dns主配置文件的格式
[root@centos7 named]# cat /etc/named.conf
//
// named.conf
//
// Provided by Red Hat bind package to configure the ISC BIND named(8) DNS
// server as a caching only nameserver (as a localhost DNS resolver only).
//
// See /usr/share/doc/bind*/sample/ for example named configuration files.
//
// See the BIND Administrator's Reference Manual (ARM) for details about the
// configuration located in /usr/share/doc/bind-{version}/Bv9ARM.html
options {
// listen-on port 53 { 127.0.0.1; };
listen-on-v6 port 53 { ::1; };
directory "/var/named";
dump-file "/var/named/data/cache_dump.db";
statistics-file "/var/named/data/named_stats.txt";
memstatistics-file "/var/named/data/named_mem_stats.txt";
// allow-query { localhost; };
/*
- If you are building an AUTHORITATIVE DNS server, do NOT enable recursion.
- If you are building a RECURSIVE (caching) DNS server, you need to enable
recursion.
- If your recursive DNS server has a public IP address, you MUST enable access
control to limit queries to your legitimate users. Failing to do so will
cause your server to become part of large scale DNS amplification
attacks. Implementing BCP38 within your network would greatly
reduce such attack surface
*/
recursion yes;
dnssec-enable yes;
dnssec-validation yes;
/* Path to ISC DLV key */
bindkeys-file "/etc/named.iscdlv.key";
managed-keys-directory "/var/named/dynamic";
pid-file "/run/named/named.pid";
session-keyfile "/run/named/session.key";
};
logging {
channel default_debug {
file "data/named.run";
severity dynamic;
};
};
zone "." IN {
type hint;
file "named.ca";
};
include "/etc/named.rfc1912.zones";
include "/etc/named.root.key";
[root@centos7 named]# cat /etc/named.conf.kk
//
// named.conf
//
// Provided by Red Hat bind package to configure the ISC BIND named(8) DNS
// server as a caching only nameserver (as a localhost DNS resolver only).
//
// See /usr/share/doc/bind*/sample/ for example named configuration files.
//
// See the BIND Administrator's Reference Manual (ARM) for details about the
// configuration located in /usr/share/doc/bind-{version}/Bv9ARM.html
options {
// listen-on port 53 { 127.0.0.1; }; //如果不注釋掉掉表示只給本機(jī)提供域名解析服務(wù)筛圆；只監(jiān)聽本地的127.0.0.1地址；也可改
成localhost表示本機(jī)所有IP listen-on-v6 port 53 { ::1; };
directory "/var/named";
dump-file "/var/named/data/cache_dump.db";
statistics-file "/var/named/data/named_stats.txt";
memstatistics-file "/var/named/data/named_mem_stats.txt";
// allow-query { localhost; }; //表示只允許本地主機(jī)查詢闽晦；或者在{}里加上運(yùn)行解析的主機(jī)ip地址；或者注釋允許所有主
機(jī)訪問仙蛉；只提供服務(wù)的ip地址
/*
- If you are building an AUTHORITATIVE DNS server, do NOT enable recursion.
- If you are building a RECURSIVE (caching) DNS server, you need to enable
recursion.
- If your recursive DNS server has a public IP address, you MUST enable access
control to limit queries to your legitimate users. Failing to do so will
cause your server to become part of large scale DNS amplification
attacks. Implementing BCP38 within your network would greatly
reduce such attack surface
*/
recursion yes;
dnssec-enable yes;
dnssec-validation yes;
/* Path to ISC DLV key */
bindkeys-file "/etc/named.iscdlv.key";
managed-keys-directory "/var/named/dynamic"; // #/var/named/dynamic表示名字解析數(shù)據(jù)庫荠瘪；用來提供名字解析而非跑
互聯(lián)網(wǎng)問其他的DNS服務(wù)器
pid-file "/run/named/named.pid";
session-keyfile "/run/named/session.key";
};
logging {
channel default_debug {
file "data/named.run";
severity dynamic;
};
};
zone "." IN {
type hint;
file "named.ca";
};
include "/etc/named.rfc1912.zones"; \\存放數(shù)據(jù)庫與域存放關(guān)系的文件；也可在此文件中更改
include "/etc/named.root.key";
存放數(shù)據(jù)庫與域存放關(guān)系的文件格式哀墓、
實(shí)例
[root@centos7 named]# cat /etc/name.rfc1912.back
// named.rfc1912.zones:
//
// Provided by Red Hat caching-nameserver package
//
// ISC BIND named zone configuration for zones recommended by
// RFC 1912 section 4.1 : localhost TLDs and address zones
// and http://www.ietf.org/internet-drafts/draft-ietf-dnsop-default-local-zones-02.txt
// (c)2007 R W Franks
//
// See /usr/share/doc/bind*/sample/ for example named configuration files.
//
zone "localhost.localdomain" IN {
type master;
file "named.localhost";
allow-update { none; };
};
zone "localhost" IN {
type master;
file "named.localhost";
allow-update { none; };
};
zone "1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.ip6.arpa" IN {
type master;
file "named.loopback";
allow-update { none; };
};
zone "1.0.0.127.in-addr.arpa" IN {
type master;
file "named.loopback";
allow-update { none; };
};
zone "0.in-addr.arpa" IN {
type master;
file "named.empty";
allow-update { none; };
};
zone "chenxi.conm" { #以chenxi.com域?yàn)槔? type master; #相對晨曦域來說這是他的第一個域
file "chenxi.zone";
allow-update {none;};
}
#zone（區(qū)域） "."（區(qū)域名字） IN （字段可世捍隆） {
# type(類型) hint; 如果類型的值是master表示第一個域
# file "named.ca"; 區(qū)域數(shù)據(jù)庫的名字；路徑不用寫默認(rèn)放在/var/named/目錄下臀突；存放區(qū)域數(shù)據(jù)庫文件的名字
#;}
[root@centos7 named]# cat /etc/named.rfc1912.zones
// named.rfc1912.zones:
//
// Provided by Red Hat caching-nameserver package
//
// ISC BIND named zone configuration for zones recommended by
// RFC 1912 section 4.1 : localhost TLDs and address zones
// and http://www.ietf.org/internet-drafts/draft-ietf-dnsop-default-local-zones-02.txt
// (c)2007 R W Franks
//
// See /usr/share/doc/bind*/sample/ for example named configuration files.
//
zone "localhost.localdomain" IN {
type master;
file "named.localhost";
allow-update { none; };
};
zone "localhost" IN {
type master;
file "named.localhost";
allow-update { none; };
};
zone "1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.ip6.arpa" IN {
type master;
file "named.loopback";
allow-update { none; };
};
zone "1.0.0.127.in-addr.arpa" IN {
type master;
file "named.loopback";
allow-update { none; };
};
zone "0.in-addr.arpa" IN {
type master;
file "named.empty";
allow-update { none; };
};
zone "chenxi.com" {
type master; //hahah
file "chenxi.com.zone";
allow-update {none;};
};
名字解析數(shù)據(jù)庫格式
[root@centos7 named]# vim /var/named/chenxi.com.zone 表示名字解析數(shù)據(jù)庫走孽；用來提供名字解析而非跑互聯(lián)網(wǎng)問其他的DNS服務(wù)器
$TTL 1D ;$TTL值表示生命期；只是全局設(shè)置;自己去其他DNS的域名解析的結(jié)果緩存的時間1D表示一天
@ IN SOA dns1.chenxi.com. rname.invalid. ( ;IN表示intnet的類型盒齿；可以繼承上一條記錄的困食；
下一條可以不寫@表示當(dāng)前區(qū)數(shù)據(jù)庫對應(yīng)的域；繼承上一條的硕盹；SOA表示資源記錄類型；區(qū)域數(shù)據(jù)庫必須且只能有一個soa記錄也必須位于與
區(qū)域數(shù)據(jù)庫的第一條記錄啊胶；@主DNS服務(wù)器的名字垛贤；省略表示繼承上一條的記錄；一般格式dns1.yuming.com.注意最后一個點(diǎn)一定要寫 ;最
后一行郵箱地址.用來表示@某饰；因?yàn)锧在這里表示本域
0 ; serial版本號；根據(jù)版本號來同步
1D ; refresh備用服務(wù)器黔漂；到主服務(wù)器的同步間隔時間；刷新時間一天
1H ; retry重試時間牧嫉；表示當(dāng)備服務(wù)到主服務(wù)器同不是劳较，發(fā)現(xiàn)網(wǎng)絡(luò)中斷；隔多久再來步
观蜗；這里是1小時
1W ; expire 過期時間；表示長達(dá)指定的時間無法連接主服務(wù)器抖仅；表示主服務(wù)器失效從
服務(wù)器
3H ) ; minimum 否定答案的TTL值砖第；表示當(dāng)主服務(wù)器這里無從服務(wù)器要要查的結(jié)果時；主
服務(wù)告訴從服務(wù)器我查不到梧兼；指定的時間內(nèi)別再問我了
NS dns1 ;NS記錄用來指定誰提供DNS服務(wù);
NS dns2
dns1 A 192.168.206.128 ;表示該域的主域服務(wù)器對應(yīng)的服務(wù)器地址
dns2 A 192.168.206.128 ;表示dns2的主機(jī)IP
websrv A 1.1.1.1 ;websrvb表示本域別名；寫全的話websrv.chenxi.com
[root@centos7 named]# named-checkzone chenxi.com /var/named/chenxi.com.zone 該文件檢查語法的命令
zone chenxi.com/IN: loaded serial 0
OK
