Linux下如何搭建与使用DNS服务器

# Linux下如何搭建与使用DNS服务器

## 一、DNS服务器概述

### 1.1 DNS基本概念
DNS（Domain Name System）是互联网的核心服务之一，它将人类可读的域名（如www.example.com）转换为机器可读的IP地址（如192.0.2.1）。这种转换过程称为"域名解析"。

### 1.2 DNS服务器类型
- **权威DNS服务器**：存储特定域名记录的官方服务器
- **递归DNS服务器**：为客户端提供查询服务的中间服务器
- **转发DNS服务器**：将查询请求转发给其他DNS服务器

### 1.3 常见DNS软件
- BIND（Berkeley Internet Name Domain）
- dnsmasq（轻量级解决方案）
- PowerDNS
- Unbound（专注于安全的DNS解析器）

## 二、搭建BIND DNS服务器

### 2.1 安装BIND
在主流Linux发行版上安装BIND9：

```bash
# Ubuntu/Debian
sudo apt update
sudo apt install bind9 bind9utils bind9-doc

# CentOS/RHEL
sudo yum install bind bind-utils

options {
    directory "/var/cache/bind";
    recursion yes;
    allow-query { any; };
    forwarders {
        8.8.8.8;
        8.8.4.4;
    };
    dnssec-validation auto;
    listen-on { any; };
    listen-on-v6 { any; };
};

zone "example.com" {
    type master;
    file "/var/cache/bind/db.example.com";
};

zone "2.0.192.in-addr.arpa" {
    type master;
    file "/var/cache/bind/db.192.0.2";
};

$TTL 86400
@       IN      SOA     ns1.example.com. admin.example.com. (
                  2023072101 ; Serial
                  3600      ; Refresh
                  1800      ; Retry
                  604800    ; Expire
                  86400     ; Minimum TTL
)
@       IN      NS      ns1.example.com.
@       IN      NS      ns2.example.com.
@       IN      A       192.0.2.1
ns1     IN      A       192.0.2.2
ns2     IN      A       192.0.2.3
www     IN      A       192.0.2.1
mail    IN      A       192.0.2.4
@       IN      MX 10   mail.example.com.

$TTL 86400
@       IN      SOA     ns1.example.com. admin.example.com. (
                  2023072101 ; Serial
                  3600      ; Refresh
                  1800      ; Retry
                  604800    ; Expire
                  86400     ; Minimum TTL
)
@       IN      NS      ns1.example.com.
@       IN      NS      ns2.example.com.
2       IN      PTR     ns1.example.com.
3       IN      PTR     ns2.example.com.
1       IN      PTR     www.example.com.
4       IN      PTR     mail.example.com.

# 启动BIND服务
sudo systemctl start named
sudo systemctl enable named

# 检查配置语法
sudo named-checkconf

# 测试正向解析
dig @localhost www.example.com

# 测试反向解析
dig @localhost -x 192.0.2.1

zone "example.com" {
    type master;
    file "/var/cache/bind/db.example.com";
    allow-transfer { 192.0.2.3; }; # 从服务器IP
    notify yes;
};

zone "example.com" {
    type slave;
    file "/var/cache/bind/slave/db.example.com";
    masters { 192.0.2.2; }; # 主服务器IP
};

www     IN      A       192.0.2.10
www     IN      A       192.0.2.11
www     IN      A       192.0.2.12

dnssec-enable yes;
dnssec-validation yes;
dnssec-lookaside auto;

logging {
    channel query_log {
        file "/var/log/named/query.log" versions 3 size 5m;
        severity debug 3;
        print-time yes;
    };
    category queries { query_log; };
};

# 重新加载配置
sudo rndc reload

# 查看服务器状态
sudo rndc status

# 清空缓存
sudo rndc flush

# 区域传输测试
sudo named-compilezone -f raw -F text -o /dev/stdout example.com /var/cache/bind/db.example.com

# 实时监控查询日志
sudo tail -f /var/log/named/query.log

# 使用dnstop监控DNS流量
sudo apt install dnstop
sudo dnstop -l eth0

options {
    max-cache-size 256M;
};

options {
    prefetch 2;
};

options {
    minimal-responses yes;
    max-ncache-ttl 3600;
    max-clients-per-query 10;
};

zone "example.com" {
    allow-transfer { trusted-ip; };
};

key "rndc-key" {
    algorithm hmac-sha256;
    secret "base64-encoded-key";
};

options {
    version "Not disclosed";
};

# 使用dig进行查询
dig @8.8.8.8 example.com ANY

# 使用nslookup测试
nslookup www.example.com

# 使用host命令
host www.example.com

# 追踪DNS查询路径
dig +trace example.com

sudo named-checkzone example.com /var/cache/bind/db.example.com

sudo rndc flush

sudo ufw allow 53/tcp
sudo ufw allow 53/udp

sudo apt install dnsmasq

listen-address=127.0.0.1,192.0.2.1
server=8.8.8.8
server=8.8.4.4
cache-size=1000
local=/example.com/
address=/www.example.com/192.0.2.1

sudo apt install pdns-server pdns-backend-sqlite3

launch=gsqlite3
gsqlite3-database=/var/lib/powerdns/pdns.sqlite3

sudo apt install unbound

server:
    interface: 0.0.0.0
    access-control: 192.0.2.0/24 allow
    local-zone: "example.com" static
    local-data: "www.example.com. IN A 192.0.2.1"