资讯详情

深入了解 · 专业解读

Linux DNS 服务器-从高速缓存到辅助 DNS 部署指南

发布时间：2026/7/23 3:19:25
Linux DNS 服务器-从高速缓存到辅助 DNS 部署指南 DNS域名系统DNSDomain Name System是将人类可读的域名如example.com转换为机器可读的IP地址如93.184.216.34的分布式数据库系统。其核心功能包括域名解析将域名映射为IP地址。分层结构采用树状结构包括根域、顶级域TLD、二级域等。记录类型支持AIPv4、AAAAIPv6、MX邮件交换、CNAME别名等记录。一.高速缓存DNSDNS高速缓存是临时存储DNS查询结果的机制用于加速后续相同域名的解析1.实验环境主机名ip用途node1172.25.254.10高速缓存dnsnode2172.25.254.20客户端1node3172.25.254.30客户端22.部署高速缓存dnsa、安装并启用dns[rootnode1 ~]# dnf install bind.x86_64 -y[rootnode1 ~]# systemctl enable --now namedCreated symlink /etc/systemd/system/multi-user.target.wants/named.service → /usr/lib/systemd/system/named.service.#配置dns的基本信息options{listen-on port53{any;};#开放端口在所有网络接口上listen-on-v6 port53{::1;};directory/var/named;dump-file/var/named/data/cache_dump.db;statistics-file/var/named/data/named_stats.txt;memstatistics-file/var/named/data/named_mem_stats.txt;secroots-file/var/named/data/named.secroots;recursing-file/var/named/data/named.recursing;allow-query{any;};#允许是所有人来使用dnsrecursionyes;#递归开关#如果你搭建【权威DNS服务器托管自有域名】禁止开启递归#如果你搭建【缓存/递归DNS内网上网解析用】必须开启recursion yesforwarders{114.114.114.114;};#指定缓存谁的A记录dnssec-validation no;#不做dns的安全校验managed-keys-directory/var/named/dynamic;geoip-directory/usr/share/GeoIP;pid-file/run/named/named.pid;session-keyfile/run/named/session.key;/* https://fedoraproject.org/wiki/Changes/CryptoPolicy */ include/etc/crypto-policies/back-ends/bind.config;};b、测试[rootnode2 ~]# dig www.taobao.com 172.25.254.10;DiG9.16.23-RHwww.taobao.com 172.25.254.10;;global options: cmd;;Got answer:;;-HEADER-opcode: QUERY, status: NOERROR, id:2587;;flags: qr rd ra;QUERY:1, ANSWER:3, AUTHORITY:0, ADDITIONAL:1;;OPT PSEUDOSECTION:;EDNS: version:0, flags:;udp:1232;COOKIE: 85998c69795b69c3010000006a5c2f47def3d47461456d61(good);;QUESTION SECTION:;www.taobao.com. IN A;;ANSWER SECTION: www.taobao.com.600IN CNAME www.taobao.com.danuoyi.tbcache.com. www.taobao.com.danuoyi.tbcache.com.32IN A117.157.129.53 www.taobao.com.danuoyi.tbcache.com.32IN A117.157.129.52;;Query time:4178msec#解析消耗时间;;SERVER:172.25.254.10#53(172.25.254.10);;WHEN: Sun Jul1909:58:31 CST2026;;MSG SIZE rcvd:151[rootnode3 ~]# dig www.taobao.com 172.25.254.10;DiG9.16.23-RHwww.taobao.com 172.25.254.10;;global options: cmd;;Got answer:;;-HEADER-opcode: QUERY, status: NOERROR, id:40520;;flags: qr rd ra;QUERY:1, ANSWER:3, AUTHORITY:0, ADDITIONAL:1;;OPT PSEUDOSECTION:;EDNS: version:0, flags:;udp:1232;COOKIE: 04aeb7a29393043e010000006a5c2f516d67e63f1bfec76e(good);;QUESTION SECTION:;www.taobao.com. IN A;;ANSWER SECTION: www.taobao.com.590IN CNAME www.taobao.com.danuoyi.tbcache.com. www.taobao.com.danuoyi.tbcache.com.22IN A117.157.129.52 www.taobao.com.danuoyi.tbcache.com.22IN A117.157.129.53;;Query time:0msec#缓存生效;;SERVER:172.25.254.10#53(172.25.254.10);;WHEN: Sun Jul1909:58:41 CST2026;;MSG SIZE rcvd:151二.dns服务器的解析部署1.正向解析a. named.rfc1912.zones 区域配置[rootnode1 ~]# vim /etc/named.rfc1912.zoneszonelocalhostIN{typemaster;filenamed.localhost;allow-update{none;};};zonetiminglee.orgIN{typemaster;filetiminglee.org.zone;allow-update{none;};};配置片段字段含义详细说明zone localhost IN {定义区域localhostzone 域名声明要托管的域名区域IN固定互联网记录类type master;服务器类型主 DNSmaster 主权威服务器本机持有该域名原始 zone 文件所有解析记录由本机管理file named.localhost;区域库文件路径文件存放根目录由named.conf的directory /var/named指定完整路径/var/named/named.localhostallow-update { none; };禁止动态 DNS 更新none 不允许客户端 / 其他服务器自动修改域名记录只能手动改 zone 文件内网有 DHCP 动态解析才填网段};区域配置结束符每个 zone 大括号成对闭合zone timinglee.org IN {自定义业务域名区域声明本机托管timinglee.org域名对应你之前写的解析记录文件type master;timinglee.org 的主 DNS本机是 timinglee.org 权威主服务器file timinglee.org.zone;对应区域解析文件完整路径/var/named/timinglee.org.zone里面存放 A/NS/SOA 记录allow-update { none; };关闭动态更新手动维护域名记录安全推荐配置b. timinglee.org 区域文件配置[rootnode1 ~]# cd /var/named/[rootnode1 named]# cp -p named.localhost timinglee.org.zone$TTL1D IN SOA admin.timinglee.org. root.timinglee.org.(0;serial 1D;refresh 1H;retry 1W;expire 3H);minimum NS dns.timinglee.org. dns A172.25.254.10 timinglee A172.25.254.254[rootnode1 named]# systemctl restart named配置行字段释义详细讲解$TTL 1D全局生存时间TTL Time To Live缓存存活时间1D 1 天客户端拿到解析结果后本地缓存 1 天期间不用重复请求 DNS 服务器区域简写符号代表当前域名timinglee.org.等价完整写法timinglee.org.IN互联网类DNS 记录标准类别固定写IN代表互联网通用记录SOA起始授权记录区域头部核心Start of Authority每个域名区域必须唯一一条标记这台服务器是该域名的权威 DNS包含同步、超时、管理员邮箱信息admin.timinglee.org.管理员邮箱完整 FQDNDNS 语法里把第一个.替换为真实邮箱admintiminglee.org末尾必须带.代表完整绝对域名root.timinglee.org.主服务器 FQDN该域名的权威 DNS 服务器完整域名dns.timinglee.org.末尾.不可省略( 0 ; serial )区域序列号区域文件版本号手动修改辅助 DNS 同步时对比版本规则实现主动同步修改区域记录后必须数字增大推荐格式2026071901年月日 序号当前写0存在缺陷修改文件后从机不会同步1D ; refresh刷新间隔 1 天辅助 DNS 每隔 1 天主动联系主 DNS检查 serial 序列号是否更新有更新就同步区域文件1H ; retry重试间隔 1 小时如果辅助 DNS 联系主 DNS 失败每隔 1 小时重新尝试连接1W ; expire过期时长 1 周辅助 DNS 持续 1 周都无法连通主 DNS则判定区域数据失效不再对外提供解析3H ; minimum否定缓存 TTL 3 小时查询不存在的域名比如xxx.timinglee.org客户端缓存 3 小时3 小时内不会重复查不存在的域名NS dns.timinglee.org.NS 域名服务器记录Name Server声明timinglee.org域名由dns.timinglee.org.这台服务器解析域名末尾.必须加完整绝对 FQDNdns A 172.25.254.10A 地址记录A 记录 域名→IPv4 映射dns是相对域名自动补全为dns.timinglee.org.解析结果dns.timinglee.org 172.25.254.10刚好匹配上面 NS 记录的服务器地址timinglee A 172.25.254.254A 地址记录timinglee相对域名自动补全为timinglee.timinglee.org.解析结果timinglee.timinglee.org 172.25.254.254测试[rootnode2 ~]# dig timinglee.timinglee.org 172.25.254.10;DiG9.16.23-RHtiminglee.timinglee.org 172.25.254.10;;global options: cmd;;Got answer:;;-HEADER-opcode: QUERY, status: NOERROR, id:30320;;flags: qr aa rd ra;QUERY:1, ANSWER:1, AUTHORITY:0, ADDITIONAL:1;;OPT PSEUDOSECTION:;EDNS: version:0, flags:;udp:1232;COOKIE: c31774e9ef556674010000006a5c3d6d4f7539ec32594ef8(good);;QUESTION SECTION:;timinglee.timinglee.org. IN A;;ANSWER SECTION: timinglee.timinglee.org.86400IN A172.25.254.254;;Query time:0msec;;SERVER:172.25.254.10#53(172.25.254.10);;WHEN: Sun Jul1910:58:53 CST2026;;MSG SIZE rcvd:962.邮件解析记录[rootnode1 named]# vim timinglee.org.zone$TTL1D IN SOA admin.timinglee.org. root.timinglee.org.(0;serial 1D;refresh 1H;retry 1W;expire 3H);minimum NS dns.timinglee.org. dns A172.25.254.10 timinglee A172.25.254.254 timinglee.org. MX5172.25.254.10.[rootnode1 named]# systemctl restart named测试[rootnode2 ~]# dig -t mx timinglee.org 172.25.254.10 #-t -Type;DiG9.16.23-RH-tmx timinglee.org 172.25.254.10;;global options: cmd;;Got answer:;;-HEADER-opcode: QUERY, status: NOERROR, id:59523;;flags: qr aa rd ra;QUERY:1, ANSWER:1, AUTHORITY:0, ADDITIONAL:1;;OPT PSEUDOSECTION:;EDNS: version:0, flags:;udp:1232;COOKIE: 54865c32be027587010000006a5c3ec54da81b1655aa92d2(good);;QUESTION SECTION:;timinglee.org. IN MX;;ANSWER SECTION: timinglee.org.86400IN MX5172.25.254.10.;;Query time:1msec;;SERVER:172.25.254.10#53(172.25.254.10);;WHEN: Sun Jul1911:04:37 CST2026;;MSG SIZE rcvd:993.反向解析记录[rootnode1 named]# vim /etc/named.rfc1912.zoneszone1.0.0.127.in-addr.arpaIN{typemaster;filenamed.loopback;allow-update{none;};};zone254.25.172.in-addr.arpaIN{typemaster;file172.25.254.ptr;allow-update{none;};};[rootnode1 named]# cp -p named.loopback 172.25.254.ptr$TTL1D IN SOA admin.timinglee.org. root.timinglee.org.(0;serial 1D;refresh 1H;retry 1W;expire 3H);minimum NS dns.timinglee.org. dns A172.25.254.10111PTR haha.timinglee.org.[rootnode1 named]# systemctl restart named测试[rootnode2 ~]# dig -x 172.25.254.111 172.25.254.10;DiG9.16.23-RH-x172.25.254.111 172.25.254.10;;global options: cmd;;Got answer:;;-HEADER-opcode: QUERY, status: NOERROR, id:32575;;flags: qr aa rd ra;QUERY:1, ANSWER:1, AUTHORITY:0, ADDITIONAL:1;;OPT PSEUDOSECTION:;EDNS: version:0, flags:;udp:1232;COOKIE: f5ea81523d3c5e20010000006a5c4040b7be6bf6a0ae12af(good);;QUESTION SECTION:;111.254.25.172.in-addr.arpa. IN PTR;;ANSWER SECTION:111.254.25.172.in-addr.arpa.86400IN PTR haha.timinglee.org.;;Query time:1msec;;SERVER:172.25.254.10#53(172.25.254.10);;WHEN: Sun Jul1911:10:56 CST2026;;MSG SIZE rcvd:116三.dns的多向解析多向解析根据用户位置或网络条件返回不同的IP地址1.实验环境DNS:双网卡 eth0–nat模式 172.25.254.10 eth1-仅主机模式192.168.0.10node1单网卡eth0-nat模式172.25.254.20node2单网卡eth0-仅主机192.168.0.302.配置双向解析# 改/etc/named.conf主配置文件 通过view区分不同网段[rootnode1 ~]# vim /etc/named.conf/* zone.IN{typehint;filenamed.ca;};include/etc/named.rfc1912.zones;*/# 注释掉默认配置------------------------------------- view192{match-clients{192.168.0.0/24;};zone.IN{typehint;filenamed.ca;};include/etc/named.rfc1912.192;};view any{match-clients{any;};zone.IN{typehint;filenamed.ca;};include/etc/named.rfc1912.zones;};include/etc/named.root.key;#保留配置-------------------------------------# 修改/etc/named.rfc1912.192配置文件[rootnode1 ~]# cp -p /etc/named.rfc1912.zones /etc/named.rfc1912.192[rootnode1 ~]# vim /etc/named.rfc1912.192zonetiminglee.orgIN{typemaster;filetiminglee.org-192.zone;allow-update{none;};};# 修改timinglee.org-192.zone配置文件[rootnode1 ~]# cd /var/named/[rootnode1 named]# cp -p timinglee.org.zone timinglee.org-192.zone[rootnode1 named]# vim timinglee.org-192.zone$TTL1D IN SOA admin.timinglee.org. root.timinglee.org.(0;serial 1D;refresh 1H;retry 1W;expire 3H);minimum NS dns.timinglee.org. dns A192.168.0.10 timinglee A192.168.0.254 timinglee.org. MX5192.168.0.10.[rootnode1 named]# systemctl restart named测试在172.25.254.20主机中rootnode2 ~]# dig timinglee.timinglee.org 172.25.254.10;DiG9.16.23-RHtiminglee.timinglee.org 172.25.254.10;;global options: cmd;;Got answer:;;-HEADER-opcode: QUERY, status: NOERROR, id:23390;;flags: qr aa rd ra;QUERY:1, ANSWER:1, AUTHORITY:0, ADDITIONAL:1;;OPT PSEUDOSECTION:;EDNS: version:0, flags:;udp:1232;COOKIE: 6cdea0ba7e48edf7010000006a5c718408dce18bf2fbc812(good);;QUESTION SECTION:;timinglee.timinglee.org. IN A;;ANSWER SECTION: timinglee.timinglee.org.86400IN A172.25.254.254;;Query time:4msec;;SERVER:172.25.254.10#53(172.25.254.10);;WHEN: Sun Jul1914:41:08 CST2026;;MSG SIZE rcvd:96在192.168.0.30 主机中[rootnode3 ~]# dig timinglee.timinglee.org 192.168.0.10;DiG9.16.23-RHtiminglee.timinglee.org 192.168.0.10;;global options: cmd;;Got answer:;;-HEADER-opcode: QUERY, status: NOERROR, id:61435;;flags: qr aa rd ra;QUERY:1, ANSWER:1, AUTHORITY:0, ADDITIONAL:1;;OPT PSEUDOSECTION:;EDNS: version:0, flags:;udp:1232;COOKIE: 84d805319be572fb010000006a5c71adc0e850a9ed642b0d(good);;QUESTION SECTION:;timinglee.timinglee.org. IN A;;ANSWER SECTION: timinglee.timinglee.org.86400IN A192.168.0.254;;Query time:0msec;;SERVER:192.168.0.10#53(192.168.0.10);;WHEN: Sun Jul1914:41:49 CST2026;;MSG SIZE rcvd:96四.辅助dns辅助DNS是主DNS服务器的备份提供冗余和负载分担1.实验环境node1-dns-master172.25.254.10有整套A记录信息node2-dns-slave172.25.254.20本身没有任何数据数据来源从172.25.254.10来2.部署辅助dnsnode2中[rootnode2 ~]# dnf install bind -y[rootnode2 ~]# vim /etc/named.confoptions{// listen-on port53{127.0.0.1;};listen-on-v6 port53{::1;};directory/var/named;dump-file/var/named/data/cache_dump.db;statistics-file/var/named/data/named_stats.txt;memstatistics-file/var/named/data/named_mem_stats.txt;secroots-file/var/named/data/named.secroots;recursing-file/var/named/data/named.recursing;// allow-query{localhost;};#...省略内容dnssec-validation no;#...省略内容};[rootnode2 ~]# vim /etc/named.rfc1912.zoneszonelocalhostIN{typemaster;filenamed.localhost;allow-update{none;};};zonetiminglee.orgIN{typeslave;masters{172.25.254.10;};fileslaves/timinglee.org.zone;};#测试[rootnode2 ~]# dig timinglee.timinglee.org 172.25.254.20;DiG9.16.23-RHtiminglee.timinglee.org 172.25.254.20;;global options: cmd;;Got answer:;;-HEADER-opcode: QUERY, status: NOERROR, id:61256;;flags: qr aa rd ra;QUERY:1, ANSWER:1, AUTHORITY:0, ADDITIONAL:1;;OPT PSEUDOSECTION:;EDNS: version:0, flags:;udp:1232;COOKIE: 46d3796b8194b9e3010000006a5c808ec7b2c32caf76c174(good);;QUESTION SECTION:;timinglee.timinglee.org. IN A;;ANSWER SECTION: timinglee.timinglee.org.86400IN A172.25.254.254;;Query time:0msec;;SERVER:172.25.254.20#53(172.25.254.20);;WHEN: Sun Jul1915:45:18 CST2026;;MSG SIZE rcvd:963.辅助dns的数据同步问题默认主dns的A记录数据更改后辅助dns的数据要等1天才能同步解决此问题思想当主dns更新A记录后要主动通知slave[rootnode1 named]# vim /etc/named.rfc1912.zoneszonetiminglee.orgIN{typemaster;filetiminglee.org.zone;allow-update{none;};also-notify{172.25.254.20;};};[rootnode1 named]# vim /var/named/timinglee.org.zone$TTL1D IN SOA admin.timinglee.org. root.timinglee.org.(2026071903;serial#文件更改标识1D;refresh 1H;retry 1W;expire 3H);minimum NS dns.timinglee.org. dns A172.25.254.10 timinglee A172.25.254.222 timinglee.org. MX5172.25.254.10.[rootnode1 named]# systemctl restart named配置行字段释义详细讲解( 0 ; serial )区域序列号区域文件版本号手动修改辅助 DNS 同步时对比版本规则实现主动同步修改区域记录后必须数字增大推荐格式2026071901年月日 序号当前写0存在缺陷修改文件后从机不会同步1D ; refresh刷新间隔 1 天辅助 DNS 每隔 1 天主动联系主 DNS检查 serial 序列号是否更新有更新就同步区域文件1H ; retry重试间隔 1 小时如果辅助 DNS 联系主 DNS 失败每隔 1 小时重新尝试连接1W ; expire过期时长 1 周辅助 DNS 持续 1 周都无法连通主 DNS则判定区域数据失效不再对外提供解析3H ; minimum否定缓存 TTL 3 小时查询不存在的域名比如xxx.timinglee.org客户端缓存 3 小时3 小时内不会重复查不存在的域名#测试node2中的dns没有做任何操作但是数据会直接更新[rootnode2 ~]# dig timinglee.timinglee.org 172.25.254.20;DiG9.16.23-RHtiminglee.timinglee.org 172.25.254.20;;global options: cmd;;Got answer:;;-HEADER-opcode: QUERY, status: NOERROR, id:23995;;flags: qr aa rd ra;QUERY:1, ANSWER:1, AUTHORITY:0, ADDITIONAL:1;;OPT PSEUDOSECTION:;EDNS: version:0, flags:;udp:1232;COOKIE: 833ea594827ee46a010000006a5c838627b570741be071bc(good);;QUESTION SECTION:;timinglee.timinglee.org. IN A;;ANSWER SECTION: timinglee.timinglee.org.86400IN A172.25.254.222;;Query time:1msec;;SERVER:172.25.254.20#53(172.25.254.20);;WHEN: Sun Jul1915:57:58 CST2026;;MSG SIZE rcvd:96

相关新闻