Centos 搭建named dns服务无法解析外网地址

搭建了DNS服务器来解析自定义的域名，但是在遇到非自定义的域名时，不会去自动解析。使用nslookup 会提示 ** server can't find xxxx: NXDOMAIN

网上找了说要配置DNS转发，在/etc/named.conf中配置 forward 和 forwarders，但是配完以后，确没有和想象的一样，自动拿到转发的服务器解析。最后快要奔溃时，看到论坛里有说把key相关的都注释掉，然后蛮试一下，居然可以了。只需要注释以下这行。

完整的配置文件如下：

//
// named.conf
//
// Provided by Red Hat bind package to configure the ISC BIND named(8) DNS
// server as a caching only nameserver (as a localhost DNS resolver only).
//
// See /usr/share/doc/bind*/sample/ for example named configuration files.
//

options {
        //listen-on port 53 { 127.0.0.1; };
        listen-on port 53 { 127.0.0.1;192.168.200.100; };
        //listen-on-v6 port 53 { ::1; };
        directory       "/var/named";
        dump-file       "/var/named/data/cache_dump.db";
        statistics-file "/var/named/data/named_stats.txt";
        memstatistics-file "/var/named/data/named_mem_stats.txt";
        //allow-query     { localhost; };
        allow-query     { any; };
        //allow-transfer { 202.106.0.20; };
        //allow-recursion       { 202.106.0.20; };
        forward         first;
        forwarders      { 219.141.140.10; };
        //forward               only;

        /*
         - If you are building an AUTHORITATIVE DNS server, do NOT enable recursion.
         - If you are building a RECURSIVE (caching) DNS server, you need to enable
           recursion.
         - If your recursive DNS server has a public IP address, you MUST enable access
           control to limit queries to your legitimate users. Failing to do so will
           cause your server to become part of large scale DNS amplification
           attacks. Implementing BCP38 within your network would greatly
           reduce such attack surface
        */
        recursion yes;

        dnssec-enable yes;
        dnssec-validation yes;
        dnssec-lookaside auto;

        /* Path to ISC DLV key */
        bindkeys-file "/etc/named.iscdlv.key";

        managed-keys-directory "/var/named/dynamic";

        pid-file "/run/named/named.pid";
        session-keyfile "/run/named/session.key";
};

logging {
        channel default_debug {
                file "data/named.run";
                severity dynamic;
        };
};

zone "." IN {
        type hint;
        file "named.ca";
};

include "/etc/named.rfc1912.zones";
#include "/etc/named.root.key";

当你配置的有主从dns服务器的时候，在主DNS宕机的时候，需要在内网机器中配置如下参数，不然你所有的服务器访问外网API的时候会超时，导致无法解析：

[root@dev ~]# cat /etc/resolv.conf
options timeout:1 attempts:1 rotate
nameserver 10.143.22.118
nameserver 10.143.22.116