##一.DNS
#1.定义：DNS(Domain Name System,域名系统),英特网上作为域名和IP地址相互映射的一个分布式数据库，能够使用户更方便快捷的访问互联网，而不是去记住能够被机器直接读取的IP数串。通过主机名，最终得到该主机名对应的IP地址的过程叫做域名解析（或主机名解析）。DNS协议运行在UDP协议之上，使用端口为53.
#2.DNS资源记录
DNS采用资源记录的方式存储信息。
-A:名称至IPV4地址
-AAAA:名称至IPV6地址
-CNAME:名称至“规范名称”包括（A/AAAA记录的另一个名称）
-PTR：IPV4/IPV6地址至名称
-MX:用于名称的邮件交换器（向何处发送其电子邮件）
-NS:域名的名称服务器
-SOA：：授权起始：，DNS的区域信息（管理信息）
#3.DNS排错
它显示来自DNS查找的详细信息，其中包括为什么查询失败
-NOERROR:查询成功
-NXDOMAIN:DNS服务器提示不存在这样的名称
-SERVFAIL:DNS服务器停机或响应验证失败
-REFUSED:DNS服务器拒绝回答（也许是处于访问控制原因）
##二.dig
#1.定义：dig(域信息搜索器)，dig命令是用来询问dns域名服务器的灵活的工具，执行dns搜索，显示从受请求的服务器返回的答复.dig可作为dns故障诊断。
dig -b address ##设置所要询问地址的源ip地址。这必须是主机网络接口上的某一合法地址。
dig -x address ##逆向查询（将地址映射到名称），dig自动运行类似11.12.13.10.in-addr.arpa的域名解析，并分别设置查询类型和类为PTR和IN。
#2.dig输出的部分
指出关于查询和答案的信息，包括响应状态和设置的任何特殊标记
-QUESTION:提出实际的DNS查询
-ANSWER:响应（如果有）
-AUTHORITY:负责域、区域的名称服务器
-ADDITIONAL:提供的其他信息，通常是关于名称服务器
-Query time：获得响应花费的时间
A记录：183.232.231.173
Query time:访问百度需要的时间
##三.安装部署DNS
#bind是最广泛使用的开源名称服务器，通过bind软件包提供。服务由named提供。
#1.安装部署dns
yum install bind -y ##安装
(
systemctl start named （在第一次启动时敲键盘生成key） ##开启
systemctl enable named ##开机自动启动
systemctl stop firewalld.service ##关闭火墙
systemctl disable firewalld.service ##开机关闭
主配置文件：/etc/named.conf
子配置文件：/etc/name.rfc1912.zones
数据目录： /var/named
查看端口：ss -antlupe | grep named
#2.高速缓存dns
vim /etc/named.conf
11 listen-on port 53 { any; }; #接口的所有网段打开
17 allow-query { any; }; #允许所有人访问（控制哪些客户端可以向dns服务器询问信息）
18 forwarders { 172.25.254.250; }; #包含dns查询j将转发至的名称服务器的列表（而不是直接联系外部名称服务器）
#测试：
在客户主机
[root@foundation60 ~]# vim /etc/resolv.conf
nameserver 172.25.254.130
[root@foundation60 ~]# dig www.baidu.com
dig:向dns发起询问（dns作本地解析）
www.baidu.com.--域名 530 IN CNAME www.a.shifen.com.
www.a.shifen.com. 272 IN A--地址记录 183.232.231.172
www.a.shifen.com. 272 IN A 183.232.231.173
Query time: 0 msec：解析所用时间
3.权威dns的正向解析
vim /etc/named.conf
18 forwarders { 172.25.254.250; }; #删除此行
vim /etc/named.rfc1912.zones
24 zone "westos.com" IN {
25 type master;
26 file "westos.com.zone"; #该文件没有，需自行建立
27 allow-update { none; };
28 };
cd /var/named/
cp -p named.localhost westos.com.zone(P复制文件时复制权限)
vim westos.com.zone （编辑的是file "westos.com.zone";引号内的文件）
1 $TTL 1D
2 @ IN SOA dns.westos.com. root.westos.com. (
@是引号内的文件 （zone "westos.com"）不以点（.）结尾的，自动加引号内的东西
如：dns.westos.com=dns.westos.com.westos.com) #红色的@不生效，删掉
root.westos.com.：谁来维护westos.com这个域的主机
3 0 ; serial
4 1D ; refresh #1天以后自动刷新
5 1H ; retry #现在没给答案，一小时以后在来问
6 1W ; expire
7 3H ) ; minimum #三小时不重读
8 NS dns.westos.com.
9 dns A 172.25.254.130
10 www A 172.25.254.222
systemctl restart named
测试：
[root@foundation30 ~]# dig www.westos.com
;; QUESTION SECTION:
;www.westos.com. IN A
;; ANSWER SECTION:
www.westos.com. 86400 IN A 172.25.254.222
;; AUTHORITY SECTION:
westos.com. 86400 IN NS dns.westos.com.
;; ADDITIONAL SECTION:
dns.westos.com. 86400 IN A 172.25.254.130
;; Query time: 0 msec
;; SERVER: 172.25.254.130#53(172.25.254.130)
;; WHEN: Sat Nov 25 10:42:14 CST 2017
;; MSG SIZE rcvd: 93
4.反向解析
vim /etc/named.rfc1912.zones
49 zone "254.25.172.in-addr.arpa" IN { (复制37行)
50 type master;
51 file "westos.com.prt";
52 allow-update { none; };
53 };
cd /var/named/
cp -p named.loopback westos.com.prt
vim westos.com.prt
$TTL 1D
@ IN SOA dns.westos.com. root.westos.com. (
0 ; serial
1D ; refresh
1H ; retry
1W ; expire
3H ) ; minimum
NS dns.westos.com.
dns A 172.25.254.130
130 PTR www.westos.com.
systemctl restart named
测试：
[root@foundation30 ~]# dig -x 172.25.254.130 ##反向解析
130.254.25.172.in-addr.arpa. 86400 IN PTR www.westos.com.
;; AUTHORITY SECTION:
254.25.172.in-addr.arpa. 86400 IN NS dns.westos.com.
;; ADDITIONAL SECTION:
dns.westos.com. 86400 IN A 172.25.254.130
5.dns双向解析（让内部人员用内网一个网段看的是一个文件，外部人员用用内网看另一个文件）
vim /etc/named.conf
50 view localnet {
51 match-clients { 172.25.254.30; };
52 zone "." IN {
53 type hint;
54 file "named.ca";
55 };
56 include "/etc/named.rfc1912.zones";
57 include "/etc/named.root.key";
58 };
59 view any {
60 match-clients { any; };
61 zone "." IN {
62 type hint;
63 file "named.ca";
64 };
65 include "/etc/named.rfc1912.zones.inter";
66 include "/etc/named.root.key";
67 };
cp /etc/named.rfc1912.zones /etc/named.rfc1912.zones.inter -p
vim /etc/named.rfc1912.zones.inter
24 zone "westos.com" IN {
25 type master;
26 file "westos.com.inter";
27 allow-update { none; };
28 };
cp -p westos.com.zone westos.com.inter
vim westos.com.inter
$TTL 1D
@ IN SOA dns.westos.com. root.westos.com. (
0 ; serial
1D ; refresh
1H ; retry
1W ; expire
3H ) ; minimum
NS dns.westos.com.
dns A 1.1.1.130
www A 1.1.1.222
~
systemctl restart named
测试：
dig www.westos.com
;www.westos.com. IN A
;; ANSWER SECTION:
www.westos.com. 86400 IN A 1.1.1.222 # 外网
;; AUTHORITY SECTION:
westos.com. 86400 IN NS dns.westos.com.
;; ADDITIONAL SECTION:
dns.westos.com. 86400 IN A 1.1.1.130
dig www.westos.com
;www.westos.com. IN A
;; ANSWER SECTION:
www.westos.com. 86400 IN A 172.25.254.222 #内网
;; AUTHORITY SECTION:
westos.com. 86400 IN NS dns.westos.com.
;; ADDITIONAL SECTION:
dns.westos.com. 86400 IN A 172.25.254.130
6.辅助dns（减轻主dns访问压力）
主dns的设定
vim /etc/named.rfc1912.zones.inter
24 zone "westos.com" IN {
25 type master;
26 file "westos.com.inter";
27 allow-update { none; };
28 also-notify { 172.25.254.230; };
29 };
systenctl restart named
辅助dns上
yum install bind
systemctl start named
systemctl stop firewalld.service
vim /etc/named.conf
10 options {
11 listen-on port 53 { any; };
12 listen-on-v6 port 53 { ::1; };
13 directory "/var/named";
14 dump-file "/var/named/data/cache_dump.db";
15 statistics-file "/var/named/data/named_stats.txt";
16 memstatistics-file "/var/named/data/named_mem_stats.txt";
17 allow-query { any; };
18
vim /etc/named.rfc1912.zones
25 zone "westos.com" IN {
26 type slave;
27 masters { 172.25.254.130; };
28 file "slave/westos.com.inter";
29 allow-update { none; };
30 };
systemctl restart named
测试：vim /etc/resolve.conf
servername 172.25.254.130
dig www.westos.com
vim /etc/resolve.conf
servername 172.25.254.230
dig www.westos.com
注意：只有修改serial时，A记录才会发生改变，最大为十位
7.dns的远程更新
在主dns上
vim /etc/named.rfc1912.zones.inter
24 zone "westos.com" IN {
25 type master;
26 file "westos.com.inter";
27 allow-update { 172.25.254.230; }; #允许230更新
28 also-notify { 172.25.254.230; };
29 };
[root@localhost named]# systemctl restart named
[root@localhost named]# chmod g+w /var/named/ #加w权限时为了让他可执行，更新时，会自动生成westos.com.inter.jnl
[root@localhost named]# ls
测试：
在230这台主机上
nsupdate
server 172.25.254.130
update add bbs.westos.com 86400 A 1.1.1.1 #添加
send
server 172.25.254.130
update delete bbs.westos.com 86400 A 1.1.1.1 #删除
send
在刚才修改的主dns上
在执行添加时，bbs.westos.com添加上
[root@localhost named]# dig bbs.westos.com
; <<>> DiG 9.9.4-RedHat-9.9.4-14.el7 <<>> bbs.westos.com
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 21523
;; flags: qr aa rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 1, ADDITIONAL: 2
;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 4096
;; QUESTION SECTION:
;bbs.westos.com. IN A
;; ANSWER SECTION:
bbs.westos.com. 86400 IN A 1.1.1.1
;; AUTHORITY SECTION:
westos.com. 86400 IN NS dns.westos.com.
;; ADDITIONAL SECTION:
dns.westos.com. 86400 IN A 1.1.1.130
;; Query time: 1 msec
;; SERVER: 127.0.0.1#53(127.0.0.1)
;; WHEN: Sat Nov 25 01:52:24 EST 2017
;; MSG SIZE rcvd: 93
在执行删除时bbs.westos.com.NXDOMAIN表示真没有这个服务器
[root@localhost named]# dig bbs.westos.com
; <<>> DiG 9.9.4-RedHat-9.9.4-14.el7 <<>> bbs.westos.com
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NXDOMAIN, id: 26401
;; flags: qr aa rd ra; QUERY: 1, ANSWER: 0, AUTHORITY: 1, ADDITIONAL: 1
;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 4096
;; QUESTION SECTION:
;bbs.westos.com. IN A
;; AUTHORITY SECTION:
westos.com. 10800 IN SOA dns.westos.com. root.westos.com. 2017112504 86400 3600 604800 10800
;; Query time: 1 msec
;; SERVER: 127.0.0.1#53(127.0.0.1)
;; WHEN: Sat Nov 25 01:53:19 EST 2017![](
;; MSG SIZE rcvd: 88
基于钥匙的
[root@localhost named]# rm -fr westos.com.inter.jnl
[root@localhost named]# systemctl restart named
[root@localhost named]# cd /mnt/
[root@localhost mnt]# cp -p /etc/rndc.key /etc/westos.key
[root@localhost mnt]# dnssec-keygen -a HMAC-MD5 -b 128 -n HOST westos
Kwestos.+157+38857 #生成密码时要敲击键盘 a:加密方式 b:密码的位数 n:用途 HOST域名解析服务
[root@localhost mnt]# ls
Kwestos.+157+38857.key Kwestos.+157+38857.private westos.com.inter
private私钥 key公钥 HMAC-MD5对称加密
[root@localhost mnt]# cat Kwestos.+157+38857.key
westos. IN KEY 512 3 157 oDElhSOpKvO06eSBXD6ILw==
[root@localhost mnt]# vim /etc/westos.key
key "westos" {
algorithm hmac-md5;
secret "oDElhSOpKvO06eSBXD6ILw==";
};
~
[root@localhost mnt]# vim /etc/named.conf
include "/etc/westos.key";
logging {
channel default_debug {
file "data/named.run";
severity dynamic;
};
[root@localhost mnt]# vim /etc/named.rfc1912.zones.inter
zone "westos.com" IN {
type master;
file "westos.com.inter";
allow-update { key westos; };
also-notify { 172.25.254.230; };
};
systemctl restart named
[root@localhost mnt]# scp Kwestos.+157+38857* root@172.25.254.230:/mnt/
The authenticity of host '172.25.254.230 (172.25.254.230)' can't be established.
ECDSA key fingerprint is eb:24:0e:07:96:26:b1:04:c2:37:0c:78:2d:bc:b0:08.
Are you sure you want to continue connecting (yes/no)? yes
Warning: Permanently added '172.25.254.230' (ECDSA) to the list of known hosts.
root@172.25.254.230's password:
Kwestos.+157+38857.key 100% 50 0.1KB/s 00:00
Kwestos.+157+38857.private 100% 165 0.2KB/s 00:00
在传给的key的主机上
[root@localhost mnt]# nsupdate -k Kwestos.+157+38857.private
server 172.25.254.130
update add bbs.westos.com 86400 A 1.1.1.1
send
在刚才的200主机上测试：
[root@localhost mnt]# dig bbs.westos.com
; <<>> DiG 9.9.4-RedHat-9.9.4-14.el7 <<>> bbs.westos.com
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 17952
;; flags: qr aa rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 1, ADDITIONAL: 2
;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 4096
;; QUESTION SECTION:
;bbs.westos.com. IN A
;; ANSWER SECTION:
bbs.westos.com. 86400 IN A 1.1.1.1
;; AUTHORITY SECTION:
westos.com. 86400 IN NS dns.westos.com.
;; ADDITIONAL SECTION:
dns.westos.com. 86400 IN A 1.1.1.130
;; Query time: 2 msec
;; SERVER: 127.0.0.1#53(127.0.0.1)
;; WHEN: Sat Nov 25 02:48:08 EST 2017
;; MSG SIZE rcvd: 93
在传钥匙的主机上执行
[root@localhost mnt]# nsupdate -k Kwestos.+157+38857.private
server 172.25.254.130
update delete bbs.westos.com 86400 A 1.1.1.1
send
[root@localhost mnt]# dig bbs.westos.com
; <<>> DiG 9.9.4-RedHat-9.9.4-14.el7 <<>> bbs.westos.com
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NXDOMAIN, id: 46754
;; flags: qr aa rd ra; QUERY: 1, ANSWER: 0, AUTHORITY: 1, ADDITIONAL: 1
;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 4096
;; QUESTION SECTION:
;bbs.westos.com. IN A
;; AUTHORITY SECTION:
westos.com. 10800 IN SOA dns.westos.com. root.westos.com. 2017112506 86400 3600 604800 10800
;; Query time: 1 msec
8.动态dns
*搭建动态网络
yum install http #安装dhcp
复制模板文件到dhcp配置文件
vim /etc/dhcp/dhcod.conf #编辑配置文件
（相关配置见man 5 dhcpd.conf）
7 option domain-name "westos.com" ; #域名
8 option domain-name-servers 172.25.254.130; #域名主机ip
13 ddns-uodate-style interim; #允许dhcp更新高速缓存
29 subnet 172.25.254.0 network 255.255.255.0; #网段
30 range 172.25.254.0 172.25.254.255; #获取动态网络允许网段
31 option routers 172.25.254.130; #网关
34 key "westos" {
algorithm hmac-md5;
secret "3VgBQE1Z7bAn79L9ChQHyg=='
};
zone westos.com
primary 172.25.254.130;
key westos;
}
systemctl restart dhcpd ##重启服务
vim westos.com.zone #删掉www那一行，否则会产生ip冲突
vim /etc/named.rfc1912.zones #加上key更新
重启
在域名为www.westos.com的主机上更改为动态网络
重启网络来获得ip
ifconfig #查看获得的ip
172.25.254.0
当询问dns时，A记录发生改变，同时文件信息也会同步
重启网络重新获取ip
获取到新的ip，询问dns时A记录发生改变
本文转自Uniqueh51CTO博客，原文链接：http://blog.51cto.com/13363488/2045780 ，如需转载请自行联系原作者
