【DNS】域名服务 Bind实现-Toy模板网

这篇具有很好参考价值的文章主要介绍了【DNS】域名服务 Bind实现。希望对大家有所帮助。如果存在错误或未考虑完全的地方，请大家不吝赐教，您也可以点击"举报违法"按钮提交疑问。

一、域名解析过程

【DNS】域名服务 Bind实现

DNS域名完整解析过程

1、查询本地 hosts文件解析记录

2、查询客户端本地DNS缓存记录

3、访问DNS转发（缓存）服务器本地缓存记录

4、转发到权威服务器查询本地缓存记录

5、访问权威服务器解析记录

6、权威服务器迭代查询

　　6.1、访问子域权威服务器查询本地缓存记录

　　6.2、访问子域解析记录

7、访问根服务器解析记录

8、访问一级域名服务器解析记录

.......

二、DNS解析记录类型

1、DNS服务器类型

主DNS服务器

管理和维护所负责解析的域内解析库的服务器

从DNS服务器

从主服务器或从服务器复制（区域传输）解析库副本

缓存DNS服务器（转发器）

将客户端请求转发到指定的DNS服务器上，并将指定DNS服务器返回结果缓存到本地DNS缓存记录中，缓存DNS服务器自身不保存解析库数据，不使用自身进行域名解析。

2、解析结果类型

肯定答案：存在对应的查询结果

否定答案：请求的条目不存在等原因导致无法返回结果

权威答案：直接由存在此查询结果的DNS服务器（权威服务器）返回的结果

非权威答案：有其他非权威服务器返回的查询结果

3、资源记录RR（Resource Record）

区域解析库

　　有众多资源记录RR（Resource Record）组成

记录类型：SOA、A、AAAA、NS、CNAME、MX、TXT、PTR

SOA：Start Of Authority，起始授权记录；一个区域解析库有且仅能有一个SOA记录，且必须位于解析库的第一条

A：IPv4 正向解析资源记录

AAAA：IPv6正向解析资源记录

NS：用于标注当前区域的DNS服务器

CNAME：别名记录

MX：邮件交换器

TXT：对域名进行标识说明的一种方式，一般做验证记录会使用此项，如SPF（反垃圾邮件）记录，https验证登

PTR：

3.1、资源记录定义格式

name    [TTL]    IN      rr_type      value

使用@符号可引用当前区域名字

TTL 可以从全局继承

IN值可以通过继承上一条记录忽略不写

同一个名字可以通过多条记录定义多个值，此时DNS服务器会以轮询方式响应

同一个值也可能有多个不同定义的名字，通过多个名字指向同一个值进行定义，此时表示通过多个不同的名字找到同一台主机

3.2、SOA 记录

name：当前区域的名字

value：多个内容组成

　　当前主DNS服务器的FQDN，也可以使用当前区域的名字

　　当前区域的管理员邮箱，由于无法使用@符合，通常使用.替换，例如：root.janzen.com (root@janzen.com)

　　主从服务区域传输相关定义以及否定答案的统一TTL设置

@       IN      SOA     dns1.janzen.com　　root.janzen.com (
                         1        　　; 序列号
                         604800      ; 刷新时间
                         86400       ; 重试时间
                         2419200     ; 过期时间
                         604800 )    ; 否定答案的TTL值

3.3、A 记录

name：主机的FQDN，可以.结尾代表完整名称，也可以简写末尾不加.

value：对应的IPv4地址

dns1            A       10.0.0.20
dns2            A       10.0.0.21
gitlab.janzen.com.          A       10.0.0.13
harbor          A       10.0.0.9
harbor          A       10.0.0.10

3.4、AAAA 记录

name：主机的FQDN，可以.结尾代表完整名称，也可以简写末尾不加.

value：对应的IPv6地址

3.5、NS 记录

name：当前区域的名字

value：当前区域某DNS服务器的名字

　　相邻的两个资源记录name相同时，后续的可以省略

　　对于NS记录而言，每一条NS记录后面的名字，后续都应该有一条对应的A记录

　　一个区域可以有多条NS记录

@       IN      NS      dns1
                NS      dns2

3.6、CNAME 记录

name：别名FQDN

value：真实的FQDN

dns     IN      CNAME   dns1

3.7、MX 记录

name：当前区域的名字

value：当前区域某邮件服务器（smtp服务器）的名字

　　一个区域内，MX记录可以有多个，但每个记录的value后面都应该有一个（0-99）数字，表示此服务器的优先级

　　对于MX记录而言，每一条NS记录后面的名字，后续都应该有一条对应的A记录

@     IN      MX　　12　　mail1
　　　 IN      MX　　10　　mail2
mail1　　IN　　A　　10.0.0.31
mail2　　IN　　A　　10.0.0.32

3.8、TXT 记录

name：文本描述头

value：文本内容

_dnstxt        TXT     this is @ name server

3.9、PTR 记录

name：IP

value：FQDN

　　name的IP拥有固定写法，需要将IP反向书写，并添加特殊后缀 in-addr.arpa.

　　完整写法为：20.0.0.10.in-addr.arpa.

　　网络地址及后缀可以省略，主机地址依旧要反写

20.0.0.10.in-addr.arpa.    IN    PTR    dns.janzen.com.

#由于 10.0.0 为网络地址，可以省略 
9    IN    PTR    harbor.janzen.com.

三、DNS工具介绍

dig 工具介绍

用于测试DNS解析结果

Usage:  dig [@global-server] [domain] [q-type] [q-class] {q-opt}

Where:  domain      is in the Domain Name System
        q-class  is one of (in,hs,ch,...) [default: in]
        q-type   is one of (a,any,mx,ns,soa,hinfo,axfr,txt,...) [default:a]
                 (Use ixfr=version for type ixfr)
　　　　　q-opt　　+[no]trace (Trace delegation down from root [+dnssec]) 
　　　　　　　　　　+[no]recurse (Recursive mode (+[no]rdflag))

#获取目标dns全部解析记录
dig -tAXFR janzen.com @10.0.0.21

#跟踪域名解析路径
dig +trace app3.janzen.com @10.0.0.21

#查询PTR记录
dig -x 10.0.0.21

#直接显示域名查询结果
dig +short app3.janzen.com @10.0.0.71

nslookup工具

nslookup [-option] [name | -] [server]

rndc DNS管理工具

Usage: rndc [-b address] [-c config] [-s server] [-p port]
    [-k key-file ] [-y key] [-r] [-V] command

command is one of the following:
  addzone zone [class [view]] { zone-options }
        Add zone to given view. Requires allow-new-zones option.
  delzone [-clean] zone [class [view]]
        Removes zone from given view.
  dnstap -reopen
        Close, truncate and re-open the DNSTAP output file.
  dnstap -roll count
        Close, rename and re-open the DNSTAP output file(s).
  dumpdb [-all|-cache|-zones|-adb|-bad|-fail] [view ...]
        Dump cache(s) to the dump file (named_dump.db).
  flush     Flushes all of the server's caches.
  flush [view]    Flushes the server's cache for a view.
  flushname name [view]
        Flush the given name from the server's cache(s)
  flushtree name [view]
        Flush all names under the given name from the server's cache(s)
  freeze    Suspend updates to all dynamic zones.
  freeze zone [class [view]]
        Suspend updates to a dynamic zone.
  halt        Stop the server without saving pending updates.
  halt -p    Stop the server without saving pending updates reporting
        process id.
  loadkeys zone [class [view]]
        Update keys without signing immediately.
  managed-keys refresh [class [view]]
        Check trust anchor for RFC 5011 key changes
  managed-keys status [class [view]]
        Display RFC 5011 managed keys information
  managed-keys sync [class [view]]
        Write RFC 5011 managed keys to disk
  modzone zone [class [view]] { zone-options }
        Modify a zone's configuration.
        Requires allow-new-zones option.
  notify zone [class [view]]
        Resend NOTIFY messages for the zone.
  notrace    Set debugging level to 0.
  nta -dump
        List all negative trust anchors.
  nta [-lifetime duration] [-force] domain [view]
        Set a negative trust anchor, disabling DNSSEC validation
        for the given domain.
        Using -lifetime specifies the duration of the NTA, up
        to one week.
        Using -force prevents the NTA from expiring before its
        full lifetime, even if the domain can validate sooner.
  nta -remove domain [view]
        Remove a negative trust anchor, re-enabling validation
        for the given domain.
  querylog [ on | off ]
        Enable / disable query logging.
  reconfig    Reload configuration file and new zones only.
  recursing    Dump the queries that are currently recursing (named.recursing)
  refresh zone [class [view]]
        Schedule immediate maintenance for a zone.
  reload    Reload configuration file and zones.
  reload zone [class [view]]
        Reload a single zone.
  retransfer zone [class [view]]
        Retransfer a single zone without checking serial number.
  scan        Scan available network interfaces for changes.
  secroots [view ...]
        Write security roots to the secroots file.
  showzone zone [class [view]]
        Print a zone's configuration.
  sign zone [class [view]]
        Update zone keys, and sign as needed.
  signing -clear all zone [class [view]]
        Remove the private records for all keys that have
        finished signing the given zone.
  signing -clear <keyid>/<algorithm> zone [class [view]]
        Remove the private record that indicating the given key
        has finished signing the given zone.
  signing -list zone [class [view]]
        List the private records showing the state of DNSSEC
        signing in the given zone.
  signing -nsec3param hash flags iterations salt zone [class [view]]
        Add NSEC3 chain to zone if already signed.
        Prime zone with NSEC3 chain if not yet signed.
  signing -nsec3param none zone [class [view]]
        Remove NSEC3 chains from zone.
  signing -serial <value> zone [class [view]]
        Set the zones's serial to <value>.
  stats        Write server statistics to the statistics file.
  status    Display status of the server.
  stop        Save pending updates to master files and stop the server.
  stop -p    Save pending updates to master files and stop the server
        reporting process id.
  sync [-clean]    Dump changes to all dynamic zones to disk, and optionally
        remove their journal files.
  sync [-clean] zone [class [view]]
        Dump a single zone's changes to disk, and optionally
        remove its journal file.
  thaw        Enable updates to all dynamic zones and reload them.
  thaw zone [class [view]]
        Enable updates to a frozen dynamic zone and reload it.
  trace        Increment debugging level by one.
  trace level    Change the debugging level.
  tsig-delete keyname [view]
        Delete a TKEY-negotiated TSIG key.
  tsig-list    List all currently active TSIG keys, including both statically
        configured and TKEY-negotiated keys.
  validation [ yes | no | status ] [view]
        Enable / disable DNSSEC validation.
  zonestatus zone [class [view]]
        Display the current status of a zone.

Version: 9.11.3-1ubuntu1.18-Ubuntu

四、DNS安装部署

1、Centos7 配置域名正向解析主服务器

1.1、yum安装bind服务，及DNS工具 bind-utils

yum install -y bind bind-utils

1.2、修改 named.conf 配置文件，禁用服务限制，引入区域配置文件

[root@node-centos7-70 ~]# vim /etc/named.conf 

options {
    # listen-on port 53 { 127.0.0.1; };
    listen-on-v6 port 53 { ::1; };
    directory     "/var/named";
    dump-file     "/var/named/data/cache_dump.db";
    statistics-file "/var/named/data/named_stats.txt";
    memstatistics-file "/var/named/data/named_mem_stats.txt";
    recursing-file  "/var/named/data/named.recursing";
    secroots-file   "/var/named/data/named.secroots";
    # allow-query     { localhost; };

    recursion yes;

    dnssec-enable yes;
    dnssec-validation yes;

    /* Path to ISC DLV key */
    bindkeys-file "/etc/named.root.key";

    managed-keys-directory "/var/named/dynamic";

    pid-file "/run/named/named.pid";
    session-keyfile "/run/named/session.key";
};

logging {
        channel default_debug {
                file "data/named.run";
                severity dynamic;
        };
};

zone "." IN {
    type hint;
    file "named.ca";
};

include "/etc/named.rfc1912.zones";
include "/etc/named.root.key";
include "/etc/named.zones"

1.3、创建 named.zones 区域配置文件

[root@node-centos7-70 ~]# vim /etc/named.zones

zone "janzen.com" IN { type master; file "named.janzen.com"; allow-update { none; }; };

1.4、创建 named.janzen.com 区域解析库文件

[root@node-centos7-70 etc]# vim /var/named/named.janzen.com

;
; BIND reverse data file for broadcast zone
;
$TTL    604800
@       IN      SOA     janzen.com. root.localhost. (
                              1         ; Serial
                         604800         ; Refresh
                          86400         ; Retry
                        2419200         ; Expire
                         604800 )       ; Negative Cache TTL
;
@       IN      NS      dns1
        IN      NS      dns2
        IN      MX　　12　　mail1
        IN      MX　　10　　mail2
dns     IN      CNAME   dns1
dns1    IN      A       10.0.0.20
dns2    IN      A       10.0.0.21
gitlab  IN      A       10.0.0.13
harbor  IN      A       10.0.0.9
harbor  IN      A       10.0.0.10
www     IN      A       10.0.0.11
mail1   IN      A       10.0.0.31
mail2   IN      A       10.0.0.32
_dnstext IN     TXT     this is @ name server

1.5、修改文件权限

[root@node-centos7-70 etc]# chmod 640 {/etc/named.zones,/var/named/named.janzen.com}
[root@node-centos7-70 etc]# chgrp named {/etc/named.zones,/var/named/named.janzen.com}

1.6、设置named服务开机自启动

[root@node-centos7-70 etc]# systemctl enable --now named

1.7、使用dig测试DNS服务

[root@node-centos7-70 etc]# dig dns.janzen.com @10.0.0.70

; <<>> DiG 9.11.4-P2-RedHat-9.11.4-26.P2.el7_9.13 <<>> dns.janzen.com @10.0.0.70
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 51429
;; flags: qr aa rd ra; QUERY: 1, ANSWER: 2, AUTHORITY: 2, ADDITIONAL: 2

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 4096
;; QUESTION SECTION:
;dns.janzen.com.            IN    A

;; ANSWER SECTION:
dns.janzen.com.        604800    IN    CNAME    dns1.janzen.com.
dns1.janzen.com.    604800    IN    A    10.0.0.20

;; AUTHORITY SECTION:
janzen.com.        604800    IN    NS    dns2.janzen.com.
janzen.com.        604800    IN    NS    dns1.janzen.com.

;; ADDITIONAL SECTION:
dns2.janzen.com.    604800    IN    A    10.0.0.21

;; Query time: 0 msec
;; SERVER: 10.0.0.70#53(10.0.0.70)
;; WHEN: 四 5月 25 18:16:54 CST 2023
;; MSG SIZE  rcvd: 127

[root@node-centos7-70 etc]# dig janzen.com @10.0.0.70 mx

; <<>> DiG 9.11.4-P2-RedHat-9.11.4-26.P2.el7_9.13 <<>> janzen.com @10.0.0.70 mx
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 2566
;; flags: qr aa rd ra; QUERY: 1, ANSWER: 2, AUTHORITY: 2, ADDITIONAL: 5

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 4096
;; QUESTION SECTION:
;janzen.com.            IN    MX

;; ANSWER SECTION:
janzen.com.        604800    IN    MX    10 mail2.janzen.com.
janzen.com.        604800    IN    MX    12 mail1.janzen.com.

;; AUTHORITY SECTION:
janzen.com.        604800    IN    NS    dns2.janzen.com.
janzen.com.        604800    IN    NS    dns1.janzen.com.

;; ADDITIONAL SECTION:
mail1.janzen.com.    604800    IN    A    10.0.0.31
mail2.janzen.com.    604800    IN    A    10.0.0.32
dns1.janzen.com.    604800    IN    A    10.0.0.20
dns2.janzen.com.    604800    IN    A    10.0.0.21

;; Query time: 0 msec
;; SERVER: 10.0.0.70#53(10.0.0.70)
;; WHEN: 四 5月 25 18:18:09 CST 2023
;; MSG SIZE  rcvd: 185

[root@node-centos7-70 etc]# dig harbor.janzen.com @10.0.0.70

; <<>> DiG 9.11.4-P2-RedHat-9.11.4-26.P2.el7_9.13 <<>> harbor.janzen.com @10.0.0.70
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 33334
;; flags: qr aa rd ra; QUERY: 1, ANSWER: 2, AUTHORITY: 2, ADDITIONAL: 3

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 4096
;; QUESTION SECTION:
;harbor.janzen.com.        IN    A

;; ANSWER SECTION:
harbor.janzen.com.    604800    IN    A    10.0.0.10
harbor.janzen.com.    604800    IN    A    10.0.0.9

;; AUTHORITY SECTION:
janzen.com.        604800    IN    NS    dns1.janzen.com.
janzen.com.        604800    IN    NS    dns2.janzen.com.

;; ADDITIONAL SECTION:
dns1.janzen.com.    604800    IN    A    10.0.0.20
dns2.janzen.com.    604800    IN    A    10.0.0.21

;; Query time: 0 msec
;; SERVER: 10.0.0.70#53(10.0.0.70)
;; WHEN: 四 5月 25 18:20:07 CST 2023
;; MSG SIZE  rcvd: 148

1.8、修改区域解析库文件内容，使用 rndc 重载配置

[root@node-centos7-70 etc]# vim /var/named/named.janzen.com 
$TTL    604800
@       IN      SOA     janzen.com. root.localhost. (
                              2         ; Serial
                         604800         ; Refresh
                          86400         ; Retry
                        2419200         ; Expire
                         604800 )       ; Negative Cache TTL
@       IN      NS      dns1
        IN      NS      dns2
        IN      MX    12    mail1
        IN      MX    10    mail2
dns     IN      CNAME   dns1
dns1    IN      A       10.0.0.70
dns2    IN      A       10.0.0.21
gitlab  IN      A       10.0.0.13
harbor  IN      A       10.0.0.9
harbor  IN      A       10.0.0.10
www     IN      A       10.0.0.11
mail1   IN      A       10.0.0.31
mail2   IN      A       10.0.0.32
_dnstext IN     TXT     this is @ name server

[root@node-centos7-70 etc]# rndc reload
server reload successful

[root@node-centos7-70 etc]# dig dns.janzen.com @10.0.0.70

; <<>> DiG 9.11.4-P2-RedHat-9.11.4-26.P2.el7_9.13 <<>> dns.janzen.com @10.0.0.70
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 5247
;; flags: qr aa rd ra; QUERY: 1, ANSWER: 2, AUTHORITY: 2, ADDITIONAL: 2

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 4096
;; QUESTION SECTION:
;dns.janzen.com.            IN    A

;; ANSWER SECTION:
dns.janzen.com.        604800    IN    CNAME    dns1.janzen.com.
dns1.janzen.com.    604800    IN    A    10.0.0.70

;; AUTHORITY SECTION:
janzen.com.        604800    IN    NS    dns2.janzen.com.
janzen.com.        604800    IN    NS    dns1.janzen.com.

;; ADDITIONAL SECTION:
dns2.janzen.com.    604800    IN    A    10.0.0.21

;; Query time: 0 msec
;; SERVER: 10.0.0.70#53(10.0.0.70)
;; WHEN: 四 5月 25 18:27:45 CST 2023
;; MSG SIZE  rcvd: 127

2、Ubuntu apt安装bind服务

1.1、apt安装bind9服务，及DNS工具 bind9utils

[root@Node-Ubuntu1804-20:~]# apt install -y bind9 bind9utils

1.2、修改 named.conf 配置文件，引入区域配置文件

[root@Node-Ubuntu1804-20:~]# cat /etc/bind/named.conf
// This is the primary configuration file for the BIND DNS server named.
//
// Please read /usr/share/doc/bind9/README.Debian.gz for information on the 
// structure of BIND configuration files in Debian, *BEFORE* you customize 
// this configuration file.
//
// If you are just adding zones, please do that in /etc/bind/named.conf.local

include "/etc/bind/named.conf.options";
include "/etc/bind/named.conf.local";
include "/etc/bind/named.conf.default-zones";
include "/etc/bind/named.zones";

1.3、创建 named.zones 区域配置文件

[root@Node-Ubuntu1804-20:~]# vim /etc/bind/named.zones

zone janzen.com IN { type master; file "/etc/bind/db.janzen.com"; };

1.4、创建 db.janzen.com 区域解析库文件

[root@Node-Ubuntu1804-20:~]# vim /etc/bind/db.janzen.com

$TTL    604800                                                                                                                                  
@       IN      SOA     janzen.com. root.localhost. (
                              1         ; Serial
                         604800         ; Refresh
                          86400         ; Retry
                        2419200         ; Expire
                         604800 )       ; Negative Cache TTL
@       IN      NS      dns1
        IN      NS      dns2
        IN      MX      12      mail1
        IN      MX      10      mail2
dns     IN      CNAME   dns1
dns1    IN      A       10.0.0.20
dns2    IN      A       10.0.0.21
gitlab  IN      A       10.0.0.13
harbor  IN      A       10.0.0.9
harbor  IN      A       10.0.0.10
www     IN      A       10.0.0.11
mail1   IN      A       10.0.0.31
mail2   IN      A       10.0.0.32
_dnstext IN     TXT     this is @ name server

1.5、修改文件权限

[root@Node-Ubuntu1804-20:~]# chmod 640 /etc/bind/{named.zones,db.janzen.com} [root@Node-Ubuntu1804-20:~]# chgrp bind /etc/bind/{named.zones,db.janzen.com}

1.6、启动 bind9 服务

[root@Node-Ubuntu1804-20:~]# systemctl start bind9

1.7、使用dig测试DNS服务

[root@Ansible-Ubuntu1804-25:~]# dig dns.janzen.com @10.0.0.20

; <<>> DiG 9.11.3-1ubuntu1.18-Ubuntu <<>> dns.janzen.com @10.0.0.20
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 32150
;; flags: qr aa rd ra; QUERY: 1, ANSWER: 2, AUTHORITY: 2, ADDITIONAL: 2

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 4096
; COOKIE: 95d843b6344528dfc99349d4646f3bbb5812908fa82e3d3f (good)
;; QUESTION SECTION:
;dns.janzen.com.            IN    A

;; ANSWER SECTION:
dns.janzen.com.        604800    IN    CNAME    dns1.janzen.com.
dns1.janzen.com.    604800    IN    A    10.0.0.20

;; AUTHORITY SECTION:
janzen.com.        604800    IN    NS    dns1.janzen.com.
janzen.com.        604800    IN    NS    dns2.janzen.com.

;; ADDITIONAL SECTION:
dns2.janzen.com.    604800    IN    A    10.0.0.21

;; Query time: 0 msec
;; SERVER: 10.0.0.20#53(10.0.0.20)
;; WHEN: Thu May 25 18:43:07 CST 2023
;; MSG SIZE  rcvd: 155

[root@Ansible-Ubuntu1804-25:~]# dig janzen.com @10.0.0.20 mx

; <<>> DiG 9.11.3-1ubuntu1.18-Ubuntu <<>> janzen.com @10.0.0.20 mx
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 11520
;; flags: qr aa rd ra; QUERY: 1, ANSWER: 2, AUTHORITY: 2, ADDITIONAL: 5

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 4096
; COOKIE: 2bd0379cc8f4ca918c8ed28e646f3c5c2d56e5c3704f4752 (good)
;; QUESTION SECTION:
;janzen.com.            IN    MX

;; ANSWER SECTION:
janzen.com.        604800    IN    MX    10 mail2.janzen.com.
janzen.com.        604800    IN    MX    12 mail1.janzen.com.

;; AUTHORITY SECTION:
janzen.com.        604800    IN    NS    dns2.janzen.com.
janzen.com.        604800    IN    NS    dns1.janzen.com.

;; ADDITIONAL SECTION:
mail2.janzen.com.    604800    IN    A    10.0.0.32
mail1.janzen.com.    604800    IN    A    10.0.0.31
dns1.janzen.com.    604800    IN    A    10.0.0.20
dns2.janzen.com.    604800    IN    A    10.0.0.21

;; Query time: 1 msec
;; SERVER: 10.0.0.20#53(10.0.0.20)
;; WHEN: Thu May 25 18:45:48 CST 2023
;; MSG SIZE  rcvd: 213

[root@Ansible-Ubuntu1804-25:~]# dig harbor.janzen.com @10.0.0.20

; <<>> DiG 9.11.3-1ubuntu1.18-Ubuntu <<>> harbor.janzen.com @10.0.0.20
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 45201
;; flags: qr aa rd ra; QUERY: 1, ANSWER: 2, AUTHORITY: 2, ADDITIONAL: 3

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 4096
; COOKIE: 97efe511ca506c99495a4d4d646f3c70aac936a36fab58f2 (good)
;; QUESTION SECTION:
;harbor.janzen.com.        IN    A

;; ANSWER SECTION:
harbor.janzen.com.    604800    IN    A    10.0.0.9
harbor.janzen.com.    604800    IN    A    10.0.0.10

;; AUTHORITY SECTION:
janzen.com.        604800    IN    NS    dns2.janzen.com.
janzen.com.        604800    IN    NS    dns1.janzen.com.

;; ADDITIONAL SECTION:
dns1.janzen.com.    604800    IN    A    10.0.0.20
dns2.janzen.com.    604800    IN    A    10.0.0.21

;; Query time: 1 msec
;; SERVER: 10.0.0.20#53(10.0.0.20)
;; WHEN: Thu May 25 18:46:08 CST 2023
;; MSG SIZE  rcvd: 176

1.8、修改区域解析库文件内容，使用 rndc 重载配置

[root@Node-Ubuntu1804-20:~]# vim /etc/bind/db.janzen.com

$TTL    604800
@       IN      SOA     janzen.com. root.localhost. (
                              2         ; Serial                                                                                                
                         604800         ; Refresh
                          86400         ; Retry
                        2419200         ; Expire
                         604800 )       ; Negative Cache TTL
@       IN      NS      dns1
        IN      NS      dns2
        IN      NS      dns3
        IN      MX      12      mail1
        IN      MX      10      mail2
dns     IN      CNAME   dns1
dns1    IN      A       10.0.0.20
dns2    IN      A       10.0.0.21
dns3    IN      A       10.0.0.70
gitlab  IN      A       10.0.0.13
harbor  IN      A       10.0.0.9
harbor  IN      A       10.0.0.10
www     IN      A       10.0.0.11
mail1   IN      A       10.0.0.31
mail2   IN      A       10.0.0.32
_dnstext IN     TXT     this is @ name server

[root@Node-Ubuntu1804-20:~]# rndc reload janzen.com
zone reload queued

[root@Ansible-Ubuntu1804-25:~]# dig ns janzen.com @10.0.0.20

; <<>> DiG 9.11.3-1ubuntu1.18-Ubuntu <<>> ns janzen.com @10.0.0.20
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 1374
;; flags: qr aa rd ra; QUERY: 1, ANSWER: 3, AUTHORITY: 0, ADDITIONAL: 4

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 4096
; COOKIE: f4619011881ac8168f1e6981646f3ce9f82e1484c3c43f22 (good)
;; QUESTION SECTION:
;janzen.com.            IN    NS

;; ANSWER SECTION:
janzen.com.        604800    IN    NS    dns2.janzen.com.
janzen.com.        604800    IN    NS    dns1.janzen.com.
janzen.com.        604800    IN    NS    dns3.janzen.com.

;; ADDITIONAL SECTION:
dns1.janzen.com.    604800    IN    A    10.0.0.20
dns2.janzen.com.    604800    IN    A    10.0.0.21
dns3.janzen.com.    604800    IN    A    10.0.0.70

;; Query time: 0 msec
;; SERVER: 10.0.0.20#53(10.0.0.20)
;; WHEN: Thu May 25 18:48:09 CST 2023
;; MSG SIZE  rcvd: 172

五、DNS反向解析配置

1、Centos7 配置反向解析

1.1、在 named.zones 中添加反向解析区域记录

[root@node-centos7-70 etc]# vim /etc/named.zones 

zone "janzen.com" IN { type master; file "named.janzen.com"; allow-update { none; }; };
zone "0.0.10.in-addr.arpa" IN { type master; file "named.10.0.0"; };

1.2、创建 named.10.0.0 区域反向解析库

[root@node-centos7-70 etc]# vim /var/named/named.10.0.0

$TTL    604800
@       IN      SOA     janzen.com. root.localhost. (
                              2         ; Serial
                         604800         ; Refresh
                          86400         ; Retry
                        2419200         ; Expire
                         604800 )       ; Negative Cache TTL
                NS      dns1.janzen.com.
70      IN      PTR     dns1.janzen.com.
21      IN      PTR     dns2.janzen.com.
9       IN      PTR     harbor.janzen.com.
10      IN      PTR     harbor.janzen.com.
31      IN      PTR     mail1.janzen.com.
32      IN      PTR     mail2.janzen.com.

1.3、重新加载服务

[root@node-centos7-70 etc]# rndc reload
server reload successful

1.4、校验反向解析效果

[root@Node-Ubuntu1804-20:~]# dig -t ptr 9.0.0.10.in-addr.arpa. @10.0.0.70

; <<>> DiG 9.11.3-1ubuntu1.18-Ubuntu <<>> -t ptr 9.0.0.10.in-addr.arpa. @10.0.0.70
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 17291
;; flags: qr aa rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 1, ADDITIONAL: 2

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 4096
; COOKIE: d92a9b9a0cba6df1281d8d7a646f4fe3ba882373c080d21e (good)
;; QUESTION SECTION:
;9.0.0.10.in-addr.arpa.        IN    PTR

;; ANSWER SECTION:
9.0.0.10.in-addr.arpa.    604800    IN    PTR    harbor.janzen.com.

;; AUTHORITY SECTION:
0.0.10.in-addr.arpa.    604800    IN    NS    dns1.janzen.com.

;; ADDITIONAL SECTION:
dns1.janzen.com.    604800    IN    A    10.0.0.70

;; Query time: 0 msec
;; SERVER: 10.0.0.70#53(10.0.0.70)
;; WHEN: Thu May 25 20:09:07 CST 2023
;; MSG SIZE  rcvd: 144

[root@Node-Ubuntu1804-20:~]# dig -t ptr 31.0.0.10.in-addr.arpa. @10.0.0.70

; <<>> DiG 9.11.3-1ubuntu1.18-Ubuntu <<>> -t ptr 31.0.0.10.in-addr.arpa. @10.0.0.70
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 40029
;; flags: qr aa rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 1, ADDITIONAL: 2

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 4096
; COOKIE: 96c1482be18e12c7c27f80ae646f4fe90a240b78bb3e6e6c (good)
;; QUESTION SECTION:
;31.0.0.10.in-addr.arpa.        IN    PTR

;; ANSWER SECTION:
31.0.0.10.in-addr.arpa.    604800    IN    PTR    mail1.janzen.com.

;; AUTHORITY SECTION:
0.0.10.in-addr.arpa.    604800    IN    NS    dns1.janzen.com.

;; ADDITIONAL SECTION:
dns1.janzen.com.    604800    IN    A    10.0.0.70

;; Query time: 0 msec
;; SERVER: 10.0.0.70#53(10.0.0.70)
;; WHEN: Thu May 25 20:09:13 CST 2023
;; MSG SIZE  rcvd: 144

2、Ubuntu 配置反向解析

2.1、在 named.zones 中添加反向解析区域记录

[root@Node-Ubuntu1804-20:~]# vim /etc/bind/named.zones 

zone janzen.com IN { type master; file "/etc/bind/db.janzen.com"; };                                                                            
zone "0.0.10.in-addr.arpa" IN { type master; file "/etc/bind/db.10.0.0"; };

2.2、创建区域反向解析库

[root@Node-Ubuntu1804-20:~]# vim /etc/bind/db.10.0.0

$TTL    604800
@       IN      SOA     @ root.janzen.com. (
                              1         ; Serial
                         604800         ; Refresh
                          86400         ; Retry
                        2419200         ; Expire
                         604800 )       ; Negative Cache TTL
                NS      dns1.janzen.com.
                NS      dns2.janzen.com.
                NS      dns3.janzen.com.                                                                                                        
20      IN      PTR     dns1.janzen.com.
21      IN      PTR     dns2.janzen.com.
70      IN      PTR     dns3.janzen.com.
9       IN      PTR     harbor.janzen.com.
10      IN      PTR     harbor.janzen.com.
31      IN      PTR     mail1.janzen.com.
32      IN      PTR     mail2.janzen.com.
~

2.3、重新加载服务

[root@Node-Ubuntu1804-20:~]# rndc reload
server reload successful

2.4、验证反向解析结果

[root@Ansible-Ubuntu1804-25:~]# dig -t ptr 20.0.0.10.in-addr.arpa. @10.0.0.20

; <<>> DiG 9.11.3-1ubuntu1.18-Ubuntu <<>> -t ptr 20.0.0.10.in-addr.arpa. @10.0.0.20
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 30257
;; flags: qr aa rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 3, ADDITIONAL: 4

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 4096
; COOKIE: 84ac957d868c866b33777194646f52bc2f65ef3bae2f140f (good)
;; QUESTION SECTION:
;20.0.0.10.in-addr.arpa.        IN    PTR

;; ANSWER SECTION:
20.0.0.10.in-addr.arpa.    604800    IN    PTR    dns1.janzen.com.

;; AUTHORITY SECTION:
0.0.10.in-addr.arpa.    604800    IN    NS    dns1.janzen.com.
0.0.10.in-addr.arpa.    604800    IN    NS    dns3.janzen.com.
0.0.10.in-addr.arpa.    604800    IN    NS    dns2.janzen.com.

;; ADDITIONAL SECTION:
dns1.janzen.com.    604800    IN    A    10.0.0.20
dns2.janzen.com.    604800    IN    A    10.0.0.21
dns3.janzen.com.    604800    IN    A    10.0.0.70

;; Query time: 0 msec
;; SERVER: 10.0.0.20#53(10.0.0.20)
;; WHEN: Thu May 25 20:21:17 CST 2023
;; MSG SIZE  rcvd: 208

[root@Ansible-Ubuntu1804-25:~]# dig -t ptr 70.0.0.10.in-addr.arpa. @10.0.0.20

; <<>> DiG 9.11.3-1ubuntu1.18-Ubuntu <<>> -t ptr 70.0.0.10.in-addr.arpa. @10.0.0.20
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 28274
;; flags: qr aa rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 3, ADDITIONAL: 4

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 4096
; COOKIE: cb50d5bc319d559d22178c59646f52c728e60ab6e3f06ad3 (good)
;; QUESTION SECTION:
;70.0.0.10.in-addr.arpa.        IN    PTR

;; ANSWER SECTION:
70.0.0.10.in-addr.arpa.    604800    IN    PTR    dns3.janzen.com.

;; AUTHORITY SECTION:
0.0.10.in-addr.arpa.    604800    IN    NS    dns2.janzen.com.
0.0.10.in-addr.arpa.    604800    IN    NS    dns3.janzen.com.
0.0.10.in-addr.arpa.    604800    IN    NS    dns1.janzen.com.

;; ADDITIONAL SECTION:
dns1.janzen.com.    604800    IN    A    10.0.0.20
dns2.janzen.com.    604800    IN    A    10.0.0.21
dns3.janzen.com.    604800    IN    A    10.0.0.70

;; Query time: 0 msec
;; SERVER: 10.0.0.20#53(10.0.0.20)
;; WHEN: Thu May 25 20:21:27 CST 2023
;; MSG SIZE  rcvd: 208

六、DNS主从架构部署

1、Centos7 主从架构配置

1.1、主服务器配置

[root@node-centos7-70 etc]# vim /etc/named.conf 

//
// named.conf
//
// Provided by Red Hat bind package to configure the ISC BIND named(8) DNS
// server as a caching only nameserver (as a localhost DNS resolver only).
//
// See /usr/share/doc/bind*/sample/ for example named configuration files.
//
// See the BIND Administrator's Reference Manual (ARM) for details about the
// configuration located in /usr/share/doc/bind-{version}/Bv9ARM.html

options {
    # listen-on port 53 { 127.0.0.1; };
    listen-on-v6 port 53 { ::1; };
    directory     "/var/named";
    dump-file     "/var/named/data/cache_dump.db";
    statistics-file "/var/named/data/named_stats.txt";
    memstatistics-file "/var/named/data/named_mem_stats.txt";
    recursing-file  "/var/named/data/named.recursing";
    secroots-file   "/var/named/data/named.secroots";
    # allow-query     { localhost; };
    allow-transfer    { none; };

    /* 
     - If you are building an AUTHORITATIVE DNS server, do NOT enable recursion.
     - If you are building a RECURSIVE (caching) DNS server, you need to enable 
       recursion. 
     - If your recursive DNS server has a public IP address, you MUST enable access 
       control to limit queries to your legitimate users. Failing to do so will
       cause your server to become part of large scale DNS amplification 
       attacks. Implementing BCP38 within your network would greatly
       reduce such attack surface 
    */
    recursion yes;

    dnssec-enable yes;
    dnssec-validation yes;

    /* Path to ISC DLV key */
    bindkeys-file "/etc/named.root.key";

    managed-keys-directory "/var/named/dynamic";

    pid-file "/run/named/named.pid";
    session-keyfile "/run/named/session.key";
};

logging {
        channel default_debug {
                file "data/named.run";
                severity dynamic;
        };
};

zone "." IN {
    type hint;
    file "named.ca";
};

include "/etc/named.rfc1912.zones";
include "/etc/named.root.key";
include "/etc/named.zones";


[root@node-centos7-70 etc]# vim /etc/named.zones 

zone "janzen.com" IN { type master; file "named.janzen.com"; allow-update { none; }; allow-transfer { 10.0.0.71; }; };
zone "0.0.10.in-addr.arpa" IN { type master; file "named.10.0.0"; };

1.2、从服务器配置

[root@node-centos7-71 ~]# vim /etc/named.conf 
//
// named.conf
//
// Provided by Red Hat bind package to configure the ISC BIND named(8) DNS
// server as a caching only nameserver (as a localhost DNS resolver only).
//
// See /usr/share/doc/bind*/sample/ for example named configuration files.
//
// See the BIND Administrator's Reference Manual (ARM) for details about the
// configuration located in /usr/share/doc/bind-{version}/Bv9ARM.html

options {
    # listen-on port 53 { 127.0.0.1; };
    listen-on-v6 port 53 { ::1; };
    directory     "/var/named";
    dump-file     "/var/named/data/cache_dump.db";
    statistics-file "/var/named/data/named_stats.txt";
    memstatistics-file "/var/named/data/named_mem_stats.txt";
    recursing-file  "/var/named/data/named.recursing";
    secroots-file   "/var/named/data/named.secroots";
    # allow-query     { localhost; };
    allow-tranfer    { none; };

    /* 
     - If you are building an AUTHORITATIVE DNS server, do NOT enable recursion.
     - If you are building a RECURSIVE (caching) DNS server, you need to enable 
       recursion. 
     - If your recursive DNS server has a public IP address, you MUST enable access 
       control to limit queries to your legitimate users. Failing to do so will
       cause your server to become part of large scale DNS amplification 
       attacks. Implementing BCP38 within your network would greatly
       reduce such attack surface 
    */
    recursion yes;

    dnssec-enable yes;
    dnssec-validation yes;

    /* Path to ISC DLV key */
    bindkeys-file "/etc/named.root.key";

    managed-keys-directory "/var/named/dynamic";

    pid-file "/run/named/named.pid";
    session-keyfile "/run/named/session.key";
};

logging {
        channel default_debug {
                file "data/named.run";
                severity dynamic;
        };
};

zone "." IN {
    type hint;
    file "named.ca";
};

include "/etc/named.rfc1912.zones";
include "/etc/named.root.key";
include "/etc/named.zones";


[root@node-centos7-71 ~]# vim /etc/named.zones 
zone "janzen.com" IN { type slave; file "slaves/named.janzen.com.slave"; masters { 10.0.0.70; } };

2、Ubuntu 主从架构配置

2.1、主服务器配置

[root@Node-Ubuntu1804-20:~]# cat /etc/bind/named.conf | grep -v ^$ | grep -v ".*//"
include "/etc/bind/named.conf.options";
include "/etc/bind/named.conf.local";
include "/etc/bind/named.conf.default-zones";
include "/etc/bind/named.zones";

[root@Node-Ubuntu1804-20:~]# cat /etc/bind/named.conf.options | grep -v ^$ | grep -v ".*//"
options {
    directory "/var/cache/bind";
    dnssec-validation auto;
    auth-nxdomain no;    # conform to RFC1035
    listen-on-v6 { any; };
    allow-transfer { none; };
};

[root@Node-Ubuntu1804-20:~]# cat /etc/bind/named.zones 
zone janzen.com IN { type master; file "/etc/bind/db.janzen.com"; allow-transfer { 10.0.0.21; }; also-notify { 10.0.0.21; }; };

2.2、从服务器配置

[root@Node-Ubuntu1804-21:~]# cat /etc/bind/named.conf | grep -v ^$ | grep -v ".*//"
include "/etc/bind/named.conf.options";
include "/etc/bind/named.conf.local";
include "/etc/bind/named.conf.default-zones";
include "/etc/bind/named.zones";


[root@Node-Ubuntu1804-21:~]# cat /etc/bind/named.conf.options | grep -v ^$ | grep -v ".*//"
options {
    directory "/var/cache/bind";
    dnssec-validation auto;
    auth-nxdomain no;    # conform to RFC1035
    listen-on-v6 { any; };
    allow-transfer { none; };
};

[root@Node-Ubuntu1804-21:~]# cat /etc/bind/named.zones 
zone janzen.com IN { type slave; file "/etc/bind/db.janzen.com.slave"; masters { 10.0.0.20; }; };

七、DNS转发配置

1、Centos7 转发服务器配置

1.1、全局转发

[root@node-centos7-71 ~]# cat /etc/named.conf | grep  -v ^$ | grep -v ".*//"
options {
    listen-on-v6 port 53 { ::1; };
    directory     "/var/named";
    dump-file     "/var/named/data/cache_dump.db";
    statistics-file "/var/named/data/named_stats.txt";
    memstatistics-file "/var/named/data/named_mem_stats.txt";
    recursing-file  "/var/named/data/named.recursing";
    secroots-file   "/var/named/data/named.secroots";
    allow-transfer { none; };
    forward first;
    forwarders {10.0.0.70;};
/* 
     - If you are building an AUTHORITATIVE DNS server, do NOT enable recursion.
     - If you are building a RECURSIVE (caching) DNS server, you need to enable 
       recursion. 
     - If your recursive DNS server has a public IP address, you MUST enable access 
       control to limit queries to your legitimate users. Failing to do so will
       cause your server to become part of large scale DNS amplification 
       attacks. Implementing BCP38 within your network would greatly
       reduce such attack surface 
    */
    recursion yes;
    dnssec-enable yes;
    dnssec-validation yes;
    /* Path to ISC DLV key */
    bindkeys-file "/etc/named.root.key";
    managed-keys-directory "/var/named/dynamic";
    pid-file "/run/named/named.pid";
    session-keyfile "/run/named/session.key";
};
logging {
        channel default_debug {
                file "data/named.run";
                severity dynamic;
        };
};
zone "." IN {
    type hint;
    file "named.ca";
};
include "/etc/named.rfc1912.zones";
include "/etc/named.root.key";
include "/etc/named.zones";

1.2、指定域转发

[root@node-centos7-71 ~]# cat /etc/named.zones 
zone janzen.cn IN { type forward; forward only; forwarders { 10.0.0.70; }; };

2、Ubuntu 转发服务器配置

2.1、全局转发

[root@Node-Ubuntu1804-21:~]# cat /etc/bind/named.conf.options | grep -v ^$ | grep -v ".*//"
options {
    directory "/var/cache/bind";
    forward first;
    forwarders { 10.0.0.20; };
    dnssec-validation auto;
    auth-nxdomain no;    # conform to RFC1035
    listen-on-v6 { any; };
    allow-transfer { none; };
};

2.2、指定域转发

[root@Node-Ubuntu1804-21:~]# cat /etc/bind/named.zones | grep -v ^$ | grep -v ".*//"
zone janzen.cn IN { type forward; forward only; forwarders { 10.0.0.20; }; };

文章来源地址https://www.toymoban.com/news/detail-471215.html

到了这里，关于【DNS】域名服务 Bind实现的文章就介绍完了。如果您还想了解更多内容，请在右上角搜索TOY模板网以前的文章或继续浏览下面的相关文章，希望大家以后多多支持TOY模板网！

【DNS】域名服务 Bind实现

一、域名解析过程

二、DNS解析记录类型

1、DNS服务器类型

主DNS服务器

从DNS服务器

缓存DNS服务器（转发器）

2、解析结果类型

3、资源记录RR（Resource Record）

3.1、资源记录定义格式

3.2、SOA 记录

3.3、A 记录

3.4、AAAA 记录

3.5、NS 记录

3.6、CNAME 记录

3.7、MX 记录

3.8、TXT 记录

3.9、PTR 记录

三、DNS工具介绍

dig 工具介绍

nslookup工具

rndc DNS管理工具

四、DNS安装部署

1、Centos7 配置域名正向解析主服务器

1.1、yum安装bind服务，及DNS工具 bind-utils

1.2、修改 named.conf 配置文件，禁用服务限制，引入区域配置文件

1.3、创建 named.zones 区域配置文件

1.4、创建 named.janzen.com 区域解析库文件

1.5、修改文件权限

1.6、设置named服务开机自启动

1.7、使用dig测试DNS服务

1.8、修改区域解析库文件内容，使用 rndc 重载配置

2、Ubuntu apt安装bind服务

1.1、apt安装bind9服务，及DNS工具 bind9utils

1.2、修改 named.conf 配置文件，引入区域配置文件

1.3、创建 named.zones 区域配置文件

1.4、创建 db.janzen.com 区域解析库文件

1.5、修改文件权限

1.6、启动 bind9 服务

1.7、使用dig测试DNS服务

1.8、修改区域解析库文件内容，使用 rndc 重载配置

五、DNS反向解析配置

1、Centos7 配置反向解析

1.1、在 named.zones 中添加反向解析区域记录

1.2、创建 named.10.0.0 区域反向解析库

1.3、重新加载服务

1.4、校验反向解析效果

2、Ubuntu 配置反向解析

2.1、在 named.zones 中添加反向解析区域记录

2.2、创建区域反向解析库

2.3、重新加载服务

2.4、验证反向解析结果

六、DNS主从架构部署

1、Centos7 主从架构配置

1.1、主服务器配置

1.2、从服务器配置

2、Ubuntu 主从架构配置

2.1、主服务器配置

2.2、从服务器配置

七、DNS转发配置

1、Centos7 转发服务器配置

1.1、全局转发

1.2、指定域转发

2、Ubuntu 转发服务器配置

2.1、全局转发

2.2、指定域转发

相关文章

觉得文章有用就打赏一下文章作者

支付宝扫一扫打赏

微信扫一扫打赏

支付宝扫一扫领取红包，优惠每天领

二维码1

二维码2