DNS: Bind使用教程 - Githubissues

搭建缓存DNS

主要的配置项为:

        recursion yes; // 开启递归查询模式

        dnssec-enable no;  // 关闭dnssec
        dnssec-validation no; // 关闭dnssec


options {
        listen-on port 53 { 127.0.0.1; };
        listen-on-v6 port 53 { none; };
        directory       "/var/named";
        dump-file       "/var/named/data/cache_dump.db";
        statistics-file "/var/named/data/named_stats.txt";
        memstatistics-file "/var/named/data/named_mem_stats.txt";
        recursing-file  "/var/named/data/named.recursing";
        secroots-file   "/var/named/data/named.secroots";
        allow-query     { localhost; };

        /* 
         - If you are building an AUTHORITATIVE DNS server, do NOT enable recursion.
         - If you are building a RECURSIVE (caching) DNS server, you need to enable 
           recursion. 
         - If your recursive DNS server has a public IP address, you MUST enable access 
           control to limit queries to your legitimate users. Failing to do so will
           cause your server to become part of large scale DNS amplification 
           attacks. Implementing BCP38 within your network would greatly
           reduce such attack surface 
        */
        recursion yes;

        dnssec-enable no; 
        dnssec-validation no;

        /* Path to ISC DLV key */
        bindkeys-file "/etc/named.root.key";

        managed-keys-directory "/var/named/dynamic";

        pid-file "/run/named/named.pid";
        session-keyfile "/run/named/session.key";
};

验证:

[root@centos ~]# dig @127.0.0.1 baidu.com

; <<>> DiG 9.11.4-P2-RedHat-9.11.4-16.P2.el7_8.6 <<>> @127.0.0.1 baidu.com
; (1 server found)
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 24828
;; flags: qr rd ra; QUERY: 1, ANSWER: 2, AUTHORITY: 13, ADDITIONAL: 24

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 4096
;; QUESTION SECTION:
;baidu.com.         IN  A

;; ANSWER SECTION:
baidu.com.      384 IN  A   220.181.38.148
baidu.com.      384 IN  A   39.156.69.79

;; AUTHORITY SECTION:
.           469115  IN  NS  f.root-servers.net.
.           469115  IN  NS  a.root-servers.net.
.           469115  IN  NS  c.root-servers.net.
.           469115  IN  NS  b.root-servers.net.
.           469115  IN  NS  k.root-servers.net.
.           469115  IN  NS  e.root-servers.net.
.           469115  IN  NS  i.root-servers.net.
.           469115  IN  NS  g.root-servers.net.
.           469115  IN  NS  m.root-servers.net.
.           469115  IN  NS  d.root-servers.net.
.           469115  IN  NS  h.root-servers.net.
.           469115  IN  NS  l.root-servers.net.
.           469115  IN  NS  j.root-servers.net.

;; ADDITIONAL SECTION:
a.root-servers.net. 469115  IN  A   198.41.0.4
b.root-servers.net. 469115  IN  A   199.9.14.201
c.root-servers.net. 469115  IN  A   192.33.4.12
d.root-servers.net. 469115  IN  A   199.7.91.13
e.root-servers.net. 469115  IN  A   192.203.230.10
f.root-servers.net. 469115  IN  A   192.5.5.241
g.root-servers.net. 469115  IN  A   192.112.36.4
h.root-servers.net. 469115  IN  A   198.97.190.53
i.root-servers.net. 469115  IN  A   192.36.148.17
j.root-servers.net. 469115  IN  A   192.58.128.30
k.root-servers.net. 469115  IN  A   193.0.14.129
l.root-servers.net. 469115  IN  A   199.7.83.42
a.root-servers.net. 469115  IN  AAAA    2001:503:ba3e::2:30
b.root-servers.net. 469115  IN  AAAA    2001:500:200::b
c.root-servers.net. 469115  IN  AAAA    2001:500:2::c
d.root-servers.net. 469115  IN  AAAA    2001:500:2d::d
e.root-servers.net. 469115  IN  AAAA    2001:500:a8::e
f.root-servers.net. 469115  IN  AAAA    2001:500:2f::f
g.root-servers.net. 469115  IN  AAAA    2001:500:12::d0d
h.root-servers.net. 469115  IN  AAAA    2001:500:1::53
i.root-servers.net. 469115  IN  AAAA    2001:7fe::53
j.root-servers.net. 469115  IN  AAAA    2001:503:c27::2:30
k.root-servers.net. 469115  IN  AAAA    2001:7fd::1

;; Query time: 22 msec
;; SERVER: 127.0.0.1#53(127.0.0.1)
;; WHEN: Wed Nov 11 00:23:20 EST 2020
;; MSG SIZE  rcvd: 781

lihongjie0209 / myblog

DNS: Bind使用教程 #224

搭建缓存DNS