Client -->hosts文件 --> Client DNS Service Local Cache --> DNS Server (recursion递归) --> DNS Server Cache -->DNS iteration(迭代) --> 根--> 顶级域名DNS-->二级域名DNS…
www.wang.org. IN A 1.1.1.1 www.wang.org. IN A 2.2.2.2 mx1.wang.org. IN A 3.3.3.3 mx2.wang.org. IN A 4.4.4.4 $GENERATE 1-254 HOST$ IN A 1.2.3.$ *.wang.org. IN A 5.5.5.5 wang.org. IN A 6.6.6.6
4.3.2.1.in-addr.arpa. IN PTR www.wang.org. #如1.2.3为网络地址，可简写成： 4 IN PTR www.wang.org.
CNAME别名记录
1 2
name: 别名的FQDN value: 真正名字的FQDN
例如：
1
www.wang.org. IN CNAME websrv.wang.org.
子域授权
每个域的名称服务器，都是通过其上级名称服务器在解析库进行授权,类似根域授权tld
glue record：粘合记录，父域授权子域的记录
范例：
1 2 3 4 5 6 7 8 9 10 11
.com. IN NS ns1.com. .com. IN NS ns2.com. ns1.com. IN A 2.2.2.1 ns2.com. IN A 2.2.2.2 #wang.org. 在.com的名称服务器上，解析库中添加资源记录 wang.org. IN NS ns1.wang.org. wang.org. IN NS ns2.wang.org. wang.org. IN NS ns3.wang.org. ns1.wang.org. IN A 3.3.3.1 ns2.wang.org. IN A 3.3.3.2 ns3.wang.org. IN A 3.3.3.3
管理工具：/usr/sbin/rndc：remote name domain controller，默认与bind安装在同一主机，且只能通过127.0.0.1连接named进程，提供辅助性的管理功能；953/tcp
解析库文件：/var/named/ZONE_NAME.ZONE
注意：
(1) 一台物理服务器可同时为多个区域提供解析
(2) 必须要有根区域文件；named.ca
(3) 应该有两个（如果包括ipv6的，应该更多）实现localhost和本地回环地址的解析库
主配置文件
全局配置：options {};
日志子系统配置：logging {};
区域定义：本机能够为哪些zone进行解析，就要定义哪些zone zone
“ZONE_NAME” IN {};
注意：
任何服务程序如果期望其能够通过网络被其它主机访问，至少应该监听在一个能与外部主机通信的IP地址上
缓存名称服务器的配置：监听外部地址即可
dnssec: 建议关闭dnssec，设为no
实现主DNS服务器
主DNS服务器配置
在主配置文件中定义区域
1 2 3 4 5 6 7 8 9 10
vim /etc/named.conf #注释掉下面两行 // listen-on port 53 { 127.0.0.1; }; // allow-query { localhost; };
zone "ZONE_NAME" IN { type {master|slave|hint|forward}; file "ZONE_NAME.zone"; };
定义区域解析库文件
内容包括 :
- 宏定义
- 资源记录
范例：区域数据库
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19
$TTL 86400 $ORIGIN wang.org. @ IN SOA ns1.wang.org. admin.wang.org ( 2015042201 1H 5M 7D 1D ) IN NS ns1 IN NS ns2 IN MX 10 mx1 IN MX 20 mx2 ns1 IN A 172.16.100.11 ns2 IN A 172.16.100.12 mx1 IN A 172.16.100.13 mx2 IN A 172.16.100.14 websrv IN A 172.16.100.11 websrv IN A 172.16.100.12 www IN CNAME websrv
范例：抓包观察查询过程
1 2 3 4 5 6 7 8 9 10 11 12 13 14
[root@centos8 ~]# tcpdump -i eth0 udp port 53 -nn tcpdump: verbose output suppressed, use -v or -vv for full protocol decode listening on eth0, link-type EN10MB (Ethernet), capture size 262144 bytes 11:37:38.458363 IP 10.0.0.7.42201 > 10.0.0.8.53: 44928+ A? www.baidu.com. (31) 11:37:38.458896 IP 10.0.0.7.54285 > 10.0.0.8.53: 44928+ A? www.baidu.com. (31) 11:37:38.460038 IP 10.0.0.7.42053 > 10.0.0.8.53: 30536+ A? www.baidu.com.wangxiaochun.com. (48) 11:37:38.460884 IP 10.0.0.7.37739 > 10.0.0.8.53: 30536+ A? www.baidu.com.wangxiaochun.com. (48)
#查看缓存统计信息 [root@centos7 ~]#nscd -g nscd configuration: 0 server debug level 4m 25s server runtime 5 current number of threads 32 maximum number of threads 0 number of times clients had to wait no paranoia mode enabled 3600 restart internal 5 reload count passwd cache: yes cache is enabled yes cache is persistent yes cache is shared 211 suggested size 216064 total data pool size 1216 used data pool size 600 seconds time to live for positive entries 20 seconds time to live for negative entries 0 cache hits on positive entries 0 cache hits on negative entries 7 cache misses on positive entries 0 cache misses on negative entries 0% cache hit rate 14 current number of cached values 14 maximum number of cached values 0 maximum chain length searched 0 number of delays on rdlock 0 number of delays on wrlock 0 memory allocations failed yes check /etc/passwd for changes group cache: yes cache is enabled yes cache is persistent yes cache is shared 211 suggested size 216064 total data pool size 128 used data pool size 3600 seconds time to live for positive entries 60 seconds time to live for negative entries 0 cache hits on positive entries 0 cache hits on negative entries 1 cache misses on positive entries 0 cache misses on negative entries 0% cache hit rate 2 current number of cached values 2 maximum number of cached values 0 maximum chain length searched 0 number of delays on rdlock 0 number of delays on wrlock 0 memory allocations failed yes check /etc/group for changes hosts cache: yes cache is enabled yes cache is persistent yes cache is shared 211 suggested size 216064 total data pool size 248 used data pool size 3600 seconds time to live for positive entries 20 seconds time to live for negative entries 0 cache hits on positive entries 0 cache hits on negative entries 2 cache misses on positive entries 1 cache misses on negative entries 0% cache hit rate 2 current number of cached values 2 maximum number of cached values 0 maximum chain length searched 0 number of delays on rdlock 0 number of delays on wrlock 0 memory allocations failed yes check /etc/hosts for changes services cache: yes cache is enabled yes cache is persistent yes cache is shared 211 suggested size 216064 total data pool size 0 used data pool size 28800 seconds time to live for positive entries 20 seconds time to live for negative entries 0 cache hits on positive entries 0 cache hits on negative entries 0 cache misses on positive entries 0 cache misses on negative entries 0% cache hit rate 0 current number of cached values 0 maximum number of cached values 0 maximum chain length searched 0 number of delays on rdlock 0 number of delays on wrlock 0 memory allocations failed yes check /etc/services for changes netgroup cache: yes cache is enabled yes cache is persistent yes cache is shared 211 suggested size 216064 total data pool size 0 used data pool size 28800 seconds time to live for positive entries 20 seconds time to live for negative entries 0 cache hits on positive entries 0 cache hits on negative entries 0 cache misses on positive entries 0 cache misses on negative entries 0% cache hit rate 0 current number of cached values 0 maximum number of cached values 0 maximum chain length searched 0 number of delays on rdlock 0 number of delays on wrlock 0 memory allocations failed yes check /etc/netgroup for changes #清除DNS客户端缓存 [root@centos7 ~]#nscd -i hosts
[root@ubuntu1804 ~]#systemctl status systemd-resolved.service ● systemd-resolved.service - Network Name Resolution Loaded: loaded (/lib/systemd/system/systemd-resolved.service; enabled; vendor preset: enabled) Active: active (running) since Thu 2020-12-31 19:52:58 CST; 3h 6min ago Docs: man:systemd-resolved.service(8) https://www.freedesktop.org/wiki/Software/systemd/resolved https://www.freedesktop.org/wiki/Software/systemd/writing-network-configuration-managers https://www.freedesktop.org/wiki/Software/systemd/writing-resolver-clients Main PID: 738 (systemd-resolve) Status: "Processing requests..." Tasks: 1 (limit: 2290) CGroup: /system.slice/systemd-resolved.service └─738 /lib/systemd/systemd-resolved
[root@ubuntu1804 ~]#systemd-resolve --help systemd-resolve [OPTIONS...] HOSTNAME|ADDRESS... systemd-resolve [OPTIONS...] --service [[NAME] TYPE] DOMAIN systemd-resolve [OPTIONS...] --openpgp EMAIL@DOMAIN... systemd-resolve [OPTIONS...] --statistics systemd-resolve [OPTIONS...] --reset-statistics Resolve domain names, IPv4 and IPv6 addresses, DNS records, and services. -h --help Show this help --version Show package version --no-pager Do not pipe output into a pager -4 Resolve IPv4 addresses -6 Resolve IPv6 addresses -i --interface=INTERFACE Look on interface -p --protocol=PROTO|help Look via protocol -t --type=TYPE|help Query RR with DNS type -c --class=CLASS|help Query RR with DNS class --service Resolve service (SRV) --service-address=BOOL Resolve address for services (default: yes) --service-txt=BOOL Resolve TXT records for services (default: yes) --openpgp Query OpenPGP public key --tlsa Query TLS public key --cname=BOOL Follow CNAME redirects (default: yes) --search=BOOL Use search domains for single-label names (default: yes) --raw[=payload|packet] Dump the answer as binary data --legend=BOOL Print headers and additional info (default: yes) --statistics Show resolver statistics --reset-statistics Reset resolver statistics --status Show link and server status --flush-caches Flush all local DNS caches --reset-server-features Forget learnt DNS server feature levels --set-dns=SERVER Set per-interface DNS server address --set-domain=DOMAIN Set per-interface search domain --set-llmnr=MODE Set per-interface LLMNR mode --set-mdns=MODE Set per-interface MulticastDNS mode --set-dnssec=MODE Set per-interface DNSSEC mode --set-nta=DOMAIN Set per-interface DNSSEC NTA --revert Revert per-interface configuration [root@ubuntu1804 ~]#systemd-resolve --statistics DNSSEC supported by current servers: no Transactions Current Transactions: 0 Total Transactions: 53 Cache Current Cache Size: 1 Cache Hits: 2 Cache Misses: 52 DNSSEC Verdicts Secure: 0 Insecure: 0 Bogus: 0 Indeterminate: 0 #清空缓存 [root@ubuntu1804 ~]#systemd-resolve --flush-caches [root@ubuntu1804 ~]#systemd-resolve --statistics DNSSEC supported by current servers: no Transactions Current Transactions: 0 Total Transactions: 53 Cache Current Cache Size: 0 Cache Hits: 2 Cache Misses: 52 DNSSEC Verdicts Secure: 0 Insecure: 0 Bogus: 0 Indeterminate: 0
实现反向解析区域
反向解析配置
反向区域：即将IP反向解析为FQDN
区域名称：网络地址反写.in-addr.arpa.
示例：
1
172.16.100. --> 100.16.172.in-addr.arpa.
(1) 定义区域
1 2 3 4
zone "ZONE_NAME" IN { type {master|slave|forward}； file "网络地址.zone" };
(2) 定义区域解析库文件
注意：不需要A记录,以PTR记录为主
范例：
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17
$TTL 86400 $ORIGIN 16.172.in-addr.arpa. @ IN SOA ns1.wang.org. admin.wang.org. ( 2015042201 1H 5M 7D 1D )
shanghai.wang.org. IN NS ns1.ops.wang.org. shanghai.wang.org. IN NS ns2.ops.wang.org. shenzhen.wang.org. IN NS ns1.shenzhen.wang.org. shenzhen.wang.org. IN NS ns2.shenzhen.wang.org. ns1.shanghai.wang.org. IN A 1.1.1.1 ns2.shanghai.wang.org. IN A 1.1.1.2 ns1.shenzhen.wang.org. IN A 1.1.1.3 ns2.shenzhen.wang.org. IN A 1.1.1.4
