此時表示通過多個不同的名字找到同一臺主機
3.2、SOA 記錄
name：當前區域的名字
value：多個內容組成
當前主DNS伺服器的FQDN，也可以使用當前區域的名字
當前區域的管理員郵箱，由於無法使用@符合，通常使用.替換，例如：root.janzen.com ([email protected])
主從服務區域傳輸相關定義以及否定答案的統一TTL設置
@ IN SOA dns1.janzen.com root.janzen.com ( 1 ; 序列號 604800 ; 刷新時間 86400 ; 重試時間 2419200 ; 過期時間 604800 ) ; 否定答案的TTL值
3.3、A 記錄
name：主機的FQDN，可以.結尾代表完整名稱，也可以簡寫末尾不加.
value：對應的IPv4地址
dns1 A 10.0.0.20 dns2 A 10.0.0.21 gitlab.janzen.com. A 10.0.0.13 harbor A 10.0.0.9 harbor A 10.0.0.10
3.4、AAAA 記錄
name：主機的FQDN，可以.結尾代表完整名稱，也可以簡寫末尾不加.
value：對應的IPv6地址
3.5、NS 記錄
name：當前區域的名字
value：當前區域某DNS伺服器的名字
相鄰的兩個資源記錄name相同時，後續的可以省略
對於NS記錄而言，每一條NS記錄後面的名字，後續都應該有一條對應的A記錄
一個區域可以有多條NS記錄
@ IN NS dns1
NS dns2
3.6、CNAME 記錄
name：別名FQDN
value：真實的FQDN
dns IN CNAME dns1
3.7、MX 記錄
name：當前區域的名字
value：當前區域某郵件伺服器（smtp伺服器）的名字
一個區域內，MX記錄可以有多個，但每個記錄的value後面都應該有一個（0-99）數字，表示此伺服器的優先順序
對於MX記錄而言，每一條NS記錄後面的名字，後續都應該有一條對應的A記錄
@ IN MX 12 mail1
IN MX 10 mail2
mail1 IN A 10.0.0.31
mail2 IN A 10.0.0.32
3.8、TXT 記錄
name：文本描述頭
value：文本內容
_dnstxt TXT this is @ name server
3.9、PTR 記錄
name：IP
value：FQDN
name的IP擁有固定寫法，需要將IP反向書寫，並添加特殊尾碼 in-addr.arpa.
完整寫法為：20.0.0.10.in-addr.arpa.
網路地址及尾碼可以省略，主機地址依舊要反寫
20.0.0.10.in-addr.arpa. IN PTR dns.janzen.com. #由於 10.0.0 為網路地址，可以省略 9 IN PTR harbor.janzen.com.
三、DNS工具介紹
dig 工具介紹
用於測試DNS解析結果
Usage: dig [@global-server] [domain] [q-type] [q-class] {q-opt}
Where: domain is in the Domain Name System
q-class is one of (in,hs,ch,...) [default: in]
q-type is one of (a,any,mx,ns,soa,hinfo,axfr,txt,...) [default:a]
(Use ixfr=version for type ixfr)
q-opt +[no]trace (Trace delegation down from root [+dnssec])
+[no]recurse (Recursive mode (+[no]rdflag))
#獲取目標dns全部解析記錄 dig -tAXFR janzen.com @10.0.0.21 #跟蹤功能變數名稱解析路徑 dig +trace app3.janzen.com @10.0.0.21 #查詢PTR記錄 dig -x 10.0.0.21 #直接顯示功能變數名稱查詢結果 dig +short app3.janzen.com @10.0.0.71
nslookup工具
nslookup [-option] [name | -] [server]
rndc DNS管理工具
Usage: rndc [-b address] [-c config] [-s server] [-p port] [-k key-file ] [-y key] [-r] [-V] command command is one of the following: addzone zone [class [view]] { zone-options } Add zone to given view. Requires allow-new-zones option. delzone [-clean] zone [class [view]] Removes zone from given view. dnstap -reopen Close, truncate and re-open the DNSTAP output file. dnstap -roll count Close, rename and re-open the DNSTAP output file(s). dumpdb [-all|-cache|-zones|-adb|-bad|-fail] [view ...] Dump cache(s) to the dump file (named_dump.db). flush Flushes all of the server's caches. flush [view] Flushes the server's cache for a view. flushname name [view] Flush the given name from the server's cache(s) flushtree name [view] Flush all names under the given name from the server's cache(s) freeze Suspend updates to all dynamic zones. freeze zone [class [view]] Suspend updates to a dynamic zone. halt Stop the server without saving pending updates. halt -p Stop the server without saving pending updates reporting process id. loadkeys zone [class [view]] Update keys without signing immediately. managed-keys refresh [class [view]] Check trust anchor for RFC 5011 key changes managed-keys status [class [view]] Display RFC 5011 managed keys information managed-keys sync [class [view]] Write RFC 5011 managed keys to disk modzone zone [class [view]] { zone-options } Modify a zone's configuration. Requires allow-new-zones option. notify zone [class [view]] Resend NOTIFY messages for the zone. notrace Set debugging level to 0. nta -dump List all negative trust anchors. nta [-lifetime duration] [-force] domain [view] Set a negative trust anchor, disabling DNSSEC validation for the given domain. Using -lifetime specifies the duration of the NTA, up to one week. Using -force prevents the NTA from expiring before its full lifetime, even if the domain can validate sooner. nta -remove domain [view] Remove a negative trust anchor, re-enabling validation for the given domain. querylog [ on | off ] Enable / disable query logging. reconfig Reload configuration file and new zones only. recursing Dump the queries that are currently recursing (named.recursing) refresh zone [class [view]] Schedule immediate maintenance for a zone. reload Reload configuration file and zones. reload zone [class [view]] Reload a single zone. retransfer zone [class [view]] Retransfer a single zone without checking serial number. scan Scan available network interfaces for changes. secroots [view ...] Write security roots to the secroots file. showzone zone [class [view]] Print a zone's configuration. sign zone [class [view]] Update zone keys, and sign as needed. signing -clear all zone [class [view]] Remove the private records for all keys that have finished signing the given zone. signing -clear <keyid>/<algorithm> zone [class [view]] Remove the private record that indicating the given key has finished signing the given zone. signing -list zone [class [view]] List the private records showing the state of DNSSEC signing in the given zone. signing -nsec3param hash flags iterations salt zone [class [view]] Add NSEC3 chain to zone if already signed. Prime zone with NSEC3 chain if not yet signed. signing -nsec3param none zone [class [view]] Remove NSEC3 chains from zone. signing -serial <value> zone [class [view]] Set the zones's serial to <value>. stats Write server statistics to the statistics file. status Display status of the server. stop Save pending updates to master files and stop the server. stop -p Save pending updates to master files and stop the server reporting process id. sync [-clean] Dump changes to all dynamic zones to disk, and optionally remove their journal files. sync [-clean] zone [class [view]] Dump a single zone's changes to disk, and optionally remove its journal file. thaw Enable updates to all dynamic zones and reload them. thaw zone [class [view]] Enable updates to a frozen dynamic zone and reload it. trace Increment debugging level by one. trace level Change the debugging level. tsig-delete keyname [view] Delete a TKEY-negotiated TSIG key. tsig-list List all currently active TSIG keys, including both statically configured and TKEY-negotiated keys. validation [ yes | no | status ] [view] Enable / disable DNSSEC validation. zonestatus zone [class [view]] Display the current status of a zone. Version: 9.11.3-1ubuntu1.18-Ubuntu
四、DNS安裝部署
1、Centos7 配置功能變數名稱正向解析主伺服器
1.1、yum安裝bind服務，及DNS工具 bind-utils
yum install -y bind bind-utils
1.2、修改 named.conf 配置文件，禁用服務限制，引入區域配置文件
[root@node-centos7-70 ~]# vim /etc/named.conf options { # listen-on port 53 { 127.0.0.1; }; listen-on-v6 port 53 { ::1; }; directory "/var/named"; dump-file "/var/named/data/cache_dump.db"; statistics-file "/var/named/data/named_stats.txt"; memstatistics-file "/var/named/data/named_mem_stats.txt"; recursing-file "/var/named/data/named.recursing"; secroots-file "/var/named/data/named.secroots"; # allow-query { localhost; }; recursion yes; dnssec-enable yes; dnssec-validation yes; /* Path to ISC DLV key */ bindkeys-file "/etc/named.root.key"; managed-keys-directory "/var/named/dynamic"; pid-file "/run/named/named.pid"; session-keyfile "/run/named/session.key"; }; logging { channel default_debug { file "data/named.run"; severity dynamic; }; }; zone "." IN { type hint; file "named.ca"; }; include "/etc/named.rfc1912.zones"; include "/etc/named.root.key"; include "/etc/named.zones"
1.3、創建 named.zones 區域配置文件
[root@node-centos7-70 ~]# vim /etc/named.zones
zone "janzen.com" IN { type master; file "named.janzen.com"; allow-update { none; }; };
1.4、創建 named.janzen.com 區域解析庫文件
[root@node-centos7-70 etc]# vim /var/named/named.janzen.com ; ; BIND reverse data file for broadcast zone ; $TTL 604800 @ IN SOA janzen.com. root.localhost. ( 1 ; Serial 604800 ; Refresh 86400 ; Retry 2419200 ; Expire 604800 ) ; Negative Cache TTL ; @ IN NS dns1 IN NS dns2 IN MX 12 mail1 IN MX 10 mail2 dns IN CNAME dns1 dns1 IN A 10.0.0.20 dns2 IN A 10.0.0.21 gitlab IN A 10.0.0.13 harbor IN A 10.0.0.9 harbor IN A 10.0.0.10 www IN A 10.0.0.11 mail1 IN A 10.0.0.31 mail2 IN A 10.0.0.32 _dnstext IN TXT this is @ name server
1.5、修改文件許可權
[root@node-centos7-70 etc]# chmod 640 {/etc/named.zones,/var/named/named.janzen.com} [root@node-centos7-70 etc]# chgrp named {/etc/named.zones,/var/named/named.janzen.com}
1.6、設置named服務開機自啟動
[root@node-centos7-70 etc]# systemctl enable --now named
1.7、使用dig測試DNS服務
[root@node-centos7-70 etc]# dig dns.janzen.com @10.0.0.70 ; <<>> DiG 9.11.4-P2-RedHat-9.11.4-26.P2.el7_9.13 <<>> dns.janzen.com @10.0.0.70 ;; global options: +cmd ;; Got answer: ;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 51429 ;; flags: qr aa rd ra; QUERY: 1, ANSWER: 2, AUTHORITY: 2, ADDITIONAL: 2 ;; OPT PSEUDOSECTION: ; EDNS: version: 0, flags:; udp: 4096 ;; QUESTION SECTION: ;dns.janzen.com. IN A ;; ANSWER SECTION: dns.janzen.com. 604800 IN CNAME dns1.janzen.com. dns1.janzen.com. 604800 IN A 10.0.0.20 ;; AUTHORITY SECTION: janzen.com. 604800 IN NS dns2.janzen.com. janzen.com. 604800 IN NS dns1.janzen.com. ;; ADDITIONAL SECTION: dns2.janzen.com. 604800 IN A 10.0.0.21 ;; Query time: 0 msec ;; SERVER: 10.0.0.70#53(10.0.0.70) ;; WHEN: 四 5月 25 18:16:54 CST 2023 ;; MSG SIZE rcvd: 127 [root@node-centos7-70 etc]# dig janzen.com @10.0.0.70 mx ; <<>> DiG 9.11.4-P2-RedHat-9.11.4-26.P2.el7_9.13 <<>> janzen.com @10.0.0.70 mx ;; global options: +cmd ;; Got answer: ;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 2566 ;; flags: qr aa rd ra; QUERY: 1, ANSWER: 2, AUTHORITY: 2, ADDITIONAL: 5 ;; OPT PSEUDOSECTION: ; EDNS: version: 0, flags:; udp: 4096 ;; QUESTION SECTION: ;janzen.com. IN MX ;; ANSWER SECTION: janzen.com. 604800 IN MX 10 mail2.janzen.com. janzen.com. 604800 IN MX 12 mail1.janzen.com. ;; AUTHORITY SECTION: janzen.com. 604800 IN NS dns2.janzen.com. janzen.com. 604800 IN NS dns1.janzen.com. ;; ADDITIONAL SECTION: mail1.janzen.com. 604800 IN A 10.0.0.31 mail2.janzen.com. 604800 IN A 10.0.0.32 dns1.janzen.com. 604800 IN A 10.0.0.20 dns2.janzen.com. 604800 IN A 10.0.0.21 ;; Query time: 0 msec ;; SERVER: 10.0.0.70#53(10.0.0.70) ;; WHEN: 四 5月 25 18:18:09 CST 2023 ;; MSG SIZE rcvd: 185 [root@node-centos7-70 etc]# dig harbor.janzen.com @10.0.0.70 ; <<>> DiG 9.11.4-P2-RedHat-9.11.4-26.P2.el7_9.13 <<>> harbor.janzen.com @10.0.0.70 ;; global options: +cmd ;; Got answer: ;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 33334 ;; flags: qr aa rd ra; QUERY: 1, ANSWER: 2, AUTHORITY: 2, ADDITIONAL: 3 ;; OPT PSEUDOSECTION: ; EDNS: version: 0, flags:; udp: 4096 ;; QUESTION SECTION: ;harbor.janzen.com. IN A ;; ANSWER SECTION: harbor.janzen.com. 604800 IN A 10.0.0.10 harbor.janzen.com. 604800 IN A 10.0.0.9 ;; AUTHORITY SECTION: janzen.com. 604800 IN NS dns1.janzen.com. janzen.com. 604800 IN NS dns2.janzen.com. ;; ADDITIONAL SECTION: dns1.janzen.com. 604800 IN A 10.0.0.20 dns2.janzen.com. 604800 IN A 10.0.0.21 ;; Query time: 0 msec ;; SERVER: 10.0.0.70#53(10.0.0.70) ;; WHEN: 四 5月 25 18:20:07 CST 2023 ;; MSG SIZE rcvd: 148
1.8、修改區域解析庫文件內容，使用 rndc 重載配置
[root@node-centos7-70 etc]# vim /var/named/named.janzen.com $TTL 604800 @ IN SOA janzen.com. root.localhost. ( 2 ; Serial 604800 ; Refresh 86400 ; Retry 2419200 ; Expire 604800 ) ; Negative Cache TTL @ IN NS dns1 IN NS dns2 IN MX 12 mail1 IN MX 10 mail2 dns IN CNAME dns1 dns1 IN A 10.0.0.70 dns2 IN A 10.0.0.21 gitlab IN A 10.0.0.13 harbor IN A 10.0.0.9 harbor IN A 10.0.0.10 www IN A 10.0.0.11 mail1 IN A 10.0.0.31 mail2 IN A 10.0.0.32 _dnstext IN TXT this is @ name server
[root@node-centos7-70 etc]# rndc reload server reload successful
[root@node-centos7-70 etc]# dig dns.janzen.com @10.0.0.70 ; <<>> DiG 9.11.4-P2-RedHat-9.11.4-26.P2.el7_9.13 <<>> dns.janzen.com @10.0.0.70 ;; global options: +cmd ;; Got answer: ;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 5247 ;; flags: qr aa rd ra; QUERY: 1, ANSWER: 2, AUTHORITY: 2, ADDITIONAL: 2 ;; OPT PSEUDOSECTION: ; EDNS: version: 0, flags:; udp: 4096 ;; QUESTION SECTION: ;dns.janzen.com. IN A ;; ANSWER SECTION: dns.janzen.com. 604800 IN CNAME dns1.janzen.com. dns1.janzen.com. 604800 IN A 10.0.0.70 ;; AUTHORITY SECTION: janzen.com. 604800 IN NS dns2.janzen.com. janzen.com. 604800 IN NS dns1.janzen.com. ;; ADDITIONAL SECTION: dns2.janzen.com. 604800 IN A 10.0.0.21 ;; Query time: 0 msec ;; SERVER: 10.0.0.70#53(10.0.0.70) ;; WHEN: 四 5月 25 18:27:45 CST 2023 ;; MSG SIZE rcvd: 127
2、Ubuntu apt安裝bind服務
1.1、apt安裝bind9服務，及DNS工具 bind9utils
[root@Node-Ubuntu1804-20:~]# apt install -y bind9 bind9utils
1.2、修改 named.conf 配置文件，引入區域配置文件
[root@Node-Ubuntu1804-20:~]# cat /etc/bind/named.conf // This is the primary configuration file for the BIND DNS server named. // // Please read /usr/share/doc/bind9/README.Debian.gz for information on the // structure of BIND configuration files in Debian, *BEFORE* you customize // this configuration file. // // If you are just adding zones, please do that in /etc/bind/named.conf.local include "/etc/bind/named.conf.options"; include "/etc/bind/named.conf.local"; include "/etc/bind/named.conf.default-zones"; include "/etc/bind/named.zones";
1.3、創建 named.zones 區域配置文件
[root@Node-Ubuntu1804-20:~]# vim /etc/bind/named.zones zone janzen.com IN { type master; file "/etc/bind/db.janzen.com"; };
1.4、創建 db.janzen.com 區域解析庫文件
[root@Node-Ubuntu1804-20:~]# vim /etc/bind/db.janzen.com $TTL 604800 @ IN SOA janzen.com. root.localhost. ( 1 ; Serial 604800 ; Refresh 86400 ; Retry 2419200 ; Expire 604800 ) ; Negative Cache TTL @ IN NS dns1 IN NS dns2 IN MX 12 mail1 IN MX 10 mail2 dns IN CNAME dns1 dns1 IN A 10.0.0.20 dns2 IN A 10.0.0.21 gitlab IN A 10.0.0.13 harbor IN A 10.0.0.9 harbor IN A 10.0.0.10 www IN A 10.0.0.11 mail1 IN A 10.0.0.31 mail2 IN A 10.0.0.32 _dnstext IN TXT this is @ name server
1.5、修改文件許可權
[root@Node-Ubuntu1804-20:~]# chmod 640 /etc/bind/{named.zones,db.janzen.com} [root@Node-Ubuntu1804-20:~]# chgrp bind /etc/bind/{named.zones,db.janzen.com}
1.6、啟動 bind9 服務
[root@Node-Ubuntu1804-20:~]# systemctl start bind9
1.7、使用dig測試DNS服務
[root@Ansible-Ubuntu1804-25:~]# dig dns.janzen.com @10.0.0.20 ; <<>> DiG 9.11.3-1ubuntu1.18-Ubuntu <<>> dns.janzen.com @10.0.0.20 ;; global options: +cmd ;; Got answer: ;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 32150 ;; flags: qr aa rd ra; QUERY: 1, ANSWER: 2, AUTHORITY: 2, ADDITIONAL: 2 ;; OPT PSEUDOSECTION: ; EDNS: version: 0, flags:; udp: 4096 ; COOKIE: 95d843b6344528dfc99349d4646f3bbb5812908fa82e3d3f (good) ;; QUESTION SECTION: ;dns.janzen.com. IN A ;; ANSWER SECTION: dns.janzen.com. 604800 IN CNAME dns1.janzen.com. dns1.janzen.com. 604800 IN A 10.0.0.20 ;; AUTHORITY SECTION: janzen.com. 604800 IN NS dns1.janzen.com. janzen.com. 604800 IN NS dns2.janzen.com. ;; ADDITIONAL SECTION: dns2.janzen.com. 604800 IN A 10.0.0.21 ;; Query time: 0 msec ;; SERVER: 10.0.0.20#53(10.0.0.20) ;; WHEN: Thu May 25 18:43:07 CST 2023 ;; MSG SIZE rcvd: 155
[root@Ansible-Ubuntu1804-25:~]# dig janzen.com @10.0.0.20 mx ; <<>> DiG 9.11.3-1ubuntu1.18-Ubuntu <<>> janzen.com @10.0.0.20 mx ;; global options: +cmd ;; Got answer: ;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 11520 ;; flags: qr aa rd ra; QUERY: 1, ANSWER: 2, AUTHORITY: 2, ADDITIONAL: 5 ;; OPT PSEUDOSECTION: ; EDNS: version: 0, flags:; udp: 4096 ; COOKIE: 2bd0379cc8f4ca918c8ed28e646f3c5c2d56e5c3704f4752 (good) ;; QUESTION SECTION: ;janzen.com. IN MX ;; ANSWER SECTION: janzen.com. 604800 IN MX 10 mail2.janzen.com. janzen.com. 604800 IN MX 12 mail1.janzen.com. ;; AUTHORITY SECTION: janzen.com. 604800 IN NS dns2.janzen.com. janzen.com. 604800 IN NS dns1.janzen.com. ;; ADDITIONAL SECTION: mail2.janzen.com. 604800 IN A 10.0.0.32 mail1.janzen.com. 604800 IN A 10.0.0.31 dns1.janzen.com. 604800 IN A 10.0.0.20 dns2.janzen.com. 604800 IN A 10.0.0.21 ;; Query time: 1 msec ;; SERVER: 10.0.0.20#53(10.0.0.20) ;; WHEN: Thu May 25 18:45:48 CST 2023 ;; MSG SIZE rcvd: 213
[root@Ansible-Ubuntu1804-25:~]# dig harbor.janzen.com @10.0.0.20 ; <<>> DiG 9.11.3-1ubuntu1.18-Ubuntu <<>> harbor.janzen.com @10.0.0.20 ;; global options: +cmd ;; Got answer: ;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 45201 ;; flags: qr aa rd ra; QUERY:
