主DNS配置

一，安装BIND

[root@localhost ~]# yum install bind bind-chroot bind-utils
Loaded plugins: product-id, subscription-manager
This system is not registered to Red Hat Subscription Management. You can use subscription-manager to register.
cdrom                                                                      | 4.1 kB  ::
Resolving Dependencies
--> Running transaction check
---> Package bind.x86_64 :9.9.-.el7 will be installed
--> Processing Dependency: bind-libs = :9.9.-.el7 for package: :bind-9.9.-.el7.x86_64
--> Processing Dependency: libbind9.so.()(64bit) for package: :bind-9.9.-.el7.x86_64
--> Processing Dependency: libdns.so.()(64bit) for package: :bind-9.9.-.el7.x86_64
--> Processing Dependency: libisc.so.()(64bit) for package: :bind-9.9.-.el7.x86_64
--> Processing Dependency: libisccc.so.()(64bit) for package: :bind-9.9.-.el7.x86_64
--> Processing Dependency: libisccfg.so.()(64bit) for package: :bind-9.9.-.el7.x86_64
--> Processing Dependency: liblwres.so.()(64bit) for package: :bind-9.9.-.el7.x86_64
---> Package bind-chroot.x86_64 :9.9.-.el7 will be installed
---> Package bind-utils.x86_64 :9.9.-.el7 will be installed
--> Running transaction check
---> Package bind-libs.x86_64 :9.9.-.el7 will be installed
--> Finished Dependency Resolution

Dependencies Resolved

==================================================================================================
 Package                 Arch               Version                       Repository         Size
==================================================================================================
Installing:
 bind                    x86_64             :9.9.-.el7               cdrom             1.8 M
 bind-chroot             x86_64             :9.9.-.el7               cdrom               k
 bind-utils              x86_64             :9.9.-.el7               cdrom              k
Installing for dependencies:
 bind-libs               x86_64             :9.9.-.el7               cdrom             1.0 M

Transaction Summary
==================================================================================================
Install   Packages (+ Dependent package)

Total download size: 3.0 M
Installed size: 7.2 M
Is this ok [y/d/N]: y
Downloading packages:
--------------------------------------------------------------------------------------------------
Total                                                               MB/s | 3.0 MB  ::
Running transaction check
Running transaction test
Transaction test succeeded
Running transaction
  Installing : :bind-libs-9.9.-.el7.x86_64                                               /
  Installing : :bind-9.9.-.el7.x86_64                                                    /
  Installing : :bind-chroot-9.9.-.el7.x86_64                                             /
  Installing : :bind-utils-9.9.-.el7.x86_64                                              /
  Verifying  : :bind-9.9.-.el7.x86_64                                                    /
  Verifying  : :bind-libs-9.9.-.el7.x86_64                                               /
  Verifying  : :bind-chroot-9.9.-.el7.x86_64                                             /
  Verifying  : :bind-utils-9.9.-.el7.x86_64                                              / 

Installed:
  bind.x86_64 :9.9.-.el7                     bind-chroot.x86_64 :9.9.-.el7
  bind-utils.x86_64 :9.9.-.el7              

Dependency Installed:
  bind-libs.x86_64 :9.9.-.el7                                                                

Complete!

二，BIND配置

/etc/named.conf                   主配置文件

/etc/named.rfc1912.zones     区域配置文件

/var/named/named.localhost 资源记录配置文件

1，编辑主配置文件

[root@localhost ~]# vim /etc/named.conf

//
// named.conf
//
// Provided by Red Hat bind package to configure the ISC BIND named(8) DNS
// server as a caching only nameserver (as a localhost DNS resolver only).
//
// See /usr/share/doc/bind*/sample/ for example named configuration files.
//

options {
        listen-on port  { any; };  //将“127.0.0.1”改为any，可监听任何IP地址（域名服务器的IP）
        listen-on-v6 port  { ::; };
        directory       "/var/named";
        dump-file       "/var/named/data/cache_dump.db";
        statistics-file "/var/named/data/named_stats.txt";
        memstatistics-file "/var/named/data/named_mem_stats.txt";
        allow-query     { any; };  //将“localhost”改为any，代表允许任何主机查询

        /*
         - If you are building an AUTHORITATIVE DNS server, do NOT enable recursion.
         - If you are building a RECURSIVE (caching) DNS server, you need to enable
           recursion.
         - If your recursive DNS server has a public IP address, you MUST enable access
           control to limit queries to your legitimate users. Failing to do so will
           cause your server to become part of large scale DNS amplification
           attacks. Implementing BCP38 within your network would greatly
           reduce such attack surface
        */
        recursion yes;

        dnssec-enable yes;
        dnssec-validation yes;
        dnssec-lookaside auto;

        /* Path to ISC DLV key */
        bindkeys-file "/etc/named.iscdlv.key";

        managed-keys-directory "/var/named/dynamic";

        pid-file "/run/named/named.pid";
        session-keyfile "/run/named/session.key";
};

logging {
        channel default_debug {
                file "data/named.run";
                severity dynamic;
        };
};

zone "." IN {
        type hint;
        file "named.ca";
};

include "/etc/named.rfc1912.zones";  //区域配置文件
include "/etc/named.root.key";

2，编辑区域配置文件

[root@localhost ~]# vim /etc/named.rfc1912.zones 

// named.rfc1912.zones:
//
// Provided by Red Hat caching-nameserver package
//
// ISC BIND named zone configuration for zones recommended by
// RFC 1912 section 4.1 : localhost TLDs and address zones
// and http://www.ietf.org/internet-drafts/draft-ietf-dnsop-default-local-zones-02.txt
// (c)2007 R W Franks
//
// See /usr/share/doc/bind*/sample/ for example named configuration files.
//
zone "localhost.localdomain" IN {
        type master;
        file "named.localhost";
        allow-update { none; };
};      

zone "localhost" IN {
        type master;
        file "named.localhost";
        allow-update { none; };
};      

zone "1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.ip6.arpa" IN {
        type master;
        file "named.loopback";
        allow-update { none; };
};      

zone "1.0.0.127.in-addr.arpa" IN {
        type master;
        file "named.loopback";
        allow-update { none; };
};      

zone "0.in-addr.arpa" IN {
        type master;
        file "named.empty";
        allow-update { none; };
};
zone "kernel.org" IN {          //"kernel.org"为域名
        type master;            //"master"代表主域名服务器
        file "kernel.org.zone"; //"kernel.org.zone"为资源信息记录文件，在/var/named/目录下
        allow-update { none; };
};

3，编辑资源信息文件

[root@localhost ~]# cp -a  /var/named/named.localhost  /var/named/kernel.org.zone
[root@localhost ~]# vim /var/named/kernel.org.zone 

$TTL 1D
@       IN SOA  @ rname.invalid. (                        //"@"表示域名，相当于"kernel.org"可替换成"kernel.org"  "SOA"表示权威区域的开始 "rname.invalid."表示域名管理员邮箱
                                               ; serial  //区域传送序列号
                                        1D      ; refresh //从服务器更新主服务器资源的时间
                                        1H      ; retry   //"refresh"失败，重试的时间间隔
                                        1W      ; expire  //从服务器过期时长
                                        3H )    ; minimum //无效解析记录过期时长

NS ns.kernel.org.        //域名服务器记录
  ns      IN A 192.168.16.20       //域名地址记录

IN      MX   10      mail.kernel.org. //邮箱交换记录
www     IN A    192.168.16.20  //加入一条资源信息，即"www.kernel.org"和"192.168.16.20"的对应关系
mail    IN A 192.168.16.21

将DNS指向域名服务器IP地址

[root@localhost ~]# vim /etc/resolv.conf 

# Generated by NetworkManager
nameserver 192.168.16.20 //如果在其他客户端测试需要将其DNS地址更改为本域名服务器IP:"nameserver 192.168.16.20" 

关闭SELinux、firewalld，清空防火墙

[root@localhost ~]# setenforce
[root@localhost ~]# getenforce
Permissive
[root@localhost ~]# systemctl stop firewalld
[root@localhost ~]# iptables -F

三，验证DNS

在另一台客户端查询“www.kernel.org”IP地址，需要将客户端DNS改为域名服务器IP地址

[root@localhost ~]# dig www.kernel.org

; <<>> DiG 9.9.-RedHat-9.9.-.el7 <<>> www.kernel.org
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id:
;; flags: qr aa rd ra; QUERY: , ANSWER: , AUTHORITY: , ADDITIONAL: 

;; OPT PSEUDOSECTION:
; EDNS: version: , flags:; udp:
;; QUESTION SECTION:
;www.kernel.org.            IN    A

;; ANSWER SECTION:
www.kernel.org.            IN    A    192.168.16.20

;; AUTHORITY SECTION:
kernel.org.            IN    NS    ns.kernel.org.

;; ADDITIONAL SECTION:
ns.kernel.org.            IN    A    192.168.16.20

;; Query time:  msec
;; SERVER: 192.168.16.20#(192.168.16.20)
;; WHEN: Fri Feb  :: CST
;; MSG SIZE  rcvd: 

查询“kernel.org”域的邮件记录

[root@localhost ~]# dig -t mx kernel.org

; <<>> DiG 9.9.-RedHat-9.9.-.el7 <<>> -t mx kernel.org
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id:
;; flags: qr aa rd ra; QUERY: , ANSWER: , AUTHORITY: , ADDITIONAL: 

;; OPT PSEUDOSECTION:
; EDNS: version: , flags:; udp:
;; QUESTION SECTION:
;kernel.org.            IN    MX

;; AUTHORITY SECTION:
kernel.org.            IN    SOA    kernel.org. rname.invalid.     

;; Query time:  msec
;; SERVER: 192.168.16.20#(192.168.16.20)
;; WHEN: Fri Feb  :: CST
;; MSG SIZE  rcvd: