比如a.friendskaka.com 是我的外发子域名，那么可以按照下面两个命令来追踪IP：
bonelee@bonelee-VirtualBox:~/桌面$ dig auth.a.friendskaka.com @8.8.8.8 +trace
; <<>> DiG 9.10.3-P4-Ubuntu <<>> auth.a.friendskaka.com @8.8.8.8 +trace
;; global options: +cmd
. 244288 IN NS a.root-servers.net.
. 244288 IN NS b.root-servers.net.
. 244288 IN NS c.root-servers.net.
. 244288 IN NS d.root-servers.net.
. 244288 IN NS e.root-servers.net.
. 244288 IN NS f.root-servers.net.
. 244288 IN NS g.root-servers.net.
. 244288 IN NS h.root-servers.net.
. 244288 IN NS i.root-servers.net.
. 244288 IN NS j.root-servers.net.
. 244288 IN NS k.root-servers.net.
. 244288 IN NS l.root-servers.net.
. 244288 IN NS m.root-servers.net.
. 244288 IN RRSIG NS 8 0 518400 20180204200000 20180122190000 41824 . aFjlqIAoXsDRryxUfpsojm0hwOCoFbPFQ91341fa41TzedQahHQ8M0g/ /VExOM4QUk8tkZYKgK7kkRDAZWzcnCnXP4CZkf8E6SlUkZGjOPAx8YWq i0yXpAaMWERf32SyGg7VwrfEyuGadN8bxKxt7Db+VpuMANq8GCYlvHBE SkzNung1OUeiIu3hRi6jlIRXUqpPMaFmdmXpeTM1iLzCv2YkmwPBTIBX FN7hseM0f7wWZsmUTqCWvoXBO01UX+HlTGLXkKBVj69oRBOAj+eSmYh6 lc1K8emOFqi+za7zNbBAXGY6FWpIQtX0RaPztmbwrnqpdQXOqKOq5wtu tuv+tg==
;; Received 525 bytes from 8.8.8.8#53(8.8.8.8) in 67 ms
com. 172800 IN NS a.gtld-servers.net.
com. 172800 IN NS b.gtld-servers.net.
com. 172800 IN NS c.gtld-servers.net.
com. 172800 IN NS d.gtld-servers.net.
com. 172800 IN NS e.gtld-servers.net.
com. 172800 IN NS f.gtld-servers.net.
com. 172800 IN NS g.gtld-servers.net.
com. 172800 IN NS h.gtld-servers.net.
com. 172800 IN NS i.gtld-servers.net.
com. 172800 IN NS j.gtld-servers.net.
com. 172800 IN NS k.gtld-servers.net.
com. 172800 IN NS l.gtld-servers.net.
com. 172800 IN NS m.gtld-servers.net.
com. 86400 IN DS 30909 8 2 E2D3C916F6DEEAC73294E8268FB5885044A833FC5459588F4A9184CF C41A5766
com. 86400 IN RRSIG DS 8 1 86400 20180204200000 20180122190000 41824 . e5NBTkGk86oh65XaIPWOKt4y8iotYEbml0k468uohpJusmJITYXR557Y Fl4uGIB56vHjIwHiZGWK9fO7cUU7VkMo2Y/1uqzFi+7jJTZ97cb5VnMt Of7CwHq7gFBmyNSlT8xB1UKK3qAzqmsRhMmfZN3xzFkvE8Lvc60hzcA5 B/RmXOfvjugmfD5s877EDcZeO5nV7dlassDQ+wuFE21PbTtgjGkuvFb3 EDsBVLaDq/7JHGLbza50PqWZrsuXrnAVa0j70+lvl1hcUCthf+8FQCLu Wf3Gj4Jnp6P/Z6rSDPGFGjh4SRsfNdTk3UJIIPLpwg0pyGbQaQ7rJxd+ 0/XbWQ==
;; Received 1182 bytes from 199.7.83.42#53(l.root-servers.net) in 263 ms
friendskaka.com. 172800 IN NS dns2.hichina.com.
friendskaka.com. 172800 IN NS dns1.hichina.com.
CK0POJMG874LJREF7EFN8430QVIT8BSM.com. 86400 IN NSEC3 1 1 0 - CK0Q1GIN43N1ARRC9OSM6QPQR81H5M9A NS SOA RRSIG DNSKEY NSEC3PARAM
CK0POJMG874LJREF7EFN8430QVIT8BSM.com. 86400 IN RRSIG NSEC3 8 2 86400 20180128054804 20180121043804 46967 com. HNXfONUp3muIbKeijgpxL+O2PQbZnKpSwl0DzDLTkh2RPvcimEZdRMC0 qBXHUTR1Dn6nx52WKBAEm6qVhk3fy5VIWHwPdcxJO2pyyFc/hx1L/uoi 9/Oq9H4j2VaMxOhfce8x5gdUznrOetVZy536IDxXIfo5IPABw7vA/8b2 BXE=
CO5FD8E5AURAOVOMCLOJRHU4BQPQO18S.com. 86400 IN NSEC3 1 1 0 - CO5GE18T10E6MHBQLNUH2P41UKL4V8R9 NS DS RRSIG
CO5FD8E5AURAOVOMCLOJRHU4BQPQO18S.com. 86400 IN RRSIG NSEC3 8 2 86400 20180126060953 20180119045953 46967 com. icUmkiHfpgcU6Wgnwlhy5p1Afo7tORel/aARJt2a4uKOB/5v9Z+PZgq8 zCvV5kHLyNhAtZ5Woe82OP5ccF8ZtcPJaq2l0NifJVolTFNmh/pDDPc4 MTMdCeLQFVK2wPO7cq1NBdXRHo7DVOsT7KyooEDQbjpbxHwkTpWCB/LD PRo=
;; Received 838 bytes from 192.43.172.30#53(i.gtld-servers.net) in 168 ms
a.friendskaka.com. 600 IN NS ns.friendskaka.com.
;; Received 99 bytes from 140.205.81.13#53(dns1.hichina.com) in 32 ms
;; connection timed out; no servers could be reached
bonelee@bonelee-VirtualBox:~/桌面$ dig ns.friendskaka.com @8.8.8.8
; <<>> DiG 9.10.3-P4-Ubuntu <<>> ns.friendskaka.com @8.8.8.8
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 60388
;; flags: qr rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 1
;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 512
;; QUESTION SECTION:
;ns.friendskaka.com. IN A
;; ANSWER SECTION:
ns.friendskaka.com. 599 IN A 45.77.39.243
;; Query time: 129 msec
;; SERVER: 8.8.8.8#53(8.8.8.8)
;; WHEN: Tue Jan 23 12:04:48 CST 2018
;; MSG SIZE rcvd: 63
但是无法直接通过 dns 隐蔽通道的子域名来追踪，例如下面的例子，可能是因为有=这个奇怪字符：
bonelee@bonelee-VirtualBox:~/桌面$ dig AAAAAFJdQA.=auth.a.friendskaka.com @8.8.8.8 +trace
; <<>> DiG 9.10.3-P4-Ubuntu <<>> AAAAAFJdQA.=auth.a.friendskaka.com @8.8.8.8 +trace
;; global options: +cmd
. 244085 IN NS a.root-servers.net.
. 244085 IN NS b.root-servers.net.
. 244085 IN NS c.root-servers.net.
. 244085 IN NS d.root-servers.net.
. 244085 IN NS e.root-servers.net.
. 244085 IN NS f.root-servers.net.
. 244085 IN NS g.root-servers.net.
. 244085 IN NS h.root-servers.net.
. 244085 IN NS i.root-servers.net.
. 244085 IN NS j.root-servers.net.
. 244085 IN NS k.root-servers.net.
. 244085 IN NS l.root-servers.net.
. 244085 IN NS m.root-servers.net.
. 244085 IN RRSIG NS 8 0 518400 20180204200000 20180122190000 41824 . aFjlqIAoXsDRryxUfpsojm0hwOCoFbPFQ91341fa41TzedQahHQ8M0g/ /VExOM4QUk8tkZYKgK7kkRDAZWzcnCnXP4CZkf8E6SlUkZGjOPAx8YWq i0yXpAaMWERf32SyGg7VwrfEyuGadN8bxKxt7Db+VpuMANq8GCYlvHBE SkzNung1OUeiIu3hRi6jlIRXUqpPMaFmdmXpeTM1iLzCv2YkmwPBTIBX FN7hseM0f7wWZsmUTqCWvoXBO01UX+HlTGLXkKBVj69oRBOAj+eSmYh6 lc1K8emOFqi+za7zNbBAXGY6FWpIQtX0RaPztmbwrnqpdQXOqKOq5wtu tuv+tg==
;; Received 525 bytes from 8.8.8.8#53(8.8.8.8) in 66 ms
com. 172800 IN NS l.gtld-servers.net.
com. 172800 IN NS i.gtld-servers.net.
com. 172800 IN NS m.gtld-servers.net.
com. 172800 IN NS c.gtld-servers.net.
com. 172800 IN NS j.gtld-servers.net.
com. 172800 IN NS k.gtld-servers.net.
com. 172800 IN NS d.gtld-servers.net.
com. 172800 IN NS g.gtld-servers.net.
com. 172800 IN NS h.gtld-servers.net.
com. 172800 IN NS b.gtld-servers.net.
com. 172800 IN NS a.gtld-servers.net.
com. 172800 IN NS e.gtld-servers.net.
com. 172800 IN NS f.gtld-servers.net.
com. 86400 IN DS 30909 8 2 E2D3C916F6DEEAC73294E8268FB5885044A833FC5459588F4A9184CF C41A5766
com. 86400 IN RRSIG DS 8 1 86400 20180204200000 20180122190000 41824 . e5NBTkGk86oh65XaIPWOKt4y8iotYEbml0k468uohpJusmJITYXR557Y Fl4uGIB56vHjIwHiZGWK9fO7cUU7VkMo2Y/1uqzFi+7jJTZ97cb5VnMt Of7CwHq7gFBmyNSlT8xB1UKK3qAzqmsRhMmfZN3xzFkvE8Lvc60hzcA5 B/RmXOfvjugmfD5s877EDcZeO5nV7dlassDQ+wuFE21PbTtgjGkuvFb3 EDsBVLaDq/7JHGLbza50PqWZrsuXrnAVa0j70+lvl1hcUCthf+8FQCLu Wf3Gj4Jnp6P/Z6rSDPGFGjh4SRsfNdTk3UJIIPLpwg0pyGbQaQ7rJxd+ 0/XbWQ==
;; Received 1194 bytes from 192.33.4.12#53(c.root-servers.net) in 310 ms
friendskaka.com. 172800 IN NS dns2.hichina.com.
friendskaka.com. 172800 IN NS dns1.hichina.com.
CK0POJMG874LJREF7EFN8430QVIT8BSM.com. 86400 IN NSEC3 1 1 0 - CK0Q1GIN43N1ARRC9OSM6QPQR81H5M9A NS SOA RRSIG DNSKEY NSEC3PARAM
CK0POJMG874LJREF7EFN8430QVIT8BSM.com. 86400 IN RRSIG NSEC3 8 2 86400 20180128054804 20180121043804 46967 com. HNXfONUp3muIbKeijgpxL+O2PQbZnKpSwl0DzDLTkh2RPvcimEZdRMC0 qBXHUTR1Dn6nx52WKBAEm6qVhk3fy5VIWHwPdcxJO2pyyFc/hx1L/uoi 9/Oq9H4j2VaMxOhfce8x5gdUznrOetVZy536IDxXIfo5IPABw7vA/8b2 BXE=
CO5FD8E5AURAOVOMCLOJRHU4BQPQO18S.com. 86400 IN NSEC3 1 1 0 - CO5GE18T10E6MHBQLNUH2P41UKL4V8R9 NS DS RRSIG
CO5FD8E5AURAOVOMCLOJRHU4BQPQO18S.com. 86400 IN RRSIG NSEC3 8 2 86400 20180126060953 20180119045953 46967 com. icUmkiHfpgcU6Wgnwlhy5p1Afo7tORel/aARJt2a4uKOB/5v9Z+PZgq8 zCvV5kHLyNhAtZ5Woe82OP5ccF8ZtcPJaq2l0NifJVolTFNmh/pDDPc4 MTMdCeLQFVK2wPO7cq1NBdXRHo7DVOsT7KyooEDQbjpbxHwkTpWCB/LD PRo=
;; Received 850 bytes from 192.41.162.30#53(l.gtld-servers.net) in 206 ms
但是有时候又可以：
bonelee@bonelee-VirtualBox:~/桌面$ dig AAAAAFJdQA.=auth.a.friendsakka.xyz @8.8.8.8 +trace
; <<>> DiG 9.10.3-P4-Ubuntu <<>> AAAAAFJdQA.=auth.a.friendsakka.xyz @8.8.8.8 +trace
;; global options: +cmd
. 190689 IN NS a.root-servers.net.
. 190689 IN NS b.root-servers.net.
. 190689 IN NS c.root-servers.net.
. 190689 IN NS d.root-servers.net.
. 190689 IN NS e.root-servers.net.
. 190689 IN NS f.root-servers.net.
. 190689 IN NS g.root-servers.net.
. 190689 IN NS h.root-servers.net.
. 190689 IN NS i.root-servers.net.
. 190689 IN NS j.root-servers.net.
. 190689 IN NS k.root-servers.net.
. 190689 IN NS l.root-servers.net.
. 190689 IN NS m.root-servers.net.
. 190689 IN RRSIG NS 8 0 518400 20180203170000 20180121160000 41824 . jH/C0pRY9kC2UFwDQexQSyk6iVNYTlX2lg0knutGC92WiH+TKpjPKi70 seRlmztrHWNJ3QsXnTArVRNZvjlBg/4HZ8b/lZ6erj1H/qrxQZhMTMt9 LwDHhrg7NzbAzWuacCFzRd3cWNNullap51SKItfXWxUwsUtjEQg5KQ6J EegdfidgedAROoR1rO7GIUYfCqsHgc4ML3Z9U2qZjbHgEGormJBKPHK/ 0Bj3U72oW+PHFUcPptlcT9lxhNf2ivBTTiQUID30iyUscDVPXHoFXgS6 hxlU+uKH+caPziYsw/nnLwGtoRM2fPRq0hA/bJ0jYU1hp51Gh22FjGYu 9R6i7A==
;; Received 525 bytes from 8.8.8.8#53(8.8.8.8) in 55 ms
xyz. 172800 IN NS x.nic.xyz.
xyz. 172800 IN NS y.nic.xyz.
xyz. 172800 IN NS z.nic.xyz.
xyz. 172800 IN NS generationxyz.nic.xyz.
xyz. 86400 IN DS 3599 8 2 B9733869BC84C86BB59D102BA5DA6B27B2088552332A39DCD54BC4E8 D66B0499
xyz. 86400 IN DS 3599 8 1 3FA3B264F45DB5F38BEDEAF1A88B76AA318C2C7F
xyz. 86400 IN RRSIG DS 8 1 86400 20180204200000 20180122190000 41824 . BVHzmP5FP5SXIX4Vldoz3yHdaQzKOfrrDX1oepOSr6eMeLuVjvtbs/VF wv36ce0iasTiQXJxgsxwWHrsGaSyrTejx7V97iP4d+ak8/c7Poica40q IErWd3eZ5Lc5+2Il7Gf0/79XkVE9cGuMt6I3ZGACn7VP3yEXSOWnI6Pz KZHeVAlGgUQpftY7ZzjnxluApCVm+r+OVQi6hK32fMrfoMnyqQBXXbtD gFi3BjxbWzFnDvva5OwOK/6y/qqXZFNKpQi3lrjXJK8lYoUiqmQL88bQ IYx6fP3OpX4xOAG9Ke9v4yR1GZRjx20hLdLXX80Oja+9W1NljaDg5Wtj EmFXwg==
;; Received 690 bytes from 199.9.14.201#53(b.root-servers.net) in 166 ms
friendsakka.xyz. 3600 IN NS ns34.domaincontrol.com.
friendsakka.xyz. 3600 IN NS ns33.domaincontrol.com.
1h97h2oec2juov8dlbbjj6i7ik26bm8d.xyz. 3600 IN NSEC3 1 1 1 - 1H9SP7N22537R92KKG4DNO5R90TMHMCQ NS SOA RRSIG DNSKEY NSEC3PARAM
1h97h2oec2juov8dlbbjj6i7ik26bm8d.xyz. 3600 IN RRSIG NSEC3 8 2 3600 20180126113623 20171227110304 18076 xyz. han/nXPwC8NmMvq7e9bedywXsDEQHxjkXe7KErFelimkDuM7Q8vkDitp v6l/w6FNGB2AUlBLRPOD4Fxk+sdl2D4r8hjkdam1dvjAmbkzw/vMJO6H gdVb4bD2WSyrTq+l45hc+nerG1XUE5Qwu0+Bj6L/ybORD1llxiOTYQMy D/Y=
c19rrbjbgc4rbtss08d8q1mfiqj0fko3.xyz. 3600 IN NSEC3 1 1 1 - C1GGKAORFBAG4JI0F0LJG6NLJK910REV NS DS RRSIG
c19rrbjbgc4rbtss08d8q1mfiqj0fko3.xyz. 3600 IN RRSIG NSEC3 8 2 3600 20180217004626 20180117191209 10653 xyz. aXCV1Ulk51RKwcguxLm442+ncAtfXwCkgY12Im+87eQQosatYF5J93O3 d1rk5hQguB3BPp7/JMLQkAeJHGad2j4SU0T8iy6v7TjwjWGQ7+IsNwoT pHBri5ePZMSJIkBh3eVjBtrfxd8ARCCX/zzAJiqpChE1v4YYfEW1M9bL qtM=
;; Received 603 bytes from 185.24.64.42#53(y.nic.xyz) in 209 ms
a.friendsakka.xyz. 600 IN NS ns.friendsakka.xyz.
;; Received 96 bytes from 208.109.255.17#53(ns34.domaincontrol.com) in 383 ms
本文转自张昺华-sky博客园博客，原文链接：http://www.cnblogs.com/bonelee/p/8335085.html，如需转载请自行联系原作者
