鸟哥学习笔记---DNS
概要：
完整主机名：Fully Qualified Domain Name(FQDN)
Top Level Domains(TLDs)
1.一般顶级域名(Generric TLDs,gTLD)：.com、.org、.gov等
2.地区顶级域名(Country Code TLDs,ccTLD)：.uk、.jp、.cn等
#每一个上层的DNS服务器的记录的信息，其实只有其下一层的主机名而已
#每一台DNS的服务器都只管理自己的下一层主机名的转译而已
#DNS记录缓存通常为24小时
[root@Centosszm ~]# dig +trace www.163.com
DNS使用的Port为53：
[root@Centosszm ~]# vi /etc/services
通常DNS是以UDP这个较快速的数据传输协议来查询的，但是万一没有办法查询到完整的信息时，就会再次以TCP这个协议来重新查询。
全局DNS：
1.上层DNS授权区域查询权，让你自己设置DNS服务器
2.直接请上层DNS服务器来帮你设置主机名对应
1）记录服务器所在的NS（NameServer）标志；
2）记录主机名对应的A（Addrss）标志；
不管是正解还是反解，每个域的记录就是一个区域（Zone）
ISP才有权力设置反解，你向ISP取得的IP不能自己设置反解。除非你取得的是整个Class C以上等级的IP网段。
1）正解的标志
SOA(Start of Authority)：开始验证
NS(Name server)：
A(Address)：
2）反解的标志
PTR(PoinTeR):指向
.的Zone类型就是hint类型。
一台简单的正解DNS服务器，要有两个Zone：
1）hinit
2）自己的Zone；（.vbird.org）
需要正解成对需求的大概仅有Mail Server
配置文件：
1./etc/hosts
2./etc/resolv.conf
3./etc/nsswitch.conf
[root@Centosszm ~]# grep -v '[#]' /etc/nsswitch.conf
passwd: files
shadow: files
group: files
hosts: files dns
#先查hosts文件，再查DNS（/etc/resolv.conf）
bootparams: nisplus [NOTFOUND=return] files
ethers: files
netmasks: files
networks: files
protocols: files
rpc: files
services: files
netgroup: nisplus
publickey: nisplus
automount: files nisplus
aliases: files nisplus
使得DHCP服务器不改变/etc/resolv.conf的设置值：
host [-a] FQDN [server]
host -l domain [server]
查看所有相关信息，包括IP、TTL与排错信息等：
[root@Centosszm ~]# host -a www.baidu.com
Trying "www.baidu.com"
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 48990
;; flags: qr rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 4, ADDITIONAL: 4
;;
QUESTION SECTION:
;www.baidu.com. IN ANY
;;
ANSWER SECTION:
www.baidu.com. 5 IN CNAME www.a.shifen.com.
;;
AUTHORITY SECTION:
baidu.com. 5 IN NS ns3.baidu.com.
baidu.com. 5 IN NS ns4.baidu.com.
baidu.com. 5 IN NS dns.baidu.com.
baidu.com. 5 IN NS ns2.baidu.com.
;;
ADDITIONAL SECTION:
dns.baidu.com. 5 IN A 202.108.22.220
ns2.baidu.com. 5 IN A 61.135.165.235
ns3.baidu.com. 5 IN A 220.181.37.10
ns4.baidu.com. 5 IN A 220.181.38.10
Received 194 bytes from 192.168.179.2#53 in 21 ms
#因为这个域禁止区域查询：
[root@Centosszm ~]# host -l baidu.com
;; connection timed out; no servers could be reached
[root@Centosszm ~]# host www.baidu.com 172.16.2.1
Using domain server:
Name: 172.16.2.1
Address: 172.16.2.1#53
Aliases:
www.baidu.com is an alias for www.a.shifen.com.
www.a.shifen.com has address 61.135.169.105
www.a.shifen.com has address 61.135.169.125
;; connection timed out; no servers could be reached
#nslookup [FQDN] [server]
[root@Centosszm ~]# nslookup www.baidu.com
Server: 192.168.179.2
Address: 192.168.179.2#53
Non-authoritative answer:
www.baidu.com canonical name = www.a.shifen.com.
Name: www.a.shifen.com
Address: 61.135.169.125
Name: www.a.shifen.com
Address: 61.135.169.105
+trace:从.开始追踪；
-t type:MX、NS、SOA
-x:查询反解信息
[root@Centosszm ~]# dig www.baidu.com
; <<>> DiG 9.7.0-P2-RedHat-9.7.0-5.P2.el6 <<>> www.baidu.com
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 33742
;; flags: qr rd ra; QUERY: 1, ANSWER: 3, AUTHORITY: 4, ADDITIONAL: 4
;; QUESTION SECTION:
#问题
;www.baidu.com. IN A
;; ANSWER SECTION:
#回答
www.baidu.com. 5 IN CNAME www.a.shifen.com.
www.a.shifen.com. 5 IN A 61.135.169.105
www.a.shifen.com. 5 IN A 61.135.169.125
;; AUTHORITY SECTION:
#验证，那个5为缓存时间
a.shifen.com. 5 IN NS ns9.a.shifen.com.
a.shifen.com. 5 IN NS ns4.a.shifen.com.
a.shifen.com. 5 IN NS ns5.a.shifen.com.
a.shifen.com. 5 IN NS ns7.a.shifen.com.
;; ADDITIONAL SECTION:
ns4.a.shifen.com. 5 IN A 123.125.113.67
ns5.a.shifen.com. 5 IN A 220.181.3.178
ns7.a.shifen.com. 5 IN A 220.181.38.47
ns9.a.shifen.com. 5 IN A 61.135.166.226
;; Query time: 7 msec
;;
SERVER: 192.168.179.2#53(192.168.179.2)
;; WHEN: Tue Apr 9 20:20:43 2013
;; MSG SIZE rcvd: 226
反向查询：
[root@Centosszm ~]# dig -x 120.114.100.20
; <<>> DiG 9.7.0-P2-RedHat-9.7.0-5.P2.el6 <<>> -x 120.114.100.20
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 31029
;; flags: qr rd ra; QUERY: 1, ANSWER: 3, AUTHORITY: 3, ADDITIONAL: 0
;; QUESTION SECTION:
;20.100.114.120.in-addr.arpa. IN PTR
;; ANSWER SECTION:
20.100.114.120.in-addr.arpa. 5 IN PTR mail-smtp-proxy.ksu.edu.tw.
20.100.114.120.in-addr.arpa. 5 IN PTR mail.ksu.edu.tw.
20.100.114.120.in-addr.arpa. 5 IN PTR mail-out-r2.ksu.edu.tw.
;; AUTHORITY SECTION:
100.114.120.in-addr.arpa. 5 IN NS dns1.ksu.edu.tw.
100.114.120.in-addr.arpa. 5 IN NS dns2.ksu.edu.tw.
100.114.120.in-addr.arpa. 5 IN NS dns3.twaren.net.
;; Query time: 1684 msec
;; SERVER: 192.168.179.2#53(192.168.179.2)
;; WHEN: Tue Apr 9 20:31:41 2013
;; MSG SIZE rcvd: 197
查询域管理者的相关信息：whois(由jwhois)
[root@Centosszm ~]# whois baidu.com
[Querying whois.verisign-grs.com]
[Redirected to whois.markmonitor.com]
[Querying whois.markmonitor.com]
[whois.markmonitor.com]
MarkMonitor is the Global Leader in Online Brand Protection.
MarkMonitor Domain Management(TM)
MarkMonitor Brand Protection(TM)
MarkMonitor AntiPiracy(TM)
MarkMonitor AntiFraud(TM)
Professional and Managed Services
Visit MarkMonitor at www.markmonitor.com
Contact us at 1 (800) 745-9229
In Europe, at +44 (0) 203 206 2220
The Data in MarkMonitor.com's WHOIS database is provided by MarkMonitor.com
for information purposes, and to assist persons in obtaining information
about or related to a domain name registration record. MarkMonitor.com
does not guarantee its accuracy. By submitting a WHOIS query, you agree
that you will use this Data only for lawful purposes and that, under no
circumstances will you use this Data to: (1) allow, enable, or otherwise
support the transmission of mass unsolicited, commercial advertising or
solicitations via e-mail (spam); or (2) enable high volume, automated,
electronic processes that apply to MarkMonitor.com (or its systems).
MarkMonitor.com reserves the right to modify these terms at any time.
By submitting this query, you agree to abide by this policy.
Registrant:
Zhiyong Duan
Beijing Baidu Netcom Science Technology Co., Ltd.
3F Baidu Campus No.10 Shangdi 10th Street Haidian District
Beijing Beijing 100085
CN
[email protected] +86.1059924216 Fax: +86.1059927435 #联系方式
Domain Name: baidu.com
Registrar Name: Markmonitor.com
Registrar Whois: whois.markmonitor.com
Registrar Homepage: http://www.markmonitor.com
Administrative Contact:
Zhiyong Duan
Beijing Baidu Netcom Science Technology Co., Ltd.
3F Baidu Campus No.10 Shangdi 10th Street Haidian District
Beijing Beijing 100085
CN
[email protected] +86.1059924216 Fax: +86.1059927435
Technical Contact, Zone Contact:
Zhiyong Duan
Beijing Baidu Netcom Science Technology Co., Ltd.
3F Baidu Campus No.10 Shangdi 10th Street Haidian District
Beijing Beijing 100085
CN
[email protected] +86.1059924216 Fax: +86.1059927435
Created on..............: 1999-10-11.
Expires on..............: 2015-10-11. #过期时间
Record last updated on..: 2012-05-19.
Domain servers in listed order:
dns.baidu.com
ns4.baidu.com
ns2.baidu.com
ns3.baidu.com
MarkMonitor is the Global Leader in Online Brand Protection.
MarkMonitor Domain Management(TM)
MarkMonitor Brand Protection(TM)
MarkMonitor AntiPiracy(TM)
MarkMonitor AntiFraud(TM)
Professional and Managed Services
Visit MarkMonitor at www.markmonitor.com
Contact us at 1 (800) 745-9229
In Europe, at +44 (0) 203 206 2220
DNS服务器要用到的软件：
[root@Centosszm ~]# rpm -qa | grep '^bind'
bind-utils-9.7.0-5.P2.el6.i686
#客户端查找主机名的相关命令
bind-libs-9.7.0-5.P2.el6.i686
#函数库
bind-9.7.0-5.P2.el6.i686
#主程序
bind-chroot-9.7.0-5.P2.el6.i686
#设置Bind的根（/var/named/chroot）
/etc/named.conf:
/etc/sysconfig/named:
chroot等参数设置
/var/named/
：数据库
/var/run/named：
named这个程序执行时默认放置pid-file在此目录内。
[root@Centosszm ~]# grep -v "#" /etc/sysconfig/named
ROOTDIR=/var/named/chroot
因为上面的设置，Bind相关程序所需要的所有数据会变成这样：
/var/named/chroot/etc/named.vonf
/var/named/chroot/etc/sysconfig/named
/var/named/chroot/var/named/
/var/named/chroot/var/run/named
| chroot所需要使用到的目录，通过mount --bind的功能进行目录连接了（/etc/init.d/named）
mount --bind /var/named /var/named/chroot/var/named
|
单纯的cahe-only DNS服务器与forwarding功能：
1）有个只需要.这个zone file的简单DNS服务器，我们称这种没有自己公开的DNS数据库的服务器为cache-only DNS Server。
2）将原本要往.查询的任务，丢给上层DNS服务器去处理就为forwarding
3）通常搭建cache-only DNS服务器大都是为了系统安全
[root@Centosszm ~]# cat /etc/named.conf
// 这个是注释，注意结尾要以;
// named.conf
//
// Provided by Red Hat bind package to configure the ISC BIND named(8) DNS
// server as a caching only nameserver (as a localhost DNS resolver only).
//
// See /usr/share/doc/bind*/sample/ for example named configuration files.
//
options {
listen-on port 53 { any; };
#会对所有IP进行监听
directory "/var/named";
dump-file "/var/named/data/cache_dump.db";
statistics-file "/var/named/data/named_stats.txt";
memstatistics-file "/var/named/data/named_mem_stats.txt";
allow-query { any; };
recursion yes;
forward only;
forwarders {
172.16.2.6;
};
};
| 953：远程名称解析服务控制功能（Remote Name Daemon Control，RNDC） |
[root@Centosszm ~]# /etc/init.d/named start
Starting named: [ OK ]
[root@Centosszm ~]# netstat -tulnp | grep named
tcp 0 0 192.168.111.100:53 0.0.0.0:* LISTEN 3624/named
tcp 0 0 172.16.128.211:53 0.0.0.0:* LISTEN 3624/named
tcp 0 0 192.168.179.7:53 0.0.0.0:* LISTEN 3624/named
tcp 0 0 127.0.0.1:53 0.0.0.0:* LISTEN 3624/named
tcp 0 0 127.0.0.1:953 0.0.0.0:* LISTEN 3624/named
tcp 0 0 ::1:953 :::* LISTEN 3624/named
udp 0 0 192.168.111.100:53 0.0.0.0:* 3624/named
udp 0 0 172.16.128.211:53 0.0.0.0:* 3624/named
udp 0 0 192.168.179.7:53 0.0.0.0:* 3624/named
udp 0 0 127.0.0.1:53 0.0.0.0:* 3624/named
是否正确启动要看这里的内容才行：
[root@Centosszm ~]# tail -n 30 /var/log/messages | grep named
测试：
[root@Centosszm ~]# dig www.baidu.com @172.16.2.6
; <<>> DiG 9.7.0-P2-RedHat-9.7.0-5.P2.el6 <<>> www.baidu.com @172.16.2.6
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 8412
;; flags: qr rd ra; QUERY: 1, ANSWER: 3, AUTHORITY: 4, ADDITIONAL: 4
;; QUESTION SECTION:
;www.baidu.com. IN A
;; ANSWER SECTION:
www.baidu.com. 89 IN CNAME www.a.shifen.com.
www.a.shifen.com. 90 IN A 61.135.169.125
www.a.shifen.com. 90 IN A 61.135.169.105
;; AUTHORITY SECTION:
a.shifen.com. 460 IN NS ns4.a.shifen.com.
a.shifen.com. 460 IN NS ns5.a.shifen.com.
a.shifen.com. 460 IN NS ns7.a.shifen.com.
a.shifen.com. 460 IN NS ns9.a.shifen.com.
;; ADDITIONAL SECTION:
ns4.a.shifen.com. 715 IN A 123.125.113.67
ns5.a.shifen.com. 715 IN A 220.181.3.178
ns7.a.shifen.com. 532 IN A 220.181.38.47
ns9.a.shifen.com. 715 IN A 61.135.166.226
;; Query time: 5 msec
;; SERVER: 172.16.2.6#53(172.16.2.6)
#测试成功
;; WHEN: Tue Apr 9 22:05:49 2013
;; MSG SIZE rcvd: 226
正解文件资源记录（Resource Record，RR）格式：下面这个是dig的格式
[domain] [ttl] IN [RR type] [RR data]
主机名. A IPv4地址
主机名. AAAA IPv6地址
域名. NS DNS域名
域名. SOA 管理这个域名的七个重要参数
域名. MX 接收邮件的服务器主机名字
主机别名. IN 实际代表这个主机别名的主机名字
| ttl是当这笔记录被其它DNS服务器查询到后，这个记录会在对方DNS服务器的缓存中，保持多少秒钟的意思。 |
A、AAAA查询IP：
[root@Centosszm ~]# dig -t a www.baidu.com
[root@Centosszm ~]# dig www.baidu.com
3.NS:查询管理区域名（Zone）的服务器主机名
[root@Centosszm ~]# dig -t ns baidu.com
; <<>> DiG 9.7.0-P2-RedHat-9.7.0-5.P2.el6 <<>> -t ns baidu.com
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 24571
;; flags: qr rd ra; QUERY: 1, ANSWER: 4, AUTHORITY: 0, ADDITIONAL: 4
;; QUESTION SECTION:
;baidu.com. IN NS #查询NS记录
;; ANSWER SECTION:
baidu.com. 5 IN NS ns2.baidu.com.
baidu.com. 5 IN NS ns3.baidu.com.
baidu.com. 5 IN NS ns4.baidu.com.
baidu.com. 5 IN NS dns.baidu.com.
;; ADDITIONAL SECTION:
dns.baidu.com. 5 IN A 202.108.22.220
ns2.baidu.com. 5 IN A 61.135.165.235
ns3.baidu.com. 5 IN A 220.181.37.10
ns4.baidu.com. 5 IN A 220.181.38.10
;; Query time: 3 msec
;; SERVER: 192.168.179.2#53(192.168.179.2)
;; WHEN: Tue Apr 9 22:34:09 2013
;; MSG SIZE rcvd: 163
4.SOA：查询管理域名的服务器管理信息
[root@Centosszm ~]# dig -t SOA baidu.com
; <<>> DiG 9.7.0-P2-RedHat-9.7.0-5.P2.el6 <<>> -t SOA baidu.com
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 9164
;; flags: qr rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 4, ADDITIONAL: 4
;; QUESTION SECTION:
;baidu.com. IN SOA
#查询SOA记录
;; ANSWER SECTION:
baidu.com. 5 IN SOA dns.baidu.com. sa.baidu.com. 2012111456 300 300 2592000 7200
;; AUTHORITY SECTION:
baidu.com. 5 IN NS dns.baidu.com.
baidu.com. 5 IN NS ns2.baidu.com.
baidu.com. 5 IN NS ns3.baidu.com.
baidu.com. 5 IN NS ns4.baidu.com.
;; ADDITIONAL SECTION:
dns.baidu.com. 5 IN A 202.108.22.220
ns2.baidu.com. 5 IN A 61.135.165.235
ns3.baidu.com. 5 IN A 220.181.37.10
ns4.baidu.com. 5 IN A 220.181.38.10
;; Query time: 189 msec
;; SERVER: 192.168.179.2#53(192.168.179.2)
;; WHEN: Tue Apr 9 22:36:12 2013
;; MSG SIZE rcvd: 202
1.Master DNS
2.administrator Email因为@在数据库中是有特别意义的，所以用.取代
3.Serial序号，序号越大越新，Slave以这个序号来判断是否要更新
4.Refresh更新频率：Slave向Master要求数据更新。如果发现序号没有增大，那就不会下载数据库文件
5.Retry失败重新尝试时间：
6.Expire失效时间：
7.Minumum TTL缓存时间：
Refresh>=Retry*2
Refresh+Retry<Expire
Expire>=Retry*10
Expire>=7Days
6.CNAME:设置主机名的别名
如果只有一个主要主机名设置A，而其它的标志使用CNAME，当主机IP变更时，只要修订一个A的标志就可以了，其他的CNAME就跟着变动了，处理起来比较容易。
7.MX：查询某域名的邮件服务器主机名（Mail eXchanger）邮件交换
[root@Centosszm ~]# dig -t mx baidu.com
; <<>> DiG 9.7.0-P2-RedHat-9.7.0-5.P2.el6 <<>> -t mx baidu.com
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 34841
;; flags: qr rd ra; QUERY: 1, ANSWER: 4, AUTHORITY: 4, ADDITIONAL: 7
;; QUESTION SECTION:
;baidu.com. IN MX
;; ANSWER SECTION:
baidu.com. 5 IN MX 10 mx.mailcdn.baidu.com.
#前面的数字为优先级
baidu.com. 5 IN MX 20 mx1.baidu.com.
#越小越优先
baidu.com. 5 IN MX 20 jpmx.baidu.com.
baidu.com. 5 IN MX 20 mx50.baidu.com.
;; AUTHORITY SECTION:
baidu.com. 5 IN NS dns.baidu.com.
baidu.com. 5 IN NS ns2.baidu.com.
baidu.com. 5 IN NS ns3.baidu.com.
baidu.com. 5 IN NS ns4.baidu.com.
;; ADDITIONAL SECTION:
mx1.baidu.com. 5 IN A 61.135.163.61
jpmx.baidu.com. 5 IN A 61.208.132.13
mx50.baidu.com. 5 IN A 220.181.50.208
dns.baidu.com. 5 IN A 202.108.22.220
ns2.baidu.com. 5 IN A 61.135.165.235
ns3.baidu.com. 5 IN A 220.181.37.10
ns4.baidu.com. 5 IN A 220.181.38.10
;; Query time: 68 msec
;; SERVER: 192.168.179.2#53(192.168.179.2)
;; WHEN: Tue Apr 9 23:04:36 2013
;; MSG SIZE rcvd: 300
| 反解文件记录的RR数据
将IP反过来写，再在结尾加上.in-addr.arpa.（反过来写是为了和域名解析的过程相同）
|
[root@Centosszm ~]# dig -x 120.114.100.101
; <<>> DiG 9.7.0-P2-RedHat-9.7.0-5.P2.el6 <<>> -x 120.114.100.101
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 3633
;; flags: qr rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 3, ADDITIONAL: 1
;; QUESTION SECTION:
;101.100.114.120.in-addr.arpa. IN PTR #反向记录
;; ANSWER SECTION:
101.100.114.120.in-addr.arpa. 5 IN PTR www.ksu.edu.tw.
;; AUTHORITY SECTION:
100.114.120.in-addr.arpa. 5 IN NS dns2.ksu.edu.tw.
100.114.120.in-addr.arpa. 5 IN NS dns3.twaren.net.
100.114.120.in-addr.arpa. 5 IN NS dns1.ksu.edu.tw.
;; ADDITIONAL SECTION:
dns3.twaren.net. 5 IN AAAA 2001:e10:5c00:1::47
;; Query time: 1138 msec
;; SERVER: 192.168.179.2#53(192.168.179.2)
;; WHEN: Tue Apr 9 23:14:31 2013
;; MSG SIZE rcvd: 169
例子：
[root@www ~]# hostname
www.Centosszm.com.
[root@www ~]# cat /etc/sysconfig/network
NETWORKING=yes
HOSTNAME=www.Centosszm.com.
#主机名，记得加上.
NISDOMAIN=vbirdnis
YPSERV_ARGS="-p 1011"
1.设置配置文件：
[root@www ~]# cat /etc/named.conf
//
// named.conf
//
// Provided by Red Hat bind package to configure the ISC BIND named(8) DNS
// server as a caching only nameserver (as a localhost DNS resolver only).
//
// See /usr/share/doc/bind*/sample/ for example named configuration files.
//
options {
listen-on port 53 { any; };
#这里是要放行查询的IP
listen-on-v6 port 53 { ::1; };
directory "/var/named";
dump-file "/var/named/data/cache_dump.db";
statistics-file "/var/named/data/named_stats.txt";
memstatistics-file "/var/named/data/named_mem_stats.txt";
allow-query { any; };
recursion yes;
allow-transfer {none;}
#不许另人进行Zone转移
};
};
};
zone "." IN {
type hint;
file "named.ca";
};
zone "Centosszm.com" IN {
#Zone名称
type master;
#类型：hint、master、slave
file "named.Centosszm.com";
#文件放在哪里
};
Zone "179.168.192.in-addr.arpa" IN {
#Zone名称
type master;
file "named.192.168.179";
};
.DNS最新动态：
ftp://rs.internic.net/domain/named.root
2..数据库文件的设置
本地记录.的文件：
[root@www ~]# cat /var/named/named.ca
; <<>> DiG 9.5.0b2 <<>> +bufsize=1200 +norec NS . @a.root-servers.net
;; global options: printcmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 34420
;; flags: qr aa; QUERY: 1, ANSWER: 13, AUTHORITY: 0, ADDITIONAL: 20
;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 4096
;; QUESTION SECTION:
;. IN NS
;; ANSWER SECTION:
. 518400 IN NS M.ROOT-SERVERS.NET.
. 518400 IN NS A.ROOT-SERVERS.NET.
. 518400 IN NS B.ROOT-SERVERS.NET.
. 518400 IN NS C.ROOT-SERVERS.NET.
. 518400 IN NS D.ROOT-SERVERS.NET.
. 518400 IN NS E.ROOT-SERVERS.NET.
. 518400 IN NS F.ROOT-SERVERS.NET.
. 518400 IN NS G.ROOT-SERVERS.NET.
. 518400 IN NS H.ROOT-SERVERS.NET.
. 518400 IN NS I.ROOT-SERVERS.NET.
. 518400 IN NS J.ROOT-SERVERS.NET.
. 518400 IN NS K.ROOT-SERVERS.NET.
. 518400 IN NS L.ROOT-SERVERS.NET.
;; ADDITIONAL SECTION:
A.ROOT-SERVERS.NET. 3600000 IN A 198.41.0.4
A.ROOT-SERVERS.NET. 3600000 IN AAAA 2001:503:ba3e::2:30
B.ROOT-SERVERS.NET. 3600000 IN A 192.228.79.201
C.ROOT-SERVERS.NET. 3600000 IN A 192.33.4.12
D.ROOT-SERVERS.NET. 3600000 IN A 128.8.10.90
E.ROOT-SERVERS.NET. 3600000 IN A 192.203.230.10
F.ROOT-SERVERS.NET. 3600000 IN A 192.5.5.241
F.ROOT-SERVERS.NET. 3600000 IN AAAA 2001:500:2f::f
G.ROOT-SERVERS.NET. 3600000 IN A 192.112.36.4
H.ROOT-SERVERS.NET. 3600000 IN A 128.63.2.53
H.ROOT-SERVERS.NET. 3600000 IN AAAA 2001:500:1::803f:235
I.ROOT-SERVERS.NET. 3600000 IN A 192.36.148.17
J.ROOT-SERVERS.NET. 3600000 IN A 192.58.128.30
J.ROOT-SERVERS.NET. 3600000 IN AAAA 2001:503:c27::2:30
K.ROOT-SERVERS.NET. 3600000 IN A 193.0.14.129
K.ROOT-SERVERS.NET. 3600000 IN AAAA 2001:7fd::1
L.ROOT-SERVERS.NET. 3600000 IN A 199.7.83.42
M.ROOT-SERVERS.NET. 3600000 IN A 202.12.27.33
M.ROOT-SERVERS.NET. 3600000 IN AAAA 2001:dc3::35
;; Query time: 147 msec
;; SERVER: 198.41.0.4#53(198.41.0.4)
;; WHEN: Mon Feb 18 13:29:18 2008
;; MSG SIZE rcvd: 615
3.反向查找区域：
#所有设置数据一定要从行首开始，前面不可有空格符。若有空格符，代表延续前一个Doamin的意思。
#@：代表Zone的意思。这里体表（Centosszm.com下同体表179.168.192.in-addr.arpa）
#一个正解的数据库设置中，至少应该要有$TTL、SOA、NS、NS主要的A。
#$ORGIN:重新定义Zone而不是由named.conf来指定。
#如果主机名字后没有写点，主机的FQDN会变为+Zone的格式。
#前面的数据是IP地址的最后一位的意思
[root@www ~]# cat /var/named/named.192.168.179
$TTL 600
@ IN SOA master.Centosszm.com. www.Centosszm.com. (2013040901 3H 15M 1W 1D)
@ IN NS master.Centosszm.com.
7 IN PTR master.Centosszm.com.
7 IN PTR www.Centosszm.com.
10 IN PTR slave.centos.com.
4.正向查找区域：
[root@www ~]# cat /var/named/named.Centosszm.com
$TTL 600
@ IN SOA master.Centosszm.com. www.Centosszm.com. ( 2013040901 3H 15M 1W 1D )
@ IN NS master.Centosszm.com.
master.Centosszm.com. IN A 192.168.179.7
@ IN MX 10 www.Centosszm.com.
www.Centosszm.com. IN A 192.168.179.7
linux.Centosszm.com. IN CNAME www.Centosszm.com.
ftp.Centosszm.com. IN CNAME www.Centosszm.com.
forum.Centosszm.com. IN CNAME www.centosszm.com.
slave.Centosszm.com. IN A 192.168.179.7
clientlinux.Centosszm.com. IN A 192.168.179.7
5.防火墙设置：
[root@www ~]# iptables -A INPUT -p udp --dport 53 -j ACCEPT
[root@www ~]# iptables -A INPUT -p tcp --dport 53 -j ACCEPT
6.测试成功，如下：
[root@www ~]# vim /etc/resolv.conf
nameserver 192.168.179.7
[root@www ~]# dig master.Centosszm.com
master.Centosszm.com. 600 IN A 192.168.179.7
[root@www ~]# dig www.Centosszm.com
www.Centosszm.com. 600 IN A 192.168.179.7
[root@www ~]# dig ftp.Centosszm.com
ftp.Centosszm.com. 600 IN CNAME www.Centosszm.com.
www.Centosszm.com. 600 IN A 192.168.179.7
协同工作的DNS:Slave DNS及子域授权设定
[root@www ~]# cat /etc/named.conf
//
// named.conf
//
// Provided by Red Hat bind package to configure the ISC BIND named(8) DNS
// server as a caching only nameserver (as a localhost DNS resolver only).
//
// See /usr/share/doc/bind*/sample/ for example named configuration files.
//
options {
listen-on port 53 { any; };
listen-on-v6 port 53 { ::1; };
directory "/var/named";
dump-file "/var/named/data/cache_dump.db";
statistics-file "/var/named/data/named_stats.txt";
memstatistics-file "/var/named/data/named_mem_stats.txt";
allow-query { any; };
recursion yes;
allow-transfer {none;
};
};
zone "." IN {
type hint;
file "named.ca";
};
zone "Centosszm.com" IN {
type master;
file "named.Centosszm.com";
allow-transfer {192.168.179.10;};
#加上这一句
};
zone "179.168.192.in-addr.arpa" IN {
type master;
file "named.192.168.179";
allow-transfer {192.168.179.10;};
#加上这一句
};
[root@www ~]# cat /var/named/named.192.168.179
$TTL 600
@ IN SOA master.Centosszm.com. www.Centosszm.com. (2013040901 3H 15M 1W 1D)
@ IN NS master.Centosszm.com.
@ IN NS slave.Centosszm.com.
#增加记录
7 IN PTR master.Centosszm.com.
7 IN PTR www.Centosszm.com.
10 IN PTR slave.Centosszm.com.
#增加记录
[root@www ~]# cat /var/named/named.Centosszm.com
$TTL 600
@ IN SOA master.Centosszm.com. www.Centosszm.com. ( 2013040901 3H 15M 1W 1D )
@ IN NS master.Centosszm.com.
@ IN NS slave.Centosszm.com.
#增加记录
master.Centosszm.com. IN A 192.168.179.7
@ IN MX 10 www.Centosszm.com.
www.Centosszm.com. IN A 192.168.179.7
linux.Centosszm.com. IN CNAME www.Centosszm.com.
ftp.Centosszm.com. IN CNAME www.Centosszm.com.
forum.Centosszm.com. IN CNAME www.centosszm.com.
slave.Centosszm.com. IN A 192.168.179.10
#增加记录
clientlinux.Centosszm.com. IN A 192.168.179.7
[root@www ~]# /etc/init.d/named restart
Stopping named: [ OK ]
Starting named: [ OK ]
Slave DNS的设置与数据库权限问题：
[root@wwwclient ~]# ll -dZ /var/named/slaves/
drwxrwx---. named named system_u:object_r:named_cache_t:s0 /var/named/slaves/
[root@wwwclient ~]# cat /etc/named.conf
//
// named.conf
//
// Provided by Red Hat bind package to configure the ISC BIND named(8) DNS
// server as a caching only nameserver (as a localhost DNS resolver only).
//
// See /usr/share/doc/bind*/sample/ for example named configuration files.
//
options {
listen-on port 53 { any; };
listen-on-v6 port 53 { ::1; };
directory "/var/named";
dump-file "/var/named/data/cache_dump.db";
statistics-file "/var/named/data/named_stats.txt";
memstatistics-file "/var/named/data/named_mem_stats.txt";
allow-query { any; };
allow-transfer { none;};
recursion yes;
};
logging {
channel default_debug {
file "data/named.run";
severity dynamic;
};
};
zone "." IN {
type hint;
file "named.ca";
};
zone "Centosszm.com" IN {
type slave;
file "slaves/named.centosszm.com";
masters {192.168.179.7;};
};
zone "179.168.192.in-addr-arpa" IN {
type slave;
file "slaves/named.192.168.179";
masters {192.168.179.7;};
};
[root@wwwclient ~]# /etc/init.d/named start
Generating /etc/rndc.key:^C
[root@wwwclient ~]# rndc-confgen -r /dev/urandom -a
wrote key file "/etc/rndc.key"
[root@wwwclient ~]# /etc/init.d/named start
Starting named: [ OK ]
客户端测试：
[root@wwwclient ~]# dig master.Centosszm.com @127.0.0.1
; <<>> DiG 9.8.2rc1-RedHat-9.8.2-0.17.rc1.el6_4.4 <<>> master.Centosszm.com @127.0.0.1
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 4218
;; flags: qr aa rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 2, ADDITIONAL: 1
;; QUESTION SECTION:
;master.Centosszm.com. IN A
;; ANSWER SECTION:
master.Centosszm.com. 600 IN A 192.168.179.7
;; AUTHORITY SECTION:
Centosszm.com. 600 IN NS slave.Centosszm.com.
Centosszm.com. 600 IN NS master.Centosszm.com.
;; ADDITIONAL SECTION:
slave.Centosszm.com. 600 IN A 192.168.179.10
;; Query time: 2 msec
;; SERVER: 127.0.0.1#53(127.0.0.1)
;; WHEN: Thu Apr 11 10:01:55 2013
;; MSG SIZE rcvd: 104
[root@www ~]# ll -Z /var/named/named.*
-rw-r--r--. root root unconfined_u:object_r:etc_t:s0 /var/named/named.192.168 .179
[root@www ~]# restorecon /var/named/named.192.168.179
[root@www ~]# ll -Z /var/named/named.*
-rw-r--r--. root root system_u:object_r:named_zone_t:s0 /var/named/named.192.168.179
| 反向解析还是有问题，未果； |
rndc stop
named -u named -g
http://benjamin.sonntag.fr/a37-named_zone_sonntag_eu_org_refused_notify_from_non-master.html
Slave似乎会把没有认证的信息过滤掉；
http://linux.m2osw.com/bind_errors