DNS Server Bind9-Part2-子域、递归和Forward
[root@node-5-11 /]# cat /etc/named.confacl inside { # 定义inside acl供后续调用。10.10.0.0/16;};options { # 主要的一些配置项。......allow-query { any; };# 允许哪些客户端进行DNS查询，影响所有查询请求。allow-recursion { inside; };# 允许哪些客户端进行递归查询，这里调用了上方定义的inside acl 10.10.0.0/16# 这里的递归查询只影响对本地没有的那些域名的响应，不影响本地域名的响应。......};[root@node-5-11 /]# cat /var/named/com.zone$TTL 30 # 其他服务器来进行查询后将相关解析缓存的时间，设置为0时则不缓存。默认单位为秒。@ IN SOA dns11.com. stevie.hotmail.com. (# 当域名和来源相同的时候可以使用@替代；SOA()内的信息基本是供Slave使用的。20240509 ; serial12H ; refresh1H ; retry1W ; expire1H ) ; minimum@ IN NS dns11# 每个zone文件必须有一条NS记录，对应区域的权威名称服务器，这条NS记录必须有对应的A记录dns11 IN A 10.10.5.11dns12 IN A 10.10.5.12# 这里对应的stevie.com区域的DNS Serverwww IN A 10.10.5.11www IN A 10.10.7.11# 当有多条A记录时，DNS Server采用轮询的方式返回解析结果stevie IN NS dns12# stevie.com子域通过NS记录交给的dns12 -> 10.10.5.12 解析test IN CNAME www # CNAME记录为别名。
[]$ ping -n www.comPING www.com (10.10.7.11) 56(84) bytes of data.64 bytes from 10.10.7.11: icmp_seq=1 ttl=63 time=0.259 ms[]$ ping -n www.comPING www.com (10.10.5.11) 56(84) bytes of data.64 bytes from 10.10.5.11: icmp_seq=1 ttl=63 time=0.221 ms[]$ ping -n test.comPING www.com (10.10.7.11) 56(84) bytes of data.64 bytes from 10.10.7.11: icmp_seq=1 ttl=63 time=0.196 ms[]$ ping -n test.comPING www.com (10.10.5.11) 56(84) bytes of data.64 bytes from 10.10.5.11: icmp_seq=1 ttl=63 time=0.268 ms
[root@node-5-12 /]# cat /etc/named.confoptions { #主要的一些配置项。......allow-query { any; };allow-recursion { none; };# 不影响对本地的域名进行解析，但是不进行递归查询。};include "/etc/named/stevie.com.named.conf";[root@node-5-12 /]# cat /etc/named/stevie.com.named.conf | grep -v #zone "stevie.com" IN {type master;file "stevie.com.zone";};# zone文件配置[root@node-5-12 /]# cat /var/named/stevie.com.zone$TTL 0@ IN SOA dns12.stevie.com. stevie.hotmail.com. (20240509 ; serial12H ; refresh1H ; retry1W ; expire1H ) ; minimum@ IN NS dns12dns12 IN A 10.10.5.12dns712 IN A 10.10.7.12www IN A 10.10.5.12te IN NS dns712
[root@node-7-12 ~]# cat /var/named/te.stevie.com.zone$TTL 0@ IN SOA dns712.te.stevie.com. stevie.hotmail.com. (20240509 ; serial12H ; refresh1H ; retry1W ; expire1H ) ; minimum@ IN NS dns712dns712 IN A 10.10.7.12www IN A 10.10.7.11
# 使用10.10.5.11进行递归查询（放开了递归查询。）[root@stevie /]# cat /etc/resolv.confnameserver 10.10.5.11[root@stevie /]# nslookup www.te.stevie.comServer: 10.10.5.11Address: 10.10.5.11#53Non-authoritative answer:Name: www.te.stevie.comAddress: 10.10.7.11 # 查询成功，返回10.10.7.11# 使用10.10.5.12进行递归查询（禁止了递归查询。）[root@stevie /]# cat /etc/resolv.confnameserver 10.10.5.12[root@stevie /]# nslookup www.te.stevie.comServer: 10.10.5.12Address: 10.10.5.12#53Non-authoritative answer:*** Can't find www.te.stevie.com: No answer # 查询失败。# 使用dig解析测试。[root@stevie /]# dig www.te.stevie.com; <<>> DiG 9.9.4-RedHat-9.9.4-72.el7 <<>> www.te.stevie.com;; global options: +cmd;; Got answer:;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 6771;; flags: qr rd; QUERY: 1, ANSWER: 0, AUTHORITY: 1, ADDITIONAL: 2;; WARNING: recursion requested but not available# 提示递归请求不可用。;; OPT PSEUDOSECTION:; EDNS: version: 0, flags:; udp: 4096;; QUESTION SECTION:;www.te.stevie.com. IN A;; AUTHORITY SECTION:te.stevie.com. 0 IN NS dns712.stevie.stevie.com.;; ADDITIONAL SECTION:dns712.stevie.stevie.com. 0 IN A 10.10.7.12;; Query time: 1 msec;; SERVER: 10.10.5.12#53(10.10.5.12);; WHEN: Mon May 13 13:36:23 CST 2024;; MSG SIZE rcvd: 90
/]# cat /var/named/hvv.cn.zone5IN SOA dns612. stevie.hotmail.com. (20240509 ; serial12H ; refresh1H ; retry1W ; expire1H ) ; minimumIN NS dns612dns612 IN A 10.10.6.12test IN A 10.10.88.188
~]# cat /var/named/hvv.cn.zone5IN SOA dns12. stevie.hotmail.com. (20240509 ; serial12H ; refresh1H ; retry1W ; expire1H ) ; minimumIN NS dns12dns12 IN A 10.10.5.12test IN A 10.10.6.12
/etc/named.conf中主要配置：zone "hvv.cn" {type forward;forward first;#forward only;forwarders {10.10.6.12;};};# forward有两种模式 first和only。# first为先去目标服务器查询，查询失败的话进行本地查询（包括尝试迭代查询）。# only为仅去目标服务器查询，如果失败则返回结果，不进一步处理。zone "." IN {type hint;file "root.local";};# 自定义了10.10.5.12为根服务器。# 当forward first解析失败时会去10.10.5.12进行解析。
# forward first时测试：[root@stevie ~]# cat /etc/resolv.confnameserver 10.10.5.11[root@stevie ~]# nslookup test.hvv.cnServer: 10.10.5.11Address: 10.10.5.11#53Non-authoritative answer:Name: test.hvv.cnAddress: 10.10.88.188# 停用10.10.6.12 named服务后：[root@stevie ~]# nslookup test.hvv.cnServer: 10.10.5.11Address: 10.10.5.11#53Non-authoritative answer:Name: test.hvv.cnAddress: 10.10.6.12# 这里为通过自定义根服务器10.10.5.12的解析结果# forward only时测试：[root@stevie ~]# cat /etc/resolv.confnameserver 10.10.5.11[root@stevie ~]# nslookup test.hvv.cnServer: 10.10.5.11Address: 10.10.5.11#53Non-authoritative answer:Name: test.hvv.cnAddress: 10.10.88.188# 停用10.10.6.12named服务后：[root@stevie ~]# nslookup test.hvv.cnServer: 10.10.5.11Address: 10.10.5.11#53** server can't find test.hvv.cn: SERVFAIL# 解析失败
原创文章，作者：速盾高防cdn，如若转载，请注明出处：https://www.sudun.com/ask/57205.html
