DNS(域名系统)
DNS(Domain Name System)是将人类可读的域名(如example.com)转换为机器可读的IP地址(如93.184.216.34)的分布式数据库系统。其核心功能包括:
- 域名解析:将域名映射为IP地址。
- 分层结构:采用树状结构,包括根域、顶级域(TLD)、二级域等。
- 记录类型:支持A(IPv4)、AAAA(IPv6)、MX(邮件交换)、CNAME(别名)等记录。
一.高速缓存DNS
DNS高速缓存是临时存储DNS查询结果的机制,用于加速后续相同域名的解析
1.实验环境
| 主机名 | ip | 用途 |
|---|---|---|
| node1 | 172.25.254.10 | 高速缓存dns |
| node2 | 172.25.254.20 | 客户端1 |
| node3 | 172.25.254.30 | 客户端2 |
2.部署高速缓存dns
a、安装并启用dns
bash
[root@node1 ~]# dnf install bind.x86_64 -y
[root@node1 ~]# systemctl enable --now named
Created symlink /etc/systemd/system/multi-user.target.wants/named.service → /usr/lib/systemd/system/named.service.
#配置dns的基本信息
options {
listen-on port 53 { any; }; #开放端口在所有网络接口上
listen-on-v6 port 53 { ::1; };
directory "/var/named";
dump-file "/var/named/data/cache_dump.db";
statistics-file "/var/named/data/named_stats.txt";
memstatistics-file "/var/named/data/named_mem_stats.txt";
secroots-file "/var/named/data/named.secroots";
recursing-file "/var/named/data/named.recursing";
allow-query { any; }; #允许是所有人来使用dns
recursion yes; #递归开关
#如果你搭建【权威DNS服务器(托管自有域名)】:禁止开启递归
#如果你搭建【缓存/递归DNS(内网上网解析用)】:必须开启recursion yes
forwarders { 114.114.114.114; }; #指定缓存谁的A记录
dnssec-validation no; #不做dns的安全校验
managed-keys-directory "/var/named/dynamic";
geoip-directory "/usr/share/GeoIP";
pid-file "/run/named/named.pid";
session-keyfile "/run/named/session.key";
/* https://fedoraproject.org/wiki/Changes/CryptoPolicy */
include "/etc/crypto-policies/back-ends/bind.config";
};
b、测试:
bash
[root@node2 ~]# dig www.taobao.com @172.25.254.10
; <<>> DiG 9.16.23-RH <<>> www.taobao.com @172.25.254.10
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 2587
;; flags: qr rd ra; QUERY: 1, ANSWER: 3, AUTHORITY: 0, ADDITIONAL: 1
;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 1232
; COOKIE: 85998c69795b69c3010000006a5c2f47def3d47461456d61 (good)
;; QUESTION SECTION:
;www.taobao.com. IN A
;; ANSWER SECTION:
www.taobao.com. 600 IN CNAME www.taobao.com.danuoyi.tbcache.com.
www.taobao.com.danuoyi.tbcache.com. 32 IN A 117.157.129.53
www.taobao.com.danuoyi.tbcache.com. 32 IN A 117.157.129.52
;; Query time: 4178 msec #解析消耗时间
;; SERVER: 172.25.254.10#53(172.25.254.10)
;; WHEN: Sun Jul 19 09:58:31 CST 2026
;; MSG SIZE rcvd: 151
[root@node3 ~]# dig www.taobao.com @172.25.254.10
; <<>> DiG 9.16.23-RH <<>> www.taobao.com @172.25.254.10
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 40520
;; flags: qr rd ra; QUERY: 1, ANSWER: 3, AUTHORITY: 0, ADDITIONAL: 1
;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 1232
; COOKIE: 04aeb7a29393043e010000006a5c2f516d67e63f1bfec76e (good)
;; QUESTION SECTION:
;www.taobao.com. IN A
;; ANSWER SECTION:
www.taobao.com. 590 IN CNAME www.taobao.com.danuoyi.tbcache.com.
www.taobao.com.danuoyi.tbcache.com. 22 IN A 117.157.129.52
www.taobao.com.danuoyi.tbcache.com. 22 IN A 117.157.129.53
;; Query time: 0 msec #缓存生效
;; SERVER: 172.25.254.10#53(172.25.254.10)
;; WHEN: Sun Jul 19 09:58:41 CST 2026
;; MSG SIZE rcvd: 151
二.dns服务器的解析部署
1.正向解析
a. named.rfc1912.zones 区域配置
bash
[root@node1 ~]# vim /etc/named.rfc1912.zones
zone "localhost" IN {
type master;
file "named.localhost";
allow-update { none; };
};
zone "timinglee.org" IN {
type master;
file "timinglee.org.zone";
allow-update { none; };
};
| 配置片段 | 字段含义 | 详细说明 |
|---|---|---|
zone "localhost" IN { |
定义区域:localhost | zone "域名" 声明要托管的域名区域IN 固定互联网记录类 |
type master; |
服务器类型:主 DNS | master = 主权威服务器,本机持有该域名原始 zone 文件,所有解析记录由本机管理 |
file "named.localhost"; |
区域库文件路径 | 文件存放根目录由 named.conf 的 directory "/var/named" 指定完整路径:/var/named/named.localhost |
allow-update { none; }; |
禁止动态 DNS 更新 | none = 不允许客户端 / 其他服务器自动修改域名记录,只能手动改 zone 文件;内网有 DHCP 动态解析才填网段 |
}; |
区域配置结束符 | 每个 zone 大括号成对闭合 |
zone "timinglee.org" IN { |
自定义业务域名区域 | 声明本机托管 timinglee.org 域名,对应你之前写的解析记录文件 |
type master; |
timinglee.org 的主 DNS | 本机是 timinglee.org 权威主服务器 |
file "timinglee.org.zone"; |
对应区域解析文件 | 完整路径 /var/named/timinglee.org.zone,里面存放 A/NS/SOA 记录 |
allow-update { none; }; |
关闭动态更新 | 手动维护域名记录,安全推荐配置 |
b. timinglee.org 区域文件配置
bash
[root@node1 ~]# cd /var/named/
[root@node1 named]# cp -p named.localhost timinglee.org.zone
$TTL 1D
@ IN SOA admin.timinglee.org. root.timinglee.org. (
0 ; serial
1D ; refresh
1H ; retry
1W ; expire
3H ) ; minimum
NS dns.timinglee.org.
dns A 172.25.254.10
timinglee A 172.25.254.254
[root@node1 named]# systemctl restart named
| 配置行 | 字段释义 | 详细讲解 |
|---|---|---|
$TTL 1D |
全局生存时间 | TTL = Time To Live,缓存存活时间1D = 1 天客户端拿到解析结果后,本地缓存 1 天,期间不用重复请求 DNS 服务器 |
@ |
区域简写符号 | @ 代表当前域名 timinglee.org.,等价完整写法 timinglee.org. |
IN |
互联网类 | DNS 记录标准类别,固定写 IN,代表互联网通用记录 |
SOA |
起始授权记录(区域头部核心) | Start of Authority,每个域名区域必须唯一一条,标记这台服务器是该域名的权威 DNS,包含同步、超时、管理员邮箱信息 |
admin.timinglee.org. |
管理员邮箱(完整 FQDN) | DNS 语法里把第一个.替换为@,真实邮箱:admin@timinglee.org末尾必须带.,代表完整绝对域名 |
root.timinglee.org. |
主服务器 FQDN | 该域名的权威 DNS 服务器完整域名 dns.timinglee.org.,末尾.不可省略 |
( 0 ; serial ) |
区域序列号 | 区域文件版本号,手动修改,辅助 DNS 同步时对比版本规则实现主动同步:修改区域记录后必须数字增大 ,推荐格式 2026071901(年月日 + 序号)当前写0存在缺陷:修改文件后从机不会同步 |
1D ; refresh |
刷新间隔 1 天 | 辅助 DNS 每隔 1 天主动联系主 DNS,检查 serial 序列号是否更新,有更新就同步区域文件 |
1H ; retry |
重试间隔 1 小时 | 如果辅助 DNS 联系主 DNS 失败,每隔 1 小时重新尝试连接 |
1W ; expire |
过期时长 1 周 | 辅助 DNS 持续 1 周都无法连通主 DNS,则判定区域数据失效,不再对外提供解析 |
3H ; minimum |
否定缓存 TTL 3 小时 | 查询不存在的域名 (比如xxx.timinglee.org),客户端缓存 3 小时,3 小时内不会重复查不存在的域名 |
NS dns.timinglee.org. |
NS 域名服务器记录 | Name Server,声明 timinglee.org 域名由 dns.timinglee.org. 这台服务器解析域名末尾.必须加,完整绝对 FQDN |
dns A 172.25.254.10 |
A 地址记录 | A 记录 = 域名→IPv4 映射dns 是相对域名,自动补全为 dns.timinglee.org.解析结果:dns.timinglee.org = 172.25.254.10刚好匹配上面 NS 记录的服务器地址 |
timinglee A 172.25.254.254 |
A 地址记录 | timinglee 相对域名自动补全为 timinglee.timinglee.org.解析结果:timinglee.timinglee.org = 172.25.254.254 |
测试:
bash
[root@node2 ~]# dig timinglee.timinglee.org @172.25.254.10
; <<>> DiG 9.16.23-RH <<>> timinglee.timinglee.org @172.25.254.10
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 30320
;; flags: qr aa rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 1
;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 1232
; COOKIE: c31774e9ef556674010000006a5c3d6d4f7539ec32594ef8 (good)
;; QUESTION SECTION:
;timinglee.timinglee.org. IN A
;; ANSWER SECTION:
timinglee.timinglee.org. 86400 IN A 172.25.254.254
;; Query time: 0 msec
;; SERVER: 172.25.254.10#53(172.25.254.10)
;; WHEN: Sun Jul 19 10:58:53 CST 2026
;; MSG SIZE rcvd: 96
2.邮件解析记录
bash
[root@node1 named]# vim timinglee.org.zone
$TTL 1D
@ IN SOA admin.timinglee.org. root.timinglee.org. (
0 ; serial
1D ; refresh
1H ; retry
1W ; expire
3H ) ; minimum
NS dns.timinglee.org.
dns A 172.25.254.10
timinglee A 172.25.254.254
timinglee.org. MX 5 172.25.254.10.
[root@node1 named]# systemctl restart named
测试:
bash
[root@node2 ~]# dig -t mx timinglee.org @172.25.254.10 #-t = -Type
; <<>> DiG 9.16.23-RH <<>> -t mx timinglee.org @172.25.254.10
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 59523
;; flags: qr aa rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 1
;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 1232
; COOKIE: 54865c32be027587010000006a5c3ec54da81b1655aa92d2 (good)
;; QUESTION SECTION:
;timinglee.org. IN MX
;; ANSWER SECTION:
timinglee.org. 86400 IN MX 5 172.25.254.10.
;; Query time: 1 msec
;; SERVER: 172.25.254.10#53(172.25.254.10)
;; WHEN: Sun Jul 19 11:04:37 CST 2026
;; MSG SIZE rcvd: 99
3.反向解析记录
bash
[root@node1 named]# vim /etc/named.rfc1912.zones
zone "1.0.0.127.in-addr.arpa" IN {
type master;
file "named.loopback";
allow-update { none; };
};
zone "254.25.172.in-addr.arpa" IN {
type master;
file "172.25.254.ptr";
allow-update { none; };
};
[root@node1 named]# cp -p named.loopback 172.25.254.ptr
$TTL 1D
@ IN SOA admin.timinglee.org. root.timinglee.org. (
0 ; serial
1D ; refresh
1H ; retry
1W ; expire
3H ) ; minimum
NS dns.timinglee.org.
dns A 172.25.254.10
111 PTR haha.timinglee.org.
[root@node1 named]# systemctl restart named
测试:
bash
[root@node2 ~]# dig -x 172.25.254.111 @172.25.254.10
; <<>> DiG 9.16.23-RH <<>> -x 172.25.254.111 @172.25.254.10
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 32575
;; flags: qr aa rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 1
;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 1232
; COOKIE: f5ea81523d3c5e20010000006a5c4040b7be6bf6a0ae12af (good)
;; QUESTION SECTION:
;111.254.25.172.in-addr.arpa. IN PTR
;; ANSWER SECTION:
111.254.25.172.in-addr.arpa. 86400 IN PTR haha.timinglee.org.
;; Query time: 1 msec
;; SERVER: 172.25.254.10#53(172.25.254.10)
;; WHEN: Sun Jul 19 11:10:56 CST 2026
;; MSG SIZE rcvd: 116
三.dns的多向解析
多向解析根据用户位置或网络条件返回不同的IP地址
1.实验环境
DNS:
双网卡 eth0--nat模式 (172.25.254.10) eth1-仅主机模式(192.168.0.10)
node1:
单网卡:eth0-nat模式(172.25.254.20)
node2:
单网卡:eth0-仅主机(192.168.0.30)
2.配置双向解析
bash
# 改/etc/named.conf主配置文件 通过view区分不同网段
[root@node1 ~]# vim /etc/named.conf
/*
zone "." IN {
type hint;
file "named.ca";
};
include "/etc/named.rfc1912.zones";
*/ # 注释掉默认配置
-------------------------------------
view 192 {
match-clients { 192.168.0.0/24; };
zone "." IN {
type hint;
file "named.ca";
};
include "/etc/named.rfc1912.192";
};
view any {
match-clients { any; };
zone "." IN {
type hint;
file "named.ca";
};
include "/etc/named.rfc1912.zones";
};
include "/etc/named.root.key"; #保留配置
-------------------------------------
# 修改/etc/named.rfc1912.192配置文件
[root@node1 ~]# cp -p /etc/named.rfc1912.zones /etc/named.rfc1912.192
[root@node1 ~]# vim /etc/named.rfc1912.192
zone "timinglee.org" IN {
type master;
file "timinglee.org-192.zone";
allow-update { none; };
};
# 修改timinglee.org-192.zone配置文件
[root@node1 ~]# cd /var/named/
[root@node1 named]# cp -p timinglee.org.zone timinglee.org-192.zone
[root@node1 named]# vim timinglee.org-192.zone
$TTL 1D
@ IN SOA admin.timinglee.org. root.timinglee.org. (
0 ; serial
1D ; refresh
1H ; retry
1W ; expire
3H ) ; minimum
NS dns.timinglee.org.
dns A 192.168.0.10
timinglee A 192.168.0.254
timinglee.org. MX 5 192.168.0.10.
[root@node1 named]# systemctl restart named
测试:
在172.25.254.20主机中
bash
root@node2 ~]# dig timinglee.timinglee.org @172.25.254.10
; <<>> DiG 9.16.23-RH <<>> timinglee.timinglee.org @172.25.254.10
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 23390
;; flags: qr aa rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 1
;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 1232
; COOKIE: 6cdea0ba7e48edf7010000006a5c718408dce18bf2fbc812 (good)
;; QUESTION SECTION:
;timinglee.timinglee.org. IN A
;; ANSWER SECTION:
timinglee.timinglee.org. 86400 IN A 172.25.254.254
;; Query time: 4 msec
;; SERVER: 172.25.254.10#53(172.25.254.10)
;; WHEN: Sun Jul 19 14:41:08 CST 2026
;; MSG SIZE rcvd: 96
在192.168.0.30 主机中
bash
[root@node3 ~]# dig timinglee.timinglee.org @192.168.0.10
; <<>> DiG 9.16.23-RH <<>> timinglee.timinglee.org @192.168.0.10
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 61435
;; flags: qr aa rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 1
;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 1232
; COOKIE: 84d805319be572fb010000006a5c71adc0e850a9ed642b0d (good)
;; QUESTION SECTION:
;timinglee.timinglee.org. IN A
;; ANSWER SECTION:
timinglee.timinglee.org. 86400 IN A 192.168.0.254
;; Query time: 0 msec
;; SERVER: 192.168.0.10#53(192.168.0.10)
;; WHEN: Sun Jul 19 14:41:49 CST 2026
;; MSG SIZE rcvd: 96
四.辅助dns
辅助DNS是主DNS服务器的备份,提供冗余和负载分担
1.实验环境
node1-dns-master
- 172.25.254.10
- 有整套A记录信息
node2-dns-slave
- 172.25.254.20
- 本身没有任何数据,数据来源从172.25.254.10来
2.部署辅助dns
node2中
bash
[root@node2 ~]# dnf install bind -y
[root@node2 ~]# vim /etc/named.conf
options {
// listen-on port 53 { 127.0.0.1; };
listen-on-v6 port 53 { ::1; };
directory "/var/named";
dump-file "/var/named/data/cache_dump.db";
statistics-file "/var/named/data/named_stats.txt";
memstatistics-file "/var/named/data/named_mem_stats.txt";
secroots-file "/var/named/data/named.secroots";
recursing-file "/var/named/data/named.recursing";
// allow-query { localhost; };
#...省略内容
dnssec-validation no;
#...省略内容
};
[root@node2 ~]# vim /etc/named.rfc1912.zones
zone "localhost" IN {
type master;
file "named.localhost";
allow-update { none; };
};
zone "timinglee.org" IN {
type slave;
masters { 172.25.254.10; };
file "slaves/timinglee.org.zone";
};
#测试
[root@node2 ~]# dig timinglee.timinglee.org @172.25.254.20
; <<>> DiG 9.16.23-RH <<>> timinglee.timinglee.org @172.25.254.20
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 61256
;; flags: qr aa rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 1
;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 1232
; COOKIE: 46d3796b8194b9e3010000006a5c808ec7b2c32caf76c174 (good)
;; QUESTION SECTION:
;timinglee.timinglee.org. IN A
;; ANSWER SECTION:
timinglee.timinglee.org. 86400 IN A 172.25.254.254
;; Query time: 0 msec
;; SERVER: 172.25.254.20#53(172.25.254.20)
;; WHEN: Sun Jul 19 15:45:18 CST 2026
;; MSG SIZE rcvd: 96
3.辅助dns的数据同步问题
默认主dns的A记录数据更改后辅助dns的数据要等1天才能同步
解决此问题思想:当主dns更新A记录后要主动通知slave
bash
[root@node1 named]# vim /etc/named.rfc1912.zones
zone "timinglee.org" IN {
type master;
file "timinglee.org.zone";
allow-update { none; };
also-notify { 172.25.254.20; };
};
[root@node1 named]# vim /var/named/timinglee.org.zone
$TTL 1D
@ IN SOA admin.timinglee.org. root.timinglee.org. (
2026071903 ; serial #文件更改标识
1D ; refresh
1H ; retry
1W ; expire
3H ) ; minimum
NS dns.timinglee.org.
dns A 172.25.254.10
timinglee A 172.25.254.222
timinglee.org. MX 5 172.25.254.10.
[root@node1 named]# systemctl restart named
| 配置行 | 字段释义 | 详细讲解 |
|---|---|---|
( 0 ; serial ) |
区域序列号 | 区域文件版本号,手动修改,辅助 DNS 同步时对比版本规则实现主动同步:修改区域记录后必须数字增大 ,推荐格式 2026071901(年月日 + 序号)当前写0存在缺陷:修改文件后从机不会同步 |
1D ; refresh |
刷新间隔 1 天 | 辅助 DNS 每隔 1 天主动联系主 DNS,检查 serial 序列号是否更新,有更新就同步区域文件 |
1H ; retry |
重试间隔 1 小时 | 如果辅助 DNS 联系主 DNS 失败,每隔 1 小时重新尝试连接 |
1W ; expire |
过期时长 1 周 | 辅助 DNS 持续 1 周都无法连通主 DNS,则判定区域数据失效,不再对外提供解析 |
3H ; minimum |
否定缓存 TTL 3 小时 | 查询不存在的域名 (比如xxx.timinglee.org),客户端缓存 3 小时,3 小时内不会重复查不存在的域名 |
#测试:
node2中的dns没有做任何操作,但是数据会直接更新
bash
[root@node2 ~]# dig timinglee.timinglee.org @172.25.254.20
; <<>> DiG 9.16.23-RH <<>> timinglee.timinglee.org @172.25.254.20
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 23995
;; flags: qr aa rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 1
;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 1232
; COOKIE: 833ea594827ee46a010000006a5c838627b570741be071bc (good)
;; QUESTION SECTION:
;timinglee.timinglee.org. IN A
;; ANSWER SECTION:
timinglee.timinglee.org. 86400 IN A 172.25.254.222
;; Query time: 1 msec
;; SERVER: 172.25.254.20#53(172.25.254.20)
;; WHEN: Sun Jul 19 15:57:58 CST 2026
;; MSG SIZE rcvd: 96