Linux DNS 服务器-从高速缓存到辅助 DNS 部署指南

DNS(域名系统)

DNS(Domain Name System)是将人类可读的域名(如example.com)转换为机器可读的IP地址(如93.184.216.34)的分布式数据库系统。其核心功能包括:

  • 域名解析:将域名映射为IP地址。
  • 分层结构:采用树状结构,包括根域、顶级域(TLD)、二级域等。
  • 记录类型:支持A(IPv4)、AAAA(IPv6)、MX(邮件交换)、CNAME(别名)等记录。

一.高速缓存DNS

DNS高速缓存是临时存储DNS查询结果的机制,用于加速后续相同域名的解析

1.实验环境

主机名 ip 用途
node1 172.25.254.10 高速缓存dns
node2 172.25.254.20 客户端1
node3 172.25.254.30 客户端2

2.部署高速缓存dns

a、安装并启用dns

bash 复制代码
[root@node1 ~]# dnf install bind.x86_64 -y
[root@node1 ~]# systemctl enable --now named
Created symlink /etc/systemd/system/multi-user.target.wants/named.service → /usr/lib/systemd/system/named.service.

#配置dns的基本信息
options {
        listen-on port 53 { any; };				#开放端口在所有网络接口上
        listen-on-v6 port 53 { ::1; };
        directory       "/var/named";
        dump-file       "/var/named/data/cache_dump.db";
        statistics-file "/var/named/data/named_stats.txt";
        memstatistics-file "/var/named/data/named_mem_stats.txt";
        secroots-file   "/var/named/data/named.secroots";
        recursing-file  "/var/named/data/named.recursing";
        allow-query     { any; };			#允许是所有人来使用dns
        recursion yes;							#递归开关
        #如果你搭建【权威DNS服务器(托管自有域名)】:禁止开启递归
		#如果你搭建【缓存/递归DNS(内网上网解析用)】:必须开启recursion yes
        forwarders        { 114.114.114.114; };		#指定缓存谁的A记录
        dnssec-validation no;						#不做dns的安全校验

        managed-keys-directory "/var/named/dynamic";
        geoip-directory "/usr/share/GeoIP";

        pid-file "/run/named/named.pid";
        session-keyfile "/run/named/session.key";

        /* https://fedoraproject.org/wiki/Changes/CryptoPolicy */
        include "/etc/crypto-policies/back-ends/bind.config";
};

b、测试:

bash 复制代码
[root@node2 ~]# dig www.taobao.com @172.25.254.10

; <<>> DiG 9.16.23-RH <<>> www.taobao.com @172.25.254.10
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 2587
;; flags: qr rd ra; QUERY: 1, ANSWER: 3, AUTHORITY: 0, ADDITIONAL: 1

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 1232
; COOKIE: 85998c69795b69c3010000006a5c2f47def3d47461456d61 (good)
;; QUESTION SECTION:
;www.taobao.com.                        IN      A

;; ANSWER SECTION:
www.taobao.com.         600     IN      CNAME   www.taobao.com.danuoyi.tbcache.com.
www.taobao.com.danuoyi.tbcache.com. 32 IN A     117.157.129.53
www.taobao.com.danuoyi.tbcache.com. 32 IN A     117.157.129.52

;; Query time: 4178 msec			#解析消耗时间
;; SERVER: 172.25.254.10#53(172.25.254.10)
;; WHEN: Sun Jul 19 09:58:31 CST 2026
;; MSG SIZE  rcvd: 151

[root@node3 ~]# dig www.taobao.com @172.25.254.10

; <<>> DiG 9.16.23-RH <<>> www.taobao.com @172.25.254.10
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 40520
;; flags: qr rd ra; QUERY: 1, ANSWER: 3, AUTHORITY: 0, ADDITIONAL: 1

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 1232
; COOKIE: 04aeb7a29393043e010000006a5c2f516d67e63f1bfec76e (good)
;; QUESTION SECTION:
;www.taobao.com.                        IN      A

;; ANSWER SECTION:
www.taobao.com.         590     IN      CNAME   www.taobao.com.danuoyi.tbcache.com.
www.taobao.com.danuoyi.tbcache.com. 22 IN A     117.157.129.52
www.taobao.com.danuoyi.tbcache.com. 22 IN A     117.157.129.53

;; Query time: 0 msec		#缓存生效
;; SERVER: 172.25.254.10#53(172.25.254.10)
;; WHEN: Sun Jul 19 09:58:41 CST 2026
;; MSG SIZE  rcvd: 151

二.dns服务器的解析部署

1.正向解析

a. named.rfc1912.zones 区域配置

bash 复制代码
[root@node1 ~]# vim /etc/named.rfc1912.zones
zone "localhost" IN {
        type master;
        file "named.localhost";
        allow-update { none; };
};

zone "timinglee.org" IN {
        type master;
        file "timinglee.org.zone";
        allow-update { none; };
};
配置片段 字段含义 详细说明
zone "localhost" IN { 定义区域:localhost zone "域名" 声明要托管的域名区域IN 固定互联网记录类
type master; 服务器类型:主 DNS master = 主权威服务器,本机持有该域名原始 zone 文件,所有解析记录由本机管理
file "named.localhost"; 区域库文件路径 文件存放根目录由 named.confdirectory "/var/named" 指定完整路径:/var/named/named.localhost
allow-update { none; }; 禁止动态 DNS 更新 none = 不允许客户端 / 其他服务器自动修改域名记录,只能手动改 zone 文件;内网有 DHCP 动态解析才填网段
}; 区域配置结束符 每个 zone 大括号成对闭合
zone "timinglee.org" IN { 自定义业务域名区域 声明本机托管 timinglee.org 域名,对应你之前写的解析记录文件
type master; timinglee.org 的主 DNS 本机是 timinglee.org 权威主服务器
file "timinglee.org.zone"; 对应区域解析文件 完整路径 /var/named/timinglee.org.zone,里面存放 A/NS/SOA 记录
allow-update { none; }; 关闭动态更新 手动维护域名记录,安全推荐配置

b. timinglee.org 区域文件配置

bash 复制代码
[root@node1 ~]# cd /var/named/
[root@node1 named]# cp -p named.localhost timinglee.org.zone
$TTL 1D
@       IN SOA  admin.timinglee.org.  root.timinglee.org. (
                                        0       ; serial
                                        1D      ; refresh
                                        1H      ; retry
                                        1W      ; expire
                                        3H )    ; minimum
                NS      dns.timinglee.org.
dns             A       172.25.254.10
timinglee       A       172.25.254.254

[root@node1 named]# systemctl restart named
配置行 字段释义 详细讲解
$TTL 1D 全局生存时间 TTL = Time To Live,缓存存活时间1D = 1 天客户端拿到解析结果后,本地缓存 1 天,期间不用重复请求 DNS 服务器
@ 区域简写符号 @ 代表当前域名 timinglee.org.,等价完整写法 timinglee.org.
IN 互联网类 DNS 记录标准类别,固定写 IN,代表互联网通用记录
SOA 起始授权记录(区域头部核心) Start of Authority,每个域名区域必须唯一一条,标记这台服务器是该域名的权威 DNS,包含同步、超时、管理员邮箱信息
admin.timinglee.org. 管理员邮箱(完整 FQDN) DNS 语法里把第一个.替换为@,真实邮箱:admin@timinglee.org末尾必须带.,代表完整绝对域名
root.timinglee.org. 主服务器 FQDN 该域名的权威 DNS 服务器完整域名 dns.timinglee.org.,末尾.不可省略
( 0 ; serial ) 区域序列号 区域文件版本号,手动修改,辅助 DNS 同步时对比版本规则实现主动同步:修改区域记录后必须数字增大 ,推荐格式 2026071901(年月日 + 序号)当前写0存在缺陷:修改文件后从机不会同步
1D ; refresh 刷新间隔 1 天 辅助 DNS 每隔 1 天主动联系主 DNS,检查 serial 序列号是否更新,有更新就同步区域文件
1H ; retry 重试间隔 1 小时 如果辅助 DNS 联系主 DNS 失败,每隔 1 小时重新尝试连接
1W ; expire 过期时长 1 周 辅助 DNS 持续 1 周都无法连通主 DNS,则判定区域数据失效,不再对外提供解析
3H ; minimum 否定缓存 TTL 3 小时 查询不存在的域名 (比如xxx.timinglee.org),客户端缓存 3 小时,3 小时内不会重复查不存在的域名
NS dns.timinglee.org. NS 域名服务器记录 Name Server,声明 timinglee.org 域名由 dns.timinglee.org. 这台服务器解析域名末尾.必须加,完整绝对 FQDN
dns A 172.25.254.10 A 地址记录 A 记录 = 域名→IPv4 映射dns 是相对域名,自动补全为 dns.timinglee.org.解析结果:dns.timinglee.org = 172.25.254.10刚好匹配上面 NS 记录的服务器地址
timinglee A 172.25.254.254 A 地址记录 timinglee 相对域名自动补全为 timinglee.timinglee.org.解析结果:timinglee.timinglee.org = 172.25.254.254

测试:

bash 复制代码
[root@node2 ~]# dig timinglee.timinglee.org @172.25.254.10

; <<>> DiG 9.16.23-RH <<>> timinglee.timinglee.org @172.25.254.10
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 30320
;; flags: qr aa rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 1

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 1232
; COOKIE: c31774e9ef556674010000006a5c3d6d4f7539ec32594ef8 (good)
;; QUESTION SECTION:
;timinglee.timinglee.org.       IN      A

;; ANSWER SECTION:
timinglee.timinglee.org. 86400  IN      A       172.25.254.254

;; Query time: 0 msec
;; SERVER: 172.25.254.10#53(172.25.254.10)
;; WHEN: Sun Jul 19 10:58:53 CST 2026
;; MSG SIZE  rcvd: 96

2.邮件解析记录

bash 复制代码
[root@node1 named]# vim timinglee.org.zone
$TTL 1D
@       IN SOA  admin.timinglee.org.  root.timinglee.org. (
                                        0       ; serial
                                        1D      ; refresh
                                        1H      ; retry
                                        1W      ; expire
                                        3H )    ; minimum
                        NS      dns.timinglee.org.
dns                     A       172.25.254.10
timinglee               A       172.25.254.254	
timinglee.org.          MX 5    172.25.254.10.

[root@node1 named]# systemctl restart named

测试:

bash 复制代码
[root@node2 ~]# dig -t mx timinglee.org  @172.25.254.10   #-t = -Type

; <<>> DiG 9.16.23-RH <<>> -t mx timinglee.org @172.25.254.10
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 59523
;; flags: qr aa rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 1

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 1232
; COOKIE: 54865c32be027587010000006a5c3ec54da81b1655aa92d2 (good)
;; QUESTION SECTION:
;timinglee.org.                 IN      MX

;; ANSWER SECTION:
timinglee.org.          86400   IN      MX      5 172.25.254.10.

;; Query time: 1 msec
;; SERVER: 172.25.254.10#53(172.25.254.10)
;; WHEN: Sun Jul 19 11:04:37 CST 2026
;; MSG SIZE  rcvd: 99

3.反向解析记录

bash 复制代码
[root@node1 named]# vim /etc/named.rfc1912.zones
zone "1.0.0.127.in-addr.arpa" IN {
        type master;
        file "named.loopback";
        allow-update { none; };
};

zone "254.25.172.in-addr.arpa" IN {
        type master;
        file "172.25.254.ptr";
        allow-update { none; };
};

[root@node1 named]# cp -p named.loopback 172.25.254.ptr
$TTL 1D
@       IN SOA  admin.timinglee.org. root.timinglee.org. (
                                        0       ; serial
                                        1D      ; refresh
                                        1H      ; retry
                                        1W      ; expire
                                        3H )    ; minimum
        NS      dns.timinglee.org.
dns     A       172.25.254.10
111     PTR     haha.timinglee.org.

[root@node1 named]# systemctl restart named

测试:

bash 复制代码
[root@node2 ~]# dig -x 172.25.254.111  @172.25.254.10

; <<>> DiG 9.16.23-RH <<>> -x 172.25.254.111 @172.25.254.10
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 32575
;; flags: qr aa rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 1

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 1232
; COOKIE: f5ea81523d3c5e20010000006a5c4040b7be6bf6a0ae12af (good)
;; QUESTION SECTION:
;111.254.25.172.in-addr.arpa.   IN      PTR

;; ANSWER SECTION:
111.254.25.172.in-addr.arpa. 86400 IN   PTR     haha.timinglee.org.

;; Query time: 1 msec
;; SERVER: 172.25.254.10#53(172.25.254.10)
;; WHEN: Sun Jul 19 11:10:56 CST 2026
;; MSG SIZE  rcvd: 116

三.dns的多向解析

多向解析根据用户位置或网络条件返回不同的IP地址

1.实验环境

DNS:

双网卡 eth0--nat模式 (172.25.254.10) eth1-仅主机模式(192.168.0.10)

node1:

单网卡:eth0-nat模式(172.25.254.20)

node2:

单网卡:eth0-仅主机(192.168.0.30)

2.配置双向解析

bash 复制代码
# 改/etc/named.conf主配置文件 通过view区分不同网段
[root@node1 ~]# vim /etc/named.conf
/*
zone "." IN {
        type hint;
        file "named.ca";
};

include "/etc/named.rfc1912.zones";
*/ # 注释掉默认配置
-------------------------------------
view  192 {
  match-clients { 192.168.0.0/24; };
  zone "." IN {
        type hint;
        file "named.ca";
        };
include "/etc/named.rfc1912.192";
};
view  any {
  match-clients { any; };
  zone "." IN {
        type hint;
        file "named.ca";
        };
include "/etc/named.rfc1912.zones";
};
include "/etc/named.root.key"; #保留配置
-------------------------------------

# 修改/etc/named.rfc1912.192配置文件
[root@node1 ~]# cp -p /etc/named.rfc1912.zones /etc/named.rfc1912.192
[root@node1 ~]# vim /etc/named.rfc1912.192
zone "timinglee.org" IN {
        type master;
        file "timinglee.org-192.zone";
        allow-update { none; };
};

# 修改timinglee.org-192.zone配置文件
[root@node1 ~]# cd /var/named/
[root@node1 named]# cp -p timinglee.org.zone  timinglee.org-192.zone
[root@node1 named]# vim timinglee.org-192.zone
$TTL 1D
@       IN SOA  admin.timinglee.org.  root.timinglee.org. (
                                        0       ; serial
                                        1D      ; refresh
                                        1H      ; retry
                                        1W      ; expire
                                        3H )    ; minimum
                        NS      dns.timinglee.org.
dns                     A       192.168.0.10
timinglee               A       192.168.0.254
timinglee.org.          MX 5    192.168.0.10.

[root@node1 named]# systemctl restart named

测试:

在172.25.254.20主机中

bash 复制代码
root@node2 ~]# dig    timinglee.timinglee.org   @172.25.254.10

; <<>> DiG 9.16.23-RH <<>> timinglee.timinglee.org @172.25.254.10
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 23390
;; flags: qr aa rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 1

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 1232
; COOKIE: 6cdea0ba7e48edf7010000006a5c718408dce18bf2fbc812 (good)
;; QUESTION SECTION:
;timinglee.timinglee.org.       IN      A

;; ANSWER SECTION:
timinglee.timinglee.org. 86400  IN      A       172.25.254.254

;; Query time: 4 msec
;; SERVER: 172.25.254.10#53(172.25.254.10)
;; WHEN: Sun Jul 19 14:41:08 CST 2026
;; MSG SIZE  rcvd: 96

在192.168.0.30 主机中

bash 复制代码
[root@node3 ~]# dig timinglee.timinglee.org @192.168.0.10

; <<>> DiG 9.16.23-RH <<>> timinglee.timinglee.org @192.168.0.10
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 61435
;; flags: qr aa rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 1

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 1232
; COOKIE: 84d805319be572fb010000006a5c71adc0e850a9ed642b0d (good)
;; QUESTION SECTION:
;timinglee.timinglee.org.       IN      A

;; ANSWER SECTION:
timinglee.timinglee.org. 86400  IN      A       192.168.0.254

;; Query time: 0 msec
;; SERVER: 192.168.0.10#53(192.168.0.10)
;; WHEN: Sun Jul 19 14:41:49 CST 2026
;; MSG SIZE  rcvd: 96

四.辅助dns

辅助DNS是主DNS服务器的备份,提供冗余和负载分担

1.实验环境

node1-dns-master

  • 172.25.254.10
  • 有整套A记录信息

node2-dns-slave

  • 172.25.254.20
  • 本身没有任何数据,数据来源从172.25.254.10来

2.部署辅助dns

node2中

bash 复制代码
[root@node2 ~]# dnf install bind -y
[root@node2 ~]# vim /etc/named.conf
options {
//      listen-on port 53 { 127.0.0.1; };
        listen-on-v6 port 53 { ::1; };
        directory       "/var/named";
        dump-file       "/var/named/data/cache_dump.db";
        statistics-file "/var/named/data/named_stats.txt";
        memstatistics-file "/var/named/data/named_mem_stats.txt";
        secroots-file   "/var/named/data/named.secroots";
        recursing-file  "/var/named/data/named.recursing";
//      allow-query     { localhost; };
#...省略内容
dnssec-validation no;
#...省略内容
};
[root@node2 ~]# vim /etc/named.rfc1912.zones
zone "localhost" IN {
        type master;
        file "named.localhost";
        allow-update { none; };
};

zone "timinglee.org" IN {
        type slave;
        masters { 172.25.254.10; };
        file "slaves/timinglee.org.zone";
};

#测试
[root@node2 ~]# dig timinglee.timinglee.org @172.25.254.20

; <<>> DiG 9.16.23-RH <<>> timinglee.timinglee.org @172.25.254.20
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 61256
;; flags: qr aa rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 1

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 1232
; COOKIE: 46d3796b8194b9e3010000006a5c808ec7b2c32caf76c174 (good)
;; QUESTION SECTION:
;timinglee.timinglee.org.       IN      A

;; ANSWER SECTION:
timinglee.timinglee.org. 86400  IN      A       172.25.254.254

;; Query time: 0 msec
;; SERVER: 172.25.254.20#53(172.25.254.20)
;; WHEN: Sun Jul 19 15:45:18 CST 2026
;; MSG SIZE  rcvd: 96

3.辅助dns的数据同步问题

默认主dns的A记录数据更改后辅助dns的数据要等1天才能同步

解决此问题思想:当主dns更新A记录后要主动通知slave

bash 复制代码
[root@node1 named]# vim /etc/named.rfc1912.zones
zone "timinglee.org" IN {
        type master;
        file "timinglee.org.zone";
        allow-update { none; };
        also-notify { 172.25.254.20; };
};

[root@node1 named]# vim /var/named/timinglee.org.zone
$TTL 1D
@       IN SOA  admin.timinglee.org.  root.timinglee.org. (
                                        2026071903      ; serial	#文件更改标识
                                        1D      ; refresh
                                        1H      ; retry
                                        1W      ; expire
                                        3H )    ; minimum
                        NS      dns.timinglee.org.
dns                     A       172.25.254.10
timinglee               A       172.25.254.222
timinglee.org.          MX 5    172.25.254.10.


[root@node1 named]# systemctl restart named
配置行 字段释义 详细讲解
( 0 ; serial ) 区域序列号 区域文件版本号,手动修改,辅助 DNS 同步时对比版本规则实现主动同步:修改区域记录后必须数字增大 ,推荐格式 2026071901(年月日 + 序号)当前写0存在缺陷:修改文件后从机不会同步
1D ; refresh 刷新间隔 1 天 辅助 DNS 每隔 1 天主动联系主 DNS,检查 serial 序列号是否更新,有更新就同步区域文件
1H ; retry 重试间隔 1 小时 如果辅助 DNS 联系主 DNS 失败,每隔 1 小时重新尝试连接
1W ; expire 过期时长 1 周 辅助 DNS 持续 1 周都无法连通主 DNS,则判定区域数据失效,不再对外提供解析
3H ; minimum 否定缓存 TTL 3 小时 查询不存在的域名 (比如xxx.timinglee.org),客户端缓存 3 小时,3 小时内不会重复查不存在的域名

#测试:

node2中的dns没有做任何操作,但是数据会直接更新

bash 复制代码
[root@node2 ~]# dig timinglee.timinglee.org @172.25.254.20

; <<>> DiG 9.16.23-RH <<>> timinglee.timinglee.org @172.25.254.20
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 23995
;; flags: qr aa rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 1

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 1232
; COOKIE: 833ea594827ee46a010000006a5c838627b570741be071bc (good)
;; QUESTION SECTION:
;timinglee.timinglee.org.       IN      A

;; ANSWER SECTION:
timinglee.timinglee.org. 86400  IN      A       172.25.254.222

;; Query time: 1 msec
;; SERVER: 172.25.254.20#53(172.25.254.20)
;; WHEN: Sun Jul 19 15:57:58 CST 2026
;; MSG SIZE  rcvd: 96
相关推荐
EasyGBS1 小时前
ONVIF设备接入国标GB28181视频平台EasyGBS:不用国标也能一键拉流!
服务器·php·音视频
suaizai_1 小时前
TypeScript 7 正式发布!Vue 暂被 “拒之门外“ !!!
linux·运维·ubuntu
小小代码狗2 小时前
SQLi-Labs 基础注入实战教程(Less-1 ~ Less-5and Less-9)
服务器·python·php
慕伏白2 小时前
【慕伏白】Linux 系统如何根据端口号关闭进程
linux·运维·服务器
letisgo52 小时前
VMware Workstation + Ubuntu 26.04 LTS 小白运维部署手册
linux·运维·ubuntu
蓝创工坊Blue Foundry2 小时前
图片文字提取到 Excel:批量任务如何先定义要交付的字段
运维·服务器·开发语言·数据库·自动化·ocr·excel
IT探索3 小时前
Linux 查找文件指令总结
linux·算法
晚风吹长发3 小时前
Docker使用——Docker容器及相关命令
linux·运维·服务器·docker·容器·架构
ShiXZ2133 小时前
Docker Compose 安装与配置指南
运维·docker·容器