dns主配置文件的格式
[root@centos7 named]# cat /etc/named.conf
//
// named.conf
//
// Provided by Red Hat bind package to configure the ISC BIND named(8) DNS
// server as a caching only nameserver (as a localhost DNS resolver only).
//
// See /usr/share/doc/bind*/sample/ for example named configuration files.
//
// See the BIND Administrator's Reference Manual (ARM) for details about the
// configuration located in /usr/share/doc/bind-{version}/Bv9ARM.html
options {
// listen-on port 53 { 127.0.0.1; };
listen-on-v6 port 53 { ::1; };
directory "/var/named";
dump-file "/var/named/data/cache_dump.db";
statistics-file "/var/named/data/named_stats.txt";
memstatistics-file "/var/named/data/named_mem_stats.txt";
// allow-query { localhost; };
/*
- If you are building an AUTHORITATIVE DNS server, do NOT enable recursion.
- If you are building a RECURSIVE (caching) DNS server, you need to enable
recursion.
- If your recursive DNS server has a public IP address, you MUST enable access
control to limit queries to your legitimate users. Failing to do so will
cause your server to become part of large scale DNS amplification
attacks. Implementing BCP38 within your network would greatly
reduce such attack surface
*/
recursion yes;
dnssec-enable yes;
dnssec-validation yes;
/* Path to ISC DLV key */
bindkeys-file "/etc/named.iscdlv.key";
managed-keys-directory "/var/named/dynamic";
pid-file "/run/named/named.pid";
session-keyfile "/run/named/session.key";
};
logging {
channel default_debug {
file "data/named.run";
severity dynamic;
};
};
zone "." IN {
type hint;
file "named.ca";
};
include "/etc/named.rfc1912.zones";
include "/etc/named.root.key";
[root@centos7 named]# cat /etc/named.conf.kk
//
// named.conf
//
// Provided by Red Hat bind package to configure the ISC BIND named(8) DNS
// server as a caching only nameserver (as a localhost DNS resolver only).
//
// See /usr/share/doc/bind*/sample/ for example named configuration files.
//
// See the BIND Administrator's Reference Manual (ARM) for details about the
// configuration located in /usr/share/doc/bind-{version}/Bv9ARM.html
options {
// listen-on port 53 { 127.0.0.1; }; //如果不注释掉掉表示只给本机提供域名解析服务；只监听本地的127.0.0.1地址；也可改
成localhost表示本机所有IP listen-on-v6 port 53 { ::1; };
directory "/var/named";
dump-file "/var/named/data/cache_dump.db";
statistics-file "/var/named/data/named_stats.txt";
memstatistics-file "/var/named/data/named_mem_stats.txt";
// allow-query { localhost; }; //表示只允许本地主机查询；或者在{}里加上运行解析的主机ip地址；或者注释允许所有主
机访问；只提供服务的ip地址
/*
- If you are building an AUTHORITATIVE DNS server, do NOT enable recursion.
- If you are building a RECURSIVE (caching) DNS server, you need to enable
recursion.
- If your recursive DNS server has a public IP address, you MUST enable access
control to limit queries to your legitimate users. Failing to do so will
cause your server to become part of large scale DNS amplification
attacks. Implementing BCP38 within your network would greatly
reduce such attack surface
*/
recursion yes;
dnssec-enable yes;
dnssec-validation yes;
/* Path to ISC DLV key */
bindkeys-file "/etc/named.iscdlv.key";
managed-keys-directory "/var/named/dynamic"; // #/var/named/dynamic表示名字解析数据库；用来提供名字解析而非跑
互联网问其他的DNS服务器
pid-file "/run/named/named.pid";
session-keyfile "/run/named/session.key";
};
logging {
channel default_debug {
file "data/named.run";
severity dynamic;
};
};
zone "." IN {
type hint;
file "named.ca";
};
include "/etc/named.rfc1912.zones"; \\存放数据库与域存放关系的文件；也可在此文件中更改
include "/etc/named.root.key";
存放数据库与域存放关系的文件格式、
实例
[root@centos7 named]# cat /etc/name.rfc1912.back
// named.rfc1912.zones:
//
// Provided by Red Hat caching-nameserver package
//
// ISC BIND named zone configuration for zones recommended by
// RFC 1912 section 4.1 : localhost TLDs and address zones
// and http://www.ietf.org/internet-drafts/draft-ietf-dnsop-default-local-zones-02.txt
// (c)2007 R W Franks
//
// See /usr/share/doc/bind*/sample/ for example named configuration files.
//
zone "localhost.localdomain" IN {
type master;
file "named.localhost";
allow-update { none; };
};
zone "localhost" IN {
type master;
file "named.localhost";
allow-update { none; };
};
zone "1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.ip6.arpa" IN {
type master;
file "named.loopback";
allow-update { none; };
};
zone "1.0.0.127.in-addr.arpa" IN {
type master;
file "named.loopback";
allow-update { none; };
};
zone "0.in-addr.arpa" IN {
type master;
file "named.empty";
allow-update { none; };
};
zone "chenxi.conm" { #以chenxi.com域为例
type master; #相对晨曦域来说这是他的第一个域
file "chenxi.zone";
allow-update {none;};
}
#zone（区域） "."（区域名字） IN （字段可省） {
# type(类型) hint; 如果类型的值是master表示第一个域
# file "named.ca"; 区域数据库的名字；路径不用写默认放在/var/named/目录下；存放区域数据库文件的名字
#;}
[root@centos7 named]# cat /etc/named.rfc1912.zones
// named.rfc1912.zones:
//
// Provided by Red Hat caching-nameserver package
//
// ISC BIND named zone configuration for zones recommended by
// RFC 1912 section 4.1 : localhost TLDs and address zones
// and http://www.ietf.org/internet-drafts/draft-ietf-dnsop-default-local-zones-02.txt
// (c)2007 R W Franks
//
// See /usr/share/doc/bind*/sample/ for example named configuration files.
//
zone "localhost.localdomain" IN {
type master;
file "named.localhost";
allow-update { none; };
};
zone "localhost" IN {
type master;
file "named.localhost";
allow-update { none; };
};
zone "1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.ip6.arpa" IN {
type master;
file "named.loopback";
allow-update { none; };
};
zone "1.0.0.127.in-addr.arpa" IN {
type master;
file "named.loopback";
allow-update { none; };
};
zone "0.in-addr.arpa" IN {
type master;
file "named.empty";
allow-update { none; };
};
zone "chenxi.com" {
type master; //hahah
file "chenxi.com.zone";
allow-update {none;};
};
名字解析数据库格式
[root@centos7 named]# vim /var/named/chenxi.com.zone 表示名字解析数据库；用来提供名字解析而非跑互联网问其他的DNS服务器
$TTL 1D ;$TTL值表示生命期；只是全局设置;自己去其他DNS的域名解析的结果缓存的时间1D表示一天
@ IN SOA dns1.chenxi.com. rname.invalid. ( ;IN表示intnet的类型；可以继承上一条记录的；
下一条可以不写@表示当前区数据库对应的域；继承上一条的；SOA表示资源记录类型；区域数据库必须且只能有一个soa记录也必须位于与
区域数据库的第一条记录；@主DNS服务器的名字；省略表示继承上一条的记录；一般格式dns1.yuming.com.注意最后一个点一定要写 ;最
后一行邮箱地址.用来表示@；因为@在这里表示本域
0 ; serial版本号；根据版本号来同步
1D ; refresh备用服务器；到主服务器的同步间隔时间；刷新时间一天
1H ; retry重试时间；表示当备服务到主服务器同不是，发现网络中断；隔多久再来步
；这里是1小时
1W ; expire 过期时间；表示长达指定的时间无法连接主服务器；表示主服务器失效从
服务器
3H ) ; minimum 否定答案的TTL值；表示当主服务器这里无从服务器要要查的结果时；主
服务告诉从服务器我查不到；指定的时间内别再问我了
NS dns1 ;NS记录用来指定谁提供DNS服务;
NS dns2
dns1 A 192.168.206.128 ;表示该域的主域服务器对应的服务器地址
dns2 A 192.168.206.128 ;表示dns2的主机IP
websrv A 1.1.1.1 ;websrvb表示本域别名；写全的话websrv.chenxi.com
[root@centos7 named]# named-checkzone chenxi.com /var/named/chenxi.com.zone 该文件检查语法的命令
zone chenxi.com/IN: loaded serial 0
OK