⚪DNS：Domain Name System （域名系统） 是互联网上解决网络中机器命名的一种系统。在网络中，一台主机去访问另外一台主机时，必须要知道目标主机的IP地址，虽然网络上的节点都可以用IP地址来标识，并且可以通过IP地址被访问。但对于人而言，一组组由数字组成的IP地址，是难以被理解和记忆的。于是设计出了域名系统，用一组有意义的字符来表示某个特定主机或某个网络，再将网络中主机IP地址和域名之间做成一个映射表。
早期的 internet 网络规模非常小，一个hosts文件就可以定义所有的域名与IP地址的映射关系，管理机构提供该文件下载地址，并定期更新文件内容，以此来反映网络上的变化。但随着时间的推移，接入 internet 的主机和域名越来越多，通过一个中心文件管理所有域名与IP地址映射关系己经不再可取，于是便引入了DNS服务。
host [option] hostname [server]
#常用选项
-a #显示所有信息
-c #指定查询类型 HS|CH|IN
-C #查询SOA
-d #同 -v
-i IP6.INT reverse lookups
-l lists all hosts in a domain, using AXFR
-m set memory debugging flag (trace|record|usage)
-N changes the number of dots allowed before root lookup is done
-p #指定端口
-r #不递归查询
-R specifies number of retries for UDP packets
-s a SERVFAIL response should stop query
-t #指定查询类型 CNAME|NS|SOA|TXT|DNSKEY|AXFR|...
-T #使用TCP进行DNS查询
-U #使用UDP进行DNS查询
-v #显示执行过程
-V #显示命令版本
-w #如果没有查询结果，则阻塞，一直等待
-W N #等待N秒后超时
-4 #仅查询IPV4的DNS server
-6 #仅查询IPV4的DNS server
[root@ubuntu2204-150 1018]# host www.baidu.com
www.baidu.com is an alias for www.a.shifen.com.
www.a.shifen.com has address 220.181.111.1
www.a.shifen.com has address 220.181.111.232
www.a.shifen.com has IPv6 address 2408:871a:2100:1b23:0:ff:b07a:7ebc
www.a.shifen.com has IPv6 address 2408:871a:2100:186c:0:ff:b07e:3fbc
指定DNS服务器
复制代码
[root@ubuntu2204-150 1018]# host www.baidu.com 114.114.114.114
Using domain server:
Name: 114.114.114.114
Address: 114.114.114.114#53
Aliases:
www.baidu.com is an alias for www.a.shifen.com.
www.a.shifen.com has address 220.181.111.1
www.a.shifen.com has address 220.181.111.232
www.a.shifen.com has IPv6 address 240e:83:205:381:0:ff:b00f:96a2
www.a.shifen.com has IPv6 address 240e:83:205:1cd:0:ff:b0b8:dee9
显示所有信息
复制代码
[root@ubuntu2204-150 1018]# host -a www.baidu.com 114.114.114.114
Trying "www.baidu.com"
Using domain server:
Name: 114.114.114.114
Address: 114.114.114.114#53
Aliases:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 24726
;; flags: qr rd ra; QUERY: 1, ANSWER: 5, AUTHORITY: 0, ADDITIONAL: 0
;; QUESTION SECTION:
;www.baidu.com. IN ANY
;; ANSWER SECTION:
www.baidu.com. 658 IN CNAME www.a.shifen.com.
www.a.shifen.com. 88 IN AAAA 240e:83:205:1cd:0:ff:b0b8:dee9
www.a.shifen.com. 88 IN AAAA 240e:83:205:381:0:ff:b00f:96a2
www.a.shifen.com. 88 IN A 220.181.111.232
www.a.shifen.com. 88 IN A 220.181.111.1
Received 146 bytes from 114.114.114.114#53 in 159 ms
3、nslookup命令
nslookup：(name server lookup)，一个命令行下的网络工具，主要用来查询DNS记录，查看域名解析是否正常，也可用来诊断网络问题。
[root@ubuntu-157 ~]# cat /etc/bind/named.conf
// This is the primary configuration file for the BIND DNS server named.
//
// Please read /usr/share/doc/bind9/README.Debian for information on the
// structure of BIND configuration files in Debian, *BEFORE* you customize
// this configuration file.
//
// If you are just adding zones, please do that in /etc/bind/named.conf.local
include "/etc/bind/named.conf.options";
include "/etc/bind/named.conf.local"; #不关注
include "/etc/bind/named.conf.default-zones";
#帮助
man named.conf
[root@ubuntu-157 ~]# cat /etc/bind/named.conf.local
//
// Do any local configuration here
//
// Consider adding the 1918 zones here, if they are not used in your
// organization
//include "/etc/bind/zones.rfc1918";
选项配置文件
复制代码
[root@ubuntu-157 ~]# cat /etc/bind/named.conf.options
options {
directory "/var/cache/bind";
// If there is a firewall between you and nameservers you want
// to talk to, you may need to fix the firewall to allow multiple
// ports to talk. See http://www.kb.cert.org/vuls/id/800113
// If your ISP provided one or more IP addresses for stable
// nameservers, you probably want to use them as forwarders.
// Uncomment the following block, and insert the addresses replacing
// the all-0's placeholder.
// forwarders {
// 0.0.0.0;
// };
//========================================================================
// If BIND logs error messages about the root key being expired,
// you will need to update your keys. See https://www.isc.org/bind-keys
//========================================================================
dnssec-validation auto;
listen-on-v6 { any; };
};
[root@rocky8-153 ~]#cat /etc/named.conf
//
// named.conf
//
// Provided by Red Hat bind package to configure the ISC BIND named(8) DNS
// server as a caching only nameserver (as a localhost DNS resolver only).
//
// See /usr/share/doc/bind*/sample/ for example named configuration files.
//
options {
listen-on port 53 { 127.0.0.1; };
listen-on-v6 port 53 { ::1; };
directory "/var/named";
dump-file "/var/named/data/cache_dump.db";
statistics-file "/var/named/data/named_stats.txt";
memstatistics-file "/var/named/data/named_mem_stats.txt";
secroots-file "/var/named/data/named.secroots";
recursing-file "/var/named/data/named.recursing";
allow-query { localhost; };
/*
- If you are building an AUTHORITATIVE DNS server, do NOT enable recursion.
- If you are building a RECURSIVE (caching) DNS server, you need to enable
recursion.
- If your recursive DNS server has a public IP address, you MUST enable access
control to limit queries to your legitimate users. Failing to do so will
cause your server to become part of large scale DNS amplification
attacks. Implementing BCP38 within your network would greatly
reduce such attack surface
*/
recursion yes;
dnssec-enable yes;
dnssec-validation yes;
managed-keys-directory "/var/named/dynamic";
pid-file "/run/named/named.pid";
session-keyfile "/run/named/session.key";
/* https://fedoraproject.org/wiki/Changes/CryptoPolicy */
include "/etc/crypto-policies/back-ends/bind.config";
};
logging {
channel default_debug {
file "data/named.run";
severity dynamic;
};
};
zone "." IN {
type hint;
file "named.ca";
};
include "/etc/named.rfc1912.zones";
include "/etc/named.root.key";
zone "ZONE_NAME" IN { #IN 可以省略不写
type {master|slave|hint|forward}; #类型 master,slave 用于DNS主从,forward表示转发
file "file_path"; #具体解析规则文件路径
};
#该文件中定义了要解析的域名与具体解析规则之间的对应关系
[root@ubuntu-157 ~]# cat /etc/bind/named.conf.default-zones
// prime the server with knowledge of the root servers
zone "." {
type hint;
file "/usr/share/dns/root.hints";
};
// be authoritative for the localhost forward and reverse zones, and for
// broadcast zones as per RFC 1912
zone "localhost" {
type master;
file "/etc/bind/db.local";
};
zone "127.in-addr.arpa" {
type master;
file "/etc/bind/db.127";
};
zone "0.in-addr.arpa" {
type master;
file "/etc/bind/db.0";
};
zone "255.in-addr.arpa" {
type master;
file "/etc/bind/db.255";
};
#例子
[root@ubuntu-157 ~]# cat /etc/bind/db.0
;
; BIND reverse data file for "this host on this network" zone
;
$TTL 604800
@ IN SOA localhost. root.localhost. (
1 ; Serial
604800 ; Refresh
86400 ; Retry
2419200 ; Expire
604800 ) ; Negative Cache TTL
;
@ IN NS localhost.
Resource Recode定义
复制代码
#RR格式
NAME TTL CLASS TYPE VALUE
#字段说明
NAME #资源记录名称,根据TYPE不一样，写法会有不同
TTL #缓存有效期，默认单位是秒，也可以加单位{ M(分), H(时), D(天), W(周) }
CLASS #资源记录类别
TYPE #记录类型，具体值见下表
VALUE #此记录对应的具体值，根据TYPE不一样，写法会有不同
|-------|----------------------------------------------------|
| 值 | 说明 |
| A | internet Address，将FQDN解析成IPV4地址，这是最常用的一种解析类型 |
| AAAA | IPV6 internet Address，将FQDN解析成IPV6地址 |
| CNAME | the canonical name for an alias，记录别名，将域名解析到另一个域名 |
| MX | Mail eXchanger，用于邮件交换，指定邮件服务 |
| NS | Name Server，将解析指向另外一个DNS，表示由被指定的DNS解析当前记录 |
| PTR | a domain name pointer，域名指针，用IP地址反向解析域名 |
| SOA | a marks the start of a zone of authority，标记权威区域的开始 |
| HINFO | host information，主机信息 |
| KEY | 安全密钥记录 |
| MD/MF | 被废弃，使用 MX |
| MINFO | mailbox or mail list information，邮箱或邮件列表信息 |
| SRV | service and protocol，服务和协议 |
| TXT | text strings，文本字符串，此类型值长度限定不超过512个字符 |
| WKS | a well known service description/众所周知的服务描述 |
②A、AAAA记录
A 记录也称主机记录，是将主机域名解析到指定的物理机IPV4地址上，是DNS解析服务中最常见的资源记录。
AAAA 记录是IPV6地址的主机记录，是将主机域名解析到指定物理机的IPV6地址上。
复制代码
www.linux-magedu.com. 86400 IN A 10.0.0.210
blog.linux-magedu.com. 86400 IN A 10.0.0.206
blog.linux-magedu.com. 86400 IN A 10.0.0.210 #如果有多条A记录，且有A记录的IP与DNS机器IP相同，则优先返回
*.linux-magedu.com. 86400 IN A 10.0.0.210 #泛解析，匹配所有以 linuxmagedu.com结束的域名或主机名
linux-magedu.com. 86400 IN A 10.0.0.167
@ 86400 IN A 10.0.0.167 #@代表域名，此条记录含义同上
③CNAME别名记录
记录别名，将域名解析到另一个域名。
复制代码
abc.linux-magedu.com. 86400 IN CNAME def.magedu.com. #将 abc.linuxmagedu.com 解析到def.magedu.com
linux-magedu.com. 86400 IN MX 10 mx1.linux-magedu.com.
linux-magedu.com. 86400 IN MX 20 mx2.linux-magedu.com.
mx1.linux-magedu.com. 86400 IN A 10.0.0.206
mx2.linux-magedu.com. 86400 IN A 10.0.0.208
inux-magedu.com. 86400 IN NS dns1.linux-magedu.com.
linux-magedu.com. 86400 IN NS dns2.linux-magedu.com.
dns1.linux-magedu.com. 86400 IN A 10.0.0.206
dns2.linux-magedu.com. 86400 IN A 10.0.0.208
⑥PTR记录
PTR记录是A记录的逆向记录，又称做IP反查记录或指针记录，负责将IP反向解析为域名。
复制代码
#A记录
blog.linux-magedu.com. 86400 IN A 10.0.0.167
#与其对应的PTR记录
#IP地址反着写，后面跟 .in-addr.arpa.
167.0.0.10.in-addr.arpa. 86400 IN PTR blog.linux-magedu.com.
⑦SOA记录
SOA记录是起始授权记录，用于设置当前DNS服务器的某些规则，SOA记录要放在整个文件的最开始。
SOA 记录表示此DNS是该域名的权威解析服务器，当在查询的过程中，各级缓存都没有要查询的内容时，最后会通过递归查询的方式到达此DNS服务器，并请求此域名的SOA记录。
SOA记录同样符合 NAME TTL CLASS TYPE VALUE 这五个字段的格式定义，但VALUE字段值较多。
[root@ubuntu-157 bind]# vim /etc/bind/named.conf.default-zones
[root@ubuntu-157 bind]# cat /etc/bind/named.conf.default-zones
....
zone "linux-magedu.com" IN {
type master;
file "/etc/bind/db.linux-magedu.com"; #具体解析规则文件
};
设置具体解析规则
objectivec复制代码
[root@ubuntu-157 ~]# cd /etc/bind/
[root@ubuntu-157 bind]# ls
db.0 db.empty named.conf.default-zones rndc.key
db.127 db.local named.conf.local zones.rfc1918
db.255 named.conf named.conf.options
[root@ubuntu-157 bind]# vim /etc/bind/db.linux-magedu.com
linux-magedu.com. 86400 IN SOA linux-dns admin.linux-magedu.com. ( 123 3H 15M 1D 1W )
linux-magedu.com. 86400 IN NS dns1.linux-magedu.com.
linux-magedu.com. 86400 IN NS dns2.linux-magedu.com.
dns1.linux-magedu.com. 86400 IN A 10.0.0.157
dns2.linux-magedu.com. 86400 IN A 10.0.0.157
www.linux-magedu.com. 86400 IN A 10.0.0.153
w.linux-magedu.com. 86400 IN A 1.2.3.4
bbs.linux-magedu.com. 86400 IN A 11.11.11.11
#修改权限，修改属主属组（可选）
[root@ubuntu ~]# chmod 644 /etc/bind/db.linux-magedu.com
[root@ubuntu ~]# chown root.root /etc/bind/db.linux-magedu.com
#语法检查
[root@ubuntu-157 bind]# named-checkzone linux-magedu.com ./db.linux-magedu.com #域名 对应解析规则文件
zone linux-magedu.com/IN: loaded serial 123
OK
#重载生效
[root@ubuntu-157 bind]# rndc reload
server reload successful
服务端测试
objectivec复制代码
[root@ubuntu-157 bind]# dig www.linux-magedu.com
; <<>> DiG 9.20.11-0ubuntu0.1-Ubuntu <<>> www.linux-magedu.com
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 41337
;; flags: qr aa rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 1
;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 1232
; COOKIE: 90a348da1df4980b0100000068f4a05b47bd9983787466eb (good)
;; QUESTION SECTION:
;www.linux-magedu.com. IN A
;; ANSWER SECTION:
www.linux-magedu.com. 86400 IN A 10.0.0.153
;; Query time: 0 msec
;; SERVER: 127.0.0.1#53(127.0.0.1) (UDP)
;; WHEN: Sun Oct 19 16:24:59 CST 2025
;; MSG SIZE rcvd: 93
[root@ubuntu-157 bind]# dig w.linux-magedu.com
; <<>> DiG 9.20.11-0ubuntu0.1-Ubuntu <<>> w.linux-magedu.com
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 45549
;; flags: qr aa rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 1
;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 1232
; COOKIE: 380717e24e4d2d960100000068f4a0802440deb31b424730 (good)
;; QUESTION SECTION:
;w.linux-magedu.com. IN A
;; ANSWER SECTION:
w.linux-magedu.com. 86400 IN A 1.2.3.4
;; Query time: 0 msec
;; SERVER: 127.0.0.1#53(127.0.0.1) (UDP)
;; WHEN: Sun Oct 19 16:25:36 CST 2025
;; MSG SIZE rcvd: 91
[root@ubuntu-157 bind]# dig bbs.linux-magedu.com
; <<>> DiG 9.20.11-0ubuntu0.1-Ubuntu <<>> bbs.linux-magedu.com
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 1305
;; flags: qr aa rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 1
;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 1232
; COOKIE: b46e28297f5c3b5e0100000068f4a0874befd4097972c809 (good)
;; QUESTION SECTION:
;bbs.linux-magedu.com. IN A
;; ANSWER SECTION:
bbs.linux-magedu.com. 86400 IN A 11.11.11.11
;; Query time: 0 msec
;; SERVER: 127.0.0.1#53(127.0.0.1) (UDP)
;; WHEN: Sun Oct 19 16:25:43 CST 2025
;; MSG SIZE rcvd: 93
[root@ubuntu-157 bind]# ping www.linux-magedu.com
PING www.linux-magedu.com (10.0.0.153) 56(84) bytes of data.
64 bytes from 10.0.0.153: icmp_seq=1 ttl=64 time=4.19 ms
64 bytes from 10.0.0.153: icmp_seq=2 ttl=64 time=0.955 ms
64 bytes from 10.0.0.153: icmp_seq=3 ttl=64 time=0.746 ms
64 bytes from 10.0.0.153: icmp_seq=4 ttl=64 time=0.495 ms
^C
--- www.linux-magedu.com ping statistics ---
4 packets transmitted, 4 received, 0% packet loss, time 3024ms
rtt min/avg/max/mdev = 0.495/1.597/4.194/1.507 ms
[root@ubuntu-157 bind]# ping w.linux-magedu.com
PING w.linux-magedu.com (1.2.3.4) 56(84) bytes of data.
^C
--- w.linux-magedu.com ping statistics ---
23 packets transmitted, 0 received, 100% packet loss, time 22559ms
#添加从DNS配置，此配置是保证能推送数据到从节点
[root@ubuntu-157 ~]# cat /etc/bind/db.linux-magedu.com
linux-magedu.com. 86400 IN SOA linux-dns admin.linux-magedu.com. ( 123 3H 15M 1D 1W )
linux-magedu.com. 86400 IN NS dns1.linux-magedu.com.
linux-magedu.com. 86400 IN NS dns2.linux-magedu.com.
dns1.linux-magedu.com. 86400 IN A 10.0.0.157
dns2.linux-magedu.com. 86400 IN A 10.0.0.150 #修改为从DNS服务器IP地址
www.linux-magedu.com. 86400 IN A 10.0.0.153
w.linux-magedu.com. 86400 IN A 1.2.3.4
bbs.linux-magedu.com. 86400 IN A 11.11.11.11
客户端测试
objectivec复制代码
[root@rocky-154 ~]#cat /etc/resolv.conf
# Generated by NetworkManager
search localdomain
nameserver 10.0.0.157
#默认DNS返回
[root@rocky-154 ~]#nslookup www.linux-magedu.com
Server: 10.0.0.157
Address: 10.0.0.157#53
Name: www.linux-magedu.com
Address: 10.0.0.153
#指定从DNS地址
[root@rocky-154 ~]#dig bbs.linux-magedu.com @10.0.0.150
; <<>> DiG 9.11.36-RedHat-9.11.36-16.el8_10.4 <<>> bbs.linux-magedu.com @10.0.0.150
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 29632
;; flags: qr aa rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 1
;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 1232
; COOKIE: 9135d08c270822ff0100000068f4d7986dd5213e63826b0e (good)
;; QUESTION SECTION:
;bbs.linux-magedu.com. IN A
;; ANSWER SECTION:
bbs.linux-magedu.com. 86400 IN A 11.11.11.11
;; Query time: 1 msec
;; SERVER: 10.0.0.150#53(10.0.0.150)
;; WHEN: Sun Oct 19 20:20:39 CST 2025
;; MSG SIZE rcvd: 93
[root@rocky-154 ~]#host w.linux-magedu.com
w.linux-magedu.com has address 1.2.3.4
#关闭DNS MASTER上的服务
[root@ubuntu-157 bind]# systemctl stop named.service
[root@ubuntu-157 bind]# systemctl is-active named
inactive
#测试
[root@rocky-154 ~]#ping www.linux-magedu.com
ping: www.linux-magedu.com: Name or service not known
#默认DNS无法解析
[root@rocky-154 ~]#nslookup bbs.linux-magedu.com
;; connection timed out; no servers could be reached
#客户端添加从DNS
[root@rocky-154 ~]#vim /etc/resolv.conf
[root@rocky-154 ~]#cat /etc/resolv.conf
# Generated by NetworkManager
search localdomain
nameserver 10.0.0.157
nameserver 10.0.0.150
#再次测试
[root@rocky-154 ~]#ping www.linux-magedu.com
PING www.linux-magedu.com (10.0.0.153) 56(84) bytes of data.
64 bytes from 10.0.0.153 (10.0.0.153): icmp_seq=1 ttl=64 time=0.905 ms
64 bytes from 10.0.0.153 (10.0.0.153): icmp_seq=2 ttl=64 time=0.499 ms
64 bytes from 10.0.0.153 (10.0.0.153): icmp_seq=3 ttl=64 time=0.637 ms
^C
--- www.linux-magedu.com ping statistics ---
3 packets transmitted, 3 received, 0% packet loss, time 2026ms
rtt min/avg/max/mdev = 0.499/0.680/0.905/0.169 ms
#DNS SLAVE能提供解析
[root@rocky-154 ~]#nslookup bbs.linux-magedu.com
Server: 10.0.0.150
Address: 10.0.0.150#53
Name: bbs.linux-magedu.com
Address: 11.11.11.11
主从DNS数据同步测试
在 BIND 的 DNS 区域解析规则文件中，版本号（Serial Number）是主从服务器同步的核心触发机制。它的作用类似于版本控制系统中的"提交ID"，用于标识区域文件的修改历史，确保从服务器仅在主服务器的版本号更新时才会同步数据。
objectivec复制代码
#在DNS MASTER增加一条db解析记录
[root@ubuntu-157 bind]# cat db.linux-magedu.com
linux-magedu.com. 86400 IN SOA linux-dns admin.linux-magedu.com. ( 124 3H 15M 1D 1W )
linux-magedu.com. 86400 IN NS dns1.linux-magedu.com.
linux-magedu.com. 86400 IN NS dns2.linux-magedu.com.
dns1.linux-magedu.com. 86400 IN A 10.0.0.157
dns2.linux-magedu.com. 86400 IN A 10.0.0.150
www.linux-magedu.com. 86400 IN A 10.0.0.153
w.linux-magedu.com. 86400 IN A 1.2.3.4
bbs.linux-magedu.com. 86400 IN A 11.11.11.11
blog.linux-magedu.com. 86400 IN A 6.6.6.6 #添加
#查看文件修改时间
[root@ubuntu-157 bind]# ll db.linux-magedu.com
-rw-r--r-- 1 root bind 502 Oct 19 20:37 db.linux-magedu.com
[root@ubuntu-157 bind]# dig blog.linux-magedu.com
; <<>> DiG 9.20.11-0ubuntu0.1-Ubuntu <<>> blog.linux-magedu.com
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 2621
;; flags: qr aa rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 1
;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 1232
; COOKIE: fc865b82c15d437f0100000068f4dc0549e5eac6e4341ca1 (good)
;; QUESTION SECTION:
;blog.linux-magedu.com. IN A
;; ANSWER SECTION:
blog.linux-magedu.com. 86400 IN A 6.6.6.6
;; Query time: 0 msec
;; SERVER: 127.0.0.1#53(127.0.0.1) (UDP)
;; WHEN: Sun Oct 19 20:39:33 CST 2025
;; MSG SIZE rcvd: 94
#在DNS SLAVE测试 - 还未同步数据，解析失败
[root@ubuntu2204-150 ~]# ll /etc/bind/slaves/db.linux-magedu.com
-rw-r--r-- 1 bind bind 464 Oct 19 20:00 /etc/bind/slaves/db.linux-magedu.com
[root@ubuntu2204-150 ~]# dig blog.linux-magedu.com
; <<>> DiG 9.18.39-0ubuntu0.22.04.1-Ubuntu <<>> blog.linux-magedu.com
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NXDOMAIN, id: 62014
;; flags: qr aa rd ra; QUERY: 1, ANSWER: 0, AUTHORITY: 1, ADDITIONAL: 1
;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 1232
; COOKIE: 7c3490c9cbb3fc8a0100000068f4dc68998a6748289824f5 (good)
;; QUESTION SECTION:
;blog.linux-magedu.com. IN A
;; AUTHORITY SECTION:
linux-magedu.com. 86400 IN SOA linux-dns.linux-magedu.com. admin.linux-magedu.com. 123 10800 900 86400 604800
;; Query time: 3 msec
;; SERVER: 127.0.0.1#53(127.0.0.1) (UDP)
;; WHEN: Sun Oct 19 20:41:12 CST 2025
;; MSG SIZE rcvd: 130
#DNS MASTER更改版本号
[root@ubuntu-157 bind]# vim db.linux-magedu.com
linux-magedu.com. 86400 IN SOA linux-dns admin.linux-magedu.com. ( 125 3H 15M 1D 1W )
...
[root@ubuntu-157 bind]# rndc reload
server reload successful
[root@ubuntu-157 bind]# ll db.linux-magedu.com
-rw-r--r-- 1 root bind 502 Oct 19 20:43 db.linux-magedu.com
#DNS SLAVE 同步成功
[root@ubuntu2204-150 ~]# ll /etc/bind/slaves/db.linux-magedu.com
-rw-r--r-- 1 bind bind 464 Oct 19 20:44 /etc/bind/slaves/db.linux-magedu.com
[root@rocky-154 ~]#cat /etc/resolv.conf
# Generated by NetworkManager
search localdomain
nameserver 10.0.0.157
[root@rocky-154 ~]#ping www.linux-magedu.com
PING www.linux-magedu.com (10.0.0.153) 56(84) bytes of data.
64 bytes from www.linux-magedu.com (10.0.0.153): icmp_seq=1 ttl=64 time=0.732 ms
64 bytes from www.linux-magedu.com (10.0.0.153): icmp_seq=2 ttl=64 time=0.486 ms
64 bytes from www.linux-magedu.com (10.0.0.153): icmp_seq=3 ttl=64 time=0.613 ms
64 bytes from www.linux-magedu.com (10.0.0.153): icmp_seq=4 ttl=64 time=0.974 ms
^C
--- www.linux-magedu.com ping statistics ---
4 packets transmitted, 4 received, 0% packet loss, time 3045ms
rtt min/avg/max/mdev = 0.486/0.701/0.974/0.180 ms
#停止157上的DNS服务
[root@ubuntu-157 bind]# systemctl stop named
#客户端测试，无法解析域名
[root@rocky-154 ~]#ping www.linux-magedu.com
ping: www.linux-magedu.com: Name or service not known
#启动，让客户端安装
[root@ubuntu-157 bind]# systemctl start named
#安装缓存软件，执行前保证客户机DNS能用，先启动DNS服务
[root@rocky-154 ~]#yum install -y nscd
[root@rocky-154 ~]#systemctl enable --now nscd
Created symlink /etc/systemd/system/multi-user.target.wants/nscd.service → /usr/lib/systemd/system/nscd.service.
Created symlink /etc/systemd/system/sockets.target.wants/nscd.socket → /usr/lib/systemd/system/nscd.socket.
[root@rocky-154 ~]#ping www.linux-magedu.com
PING www.linux-magedu.com (10.0.0.153) 56(84) bytes of data.
64 bytes from www.linux-magedu.com (10.0.0.153): icmp_seq=1 ttl=64 time=1.26 ms
64 bytes from www.linux-magedu.com (10.0.0.153): icmp_seq=2 ttl=64 time=0.486 ms
64 bytes from www.linux-magedu.com (10.0.0.153): icmp_seq=3 ttl=64 time=0.535 ms
64 bytes from www.linux-magedu.com (10.0.0.153): icmp_seq=4 ttl=64 time=0.414 ms
^C
--- www.linux-magedu.com ping statistics ---
4 packets transmitted, 4 received, 0% packet loss, time 4076ms
rtt min/avg/max/mdev = 0.414/0.624/1.264/0.323 ms
#再次停止157DNS服务
[root@ubuntu-157 bind]# systemctl stop named
#客户端继续可以解析域名
[root@rocky-154 ~]#ping www.linux-magedu.com
PING www.linux-magedu.com (10.0.0.153) 56(84) bytes of data.
64 bytes from www.linux-magedu.com (10.0.0.153): icmp_seq=1 ttl=64 time=1.11 ms
64 bytes from www.linux-magedu.com (10.0.0.153): icmp_seq=2 ttl=64 time=0.565 ms
64 bytes from www.linux-magedu.com (10.0.0.153): icmp_seq=3 ttl=64 time=0.426 ms
64 bytes from www.linux-magedu.com (10.0.0.153): icmp_seq=4 ttl=64 time=0.449 ms
^C
--- www.linux-magedu.com ping statistics ---
4 packets transmitted, 4 received, 0% packet loss, time 3085ms
rtt min/avg/max/mdev = 0.426/0.636/1.107/0.278 ms
#没有缓存到，无法解析
[root@rocky-154 ~]#ping bbs.linux-magedu.com
ping: bbs.linux-magedu.com: Name or service not known
#启动DNS服务
[root@ubuntu-157 bind]# systemctl start named
[root@rocky-154 ~]#ping bbs.linux-magedu.com
PING bbs.linux-magedu.com (11.11.11.11) 56(84) bytes of data.
^C
--- bbs.linux-magedu.com ping statistics ---
3 packets transmitted, 0 received, 100% packet loss, time 4122ms
#再次关闭157DNS服务
[root@ubuntu-157 bind]# systemctl stop named
[root@rocky-154 ~]#ping bbs.linux-magedu.com
PING bbs.linux-magedu.com (11.11.11.11) 56(84) bytes of data.
^C
--- bbs.linux-magedu.com ping statistics ---
3 packets transmitted, 0 received, 100% packet loss, time 2077ms
Rocky系统查看DNS缓存
objectivec复制代码
[root@rocky-154 ~]#nscd -g
nscd configuration:
0 server debug level
13m 2s server runtime
5 current number of threads
32 maximum number of threads
0 number of times clients had to wait
no paranoia mode enabled
3600 restart internal
5 reload count
...
Ubuntu系统中的DNS缓存
复制代码
#ubuntu自带DNS缓存,systemd-resolved服务提供
#用一台新主机160，没有配置过bind程序的主机
[root@ubuntu2204-160 ~]# cat /etc/resolv.conf
...
nameserver 127.0.0.53
options edns0 trust-ad
search localdomain
#无法PING通,因为该域名解析是配置在157主机上
[root@ubuntu2204-160 ~]# ping www.linux-magedu.com -c1
ping: www.linux-magedu.com: Name or service not known
[root@ubuntu2204-160 ~]# dig www.linux-magedu.com
; <<>> DiG 9.18.30-0ubuntu0.22.04.2-Ubuntu <<>> www.linux-magedu.com
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NXDOMAIN, id: 30658
;; flags: qr rd ra; QUERY: 1, ANSWER: 0, AUTHORITY: 1, ADDITIONAL: 1
;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 65494
;; QUESTION SECTION:
;www.linux-magedu.com. IN A
;; AUTHORITY SECTION:
com. 5 IN SOA a.gtld-servers.net. nstld.verisign-grs.com. 1760938999 1800 900 604800 900
;; Query time: 476 msec
;; SERVER: 127.0.0.53#53(127.0.0.53) (UDP)
;; WHEN: Mon Oct 20 05:43:34 UTC 2025
;; MSG SIZE rcvd: 122
#指定DNS
[root@ubuntu2204-160 ~]# dig www.linux-magedu.com @10.0.0.157
; <<>> DiG 9.18.30-0ubuntu0.22.04.2-Ubuntu <<>> www.linux-magedu.com @10.0.0.157
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 57569
;; flags: qr aa rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 1
;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 1232
; COOKIE: d0dab62d0195cd770100000068f5cc391efd2be593473270 (good)
;; QUESTION SECTION:
;www.linux-magedu.com. IN A
;; ANSWER SECTION:
www.linux-magedu.com. 86400 IN A 10.0.0.153
;; Query time: 3 msec
;; SERVER: 10.0.0.157#53(10.0.0.157) (UDP)
;; WHEN: Mon Oct 20 05:44:25 UTC 2025
;; MSG SIZE rcvd: 93
#修改网卡,指定DNS
[root@ubuntu2204-160 ~]# cat /etc/netplan/50-cloud-init.yaml
...
network:
ethernets:
ens33:
#dhcp4: true
addresses: [10.0.0.160/24]
routes: [{to: default,via: 10.0.0.2}]
nameservers:
addresses: [10.0.0.157] #指定DNS10.0.0.157
version: 2
[root@ubuntu2204-160 ~]# netplan apply
#测试-生效
[root@ubuntu2204-160 ~]# host www.linux-magedu.com
www.linux-magedu.com has address 10.0.0.153
[root@ubuntu2204-160 ~]# ping www.linux-magedu.com -c1
PING www.linux-magedu.com (10.0.0.153) 56(84) bytes of data.
64 bytes from www.linux-magedu.com (10.0.0.153): icmp_seq=1 ttl=64 time=2.87 ms
--- www.linux-magedu.com ping statistics ---
1 packets transmitted, 1 received, 0% packet loss, time 0ms
rtt min/avg/max/mdev = 2.867/2.867/2.867/0.000 ms
#关闭157 远程DNS服务
[root@ubuntu-157 ~]# systemctl stop named
#再次测试客户端,上次解析后有了缓存
[root@ubuntu2204-160 ~]# ping www.linux-magedu.com
PING www.linux-magedu.com (10.0.0.153) 56(84) bytes of data.
64 bytes from www.linux-magedu.com (10.0.0.153): icmp_seq=1 ttl=64 time=0.631 ms
64 bytes from www.linux-magedu.com (10.0.0.153): icmp_seq=2 ttl=64 time=0.364 ms
64 bytes from www.linux-magedu.com (10.0.0.153): icmp_seq=3 ttl=64 time=0.509 ms
^C
--- www.linux-magedu.com ping statistics ---
3 packets transmitted, 3 received, 0% packet loss, time 2004ms
rtt min/avg/max/mdev = 0.364/0.501/0.631/0.109 ms
Ubuntu系统查看DNS缓存
复制代码
[root@ubuntu2204-160 ~]# resolvectl statistics
DNSSEC supported by current servers: no
Transactions
Current Transactions: 0
Total Transactions: 48
Cache
Current Cache Size: 2
Cache Hits: 5
Cache Misses: 6
DNSSEC Verdicts
Secure: 0
Insecure: 0
Bogus: 0
Indeterminate: 0
将子域委派给其它的DNS服务器解析，实现分布式DNS服务。即将一个主域（如 example.com）下的某个子域（如 sub.example.com）的解析权完全交给另一台独立的 DNS 服务器管理，实现负载均衡、区域隔离、权限下放，是构建大规模、高可用 DNS 服务的常见方法。
|-------------------|----------------------|---------------------------------|
| 主机IP | 角色 | 备注 |
| 10.0.0.157-ubuntu | MASTER DNS SERVER | 为客户端主机提供DNS解析服务 |
| 10.0.0.150-ubuntu | SLAVE DNS SERVER | 为客户端主机提供DNS解析服务，同时从master同步解析数据 |
| 10.0.0.160-ubuntu | Subdomain DNS SERVER | 为子域提供解析服务 |
| 10.0.0.154-rocky | 客户端 | 客户端主机将DNS配置为10.0.0.157 |
| 10.0.0.153-rocky | WEB- | 提供web网站，解析域名 |
DNS MASTER 配置
复制代码
#添加bj子域配置，bj子域由bjdns服务解析，修改序列号
[root@ubuntu-157 ~]# cat /etc/bind/db.linux-magedu.com
linux-magedu.com. 86400 IN SOA linux-dns admin.linux-magedu.com. ( 127 3H 15M 1D 1W )
linux-magedu.com. 86400 IN NS dns1.linux-magedu.com.
linux-magedu.com. 86400 IN NS dns2.linux-magedu.com.
bj.linux-magedu.com. 86400 IN NS bj.linux-magedu.com.
dns1.linux-magedu.com. 86400 IN A 10.0.0.157
dns2.linux-magedu.com. 86400 IN A 10.0.0.150
bj.linux-magedu.com. 86400 IN A 10.0.0.160
www.linux-magedu.com. 86400 IN A 10.0.0.153
w.linux-magedu.com. 86400 IN A 1.2.3.4
bbs.linux-magedu.com. 86400 IN A 11.11.11.11
#重载生效
[root@ubuntu-157 ~]# rndc reload
server reload successful
[root@ubuntu-157 ~]# ll /etc/bind/db.linux-magedu.com
-rw-r--r-- 1 root bind 563 Oct 20 14:43 /etc/bind/db.linux-magedu.com
#查看从服务器，主从同步成功
[root@ubuntu2204-150 ~]# ll /etc/bind/slaves/db.linux-magedu.com
-rw-r--r-- 1 bind bind 465 Oct 20 14.43 /etc/bind/db.linux-magedu.com
子域DNS配置
复制代码
[root@ubuntu2204-160 ~]# apt install bind9 -y
#子域配置
[root@ubuntu2204-160 ~]# cat /etc/bind/named.conf.default-zones
...
zone "bj.linux-magedu.com" IN {
type master;
file "/etc/bind/db.bj.linux-magedu.com";
};
[root@ubuntu2204-160 ~]# cat /etc/bind/db.bj.linux-magedu.com
bj.linux-magedu.com. 86400 IN SOA bj-dns. admin.bj-dns.com ( 123 3H 15M 1D 1W )
bj.linux-magedu.com. 86400 IN NS bj-sub.bj.linux-magedu.com.
bj-sub.bj.linux-magedu.com. 86400 IN A 10.0.0.160
www.bj.linux-magedu.com. 86400 IN A 11.22.33.44
test.bj.linux-magedu.com. 86400 IN A 55.66.77.88
#生效
[root@ubuntu2204-160 ~]# rndc reload
server reload successful
#测试
#本机配置 标志位：权威aa
[root@ubuntu2204-160 ~]# dig www.bj.linux-magedu.com @127.1
; <<>> DiG 9.18.39-0ubuntu0.22.04.1-Ubuntu <<>> www.bj.linux-magedu.com @127.1
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 6684
;; flags: qr aa rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 1
;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 1232
; COOKIE: 7d5520c1a2a50e4f0100000068f5e29f0933759031431e72 (good)
;; QUESTION SECTION:
;www.bj.linux-magedu.com. IN A
;; ANSWER SECTION:
www.bj.linux-magedu.com. 86400 IN A 11.22.33.44
;; Query time: 0 msec
;; SERVER: 127.0.0.1#53(127.1) (UDP)
;; WHEN: Mon Oct 20 07:19:59 UTC 2025
;; MSG SIZE rcvd: 96
[root@ubuntu2204-160 ~]# dig www.bj.linux-magedu.com @10.0.0.160
; <<>> DiG 9.18.39-0ubuntu0.22.04.1-Ubuntu <<>> www.bj.linux-magedu.com @10.0.0.160
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 32359
;; flags: qr aa rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 1
;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 1232
; COOKIE: ed549f1bd8b0a39d0100000068f5e34d9065625c815c2047 (good)
;; QUESTION SECTION:
;www.bj.linux-magedu.com. IN A
;; ANSWER SECTION:
www.bj.linux-magedu.com. 86400 IN A 11.22.33.44
;; Query time: 0 msec
;; SERVER: 10.0.0.160#53(10.0.0.160) (UDP)
;; WHEN: Mon Oct 20 07:22:53 UTC 2025
;; MSG SIZE rcvd: 96
#找157DNS解析 157将子域转发到160 非权威
[root@ubuntu2204-160 ~]# dig www.bj.linux-magedu.com @10.0.0.157
; <<>> DiG 9.18.39-0ubuntu0.22.04.1-Ubuntu <<>> www.bj.linux-magedu.com @10.0.0.157
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 15187
;; flags: qr rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 1
;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 1232
; COOKIE: 02fba371dc424fad0100000068f5e2d92e7bc11c10558457 (good)
;; QUESTION SECTION:
;www.bj.linux-magedu.com. IN A
;; ANSWER SECTION:
www.bj.linux-magedu.com. 86400 IN A 11.22.33.44
;; Query time: 39 msec
;; SERVER: 10.0.0.157#53(10.0.0.157) (UDP)
;; WHEN: Mon Oct 20 07:20:57 UTC 2025
;; MSG SIZE rcvd: 96
#新增域名配置
[root@ubuntu2204-150 ~]# cat /etc/bind/named.conf.default-zones
...
//zone "linux-magedu.com" IN { #将主从配置注释
// type slave;
// masters {10.0.0.157;};
// file "/etc/bind/slaves/db.linux-magedu.com";
//};
zone "golang-magedu.com" IN {
type master;
file "/etc/bind/db.golang-magedu.com";
};
[root@ubuntu2204-150 ~]# cat /etc/bind/db.golang-magedu.com
golang-magedu.com. 86400 IN SOA golang-dns. admin.golang-dns.com ( 123 3H 15M 1D 1W)
golang-magedu.com. 86400 IN NS dns.golang-magedu.com.
dns.golang-magedu.com. 86400 IN A 10.0.0.150
www.golang-magedu.com. 86400 IN A 1.2.3.4
test.golang-magedu.com. 86400 IN A 5.6.7.8
[root@ubuntu2204-150 ~]# systemctl restart named
