关于在Linux下如何搭建DNS服务器

yum -y install bind

vim /etc/named.conf

listen-on port 53 { any; };

allow-query { any; };

//
// named.conf
//
// Provided by Red Hat bind package to configure the ISC BIND named(8) DNS
// server as a caching only nameserver (as a localhost DNS resolver only).
//
// See /usr/share/doc/bind*/sample/ for example named configuration files.
//
// See the BIND Administrator's Reference Manual (ARM) for details about the
// configuration located in /usr/share/doc/bind-{version}/Bv9ARM.html

options {
        listen-on port 53 { any; };
        # listen-on port 53 { 127.0.0.1; };
        listen-on-v6 port 53 { ::1; };
        directory       "/var/named";
        dump-file       "/var/named/data/cache_dump.db";
        statistics-file "/var/named/data/named_stats.txt";
        memstatistics-file "/var/named/data/named_mem_stats.txt";
        recursing-file  "/var/named/data/named.recursing";
        secroots-file   "/var/named/data/named.secroots";
        allow-query     { any; };
        # allow-query     { localhost; };

        /* 
         - If you are building an AUTHORITATIVE DNS server, do NOT enable recursion.
         - If you are building a RECURSIVE (caching) DNS server, you need to enable 
           recursion. 
         - If your recursive DNS server has a public IP address, you MUST enable access 
           control to limit queries to your legitimate users. Failing to do so will
           cause your server to become part of large scale DNS amplification 
           attacks. Implementing BCP38 within your network would greatly
           reduce such attack surface 
        */
        recursion yes;

        dnssec-enable yes;
        dnssec-validation yes;

        /* Path to ISC DLV key */
        bindkeys-file "/etc/named.root.key";

        managed-keys-directory "/var/named/dynamic";

        pid-file "/run/named/named.pid";
        session-keyfile "/run/named/session.key";
};

logging {
        channel default_debug {
                file "data/named.run";
                severity dynamic;
        };
};

zone "." IN {
        type hint;
        file "named.ca";
};

include "/etc/named.rfc1912.zones";
include "/etc/named.root.key";

vim /etc/named.rfc1912.zones

zone "aec.starnetuc.com" IN {             #正向解析为"aec.starnetuc.com"
        type master;                      #类型：主缓存为master
        file "aec.starnetuc.com.zone";    #指定区域数据文件为aec.starnetuc.com.zone
        allow-update { none; };
};

cp -a /var/named/named.localhost /var/named/aec.starnetuc.com.zone

$TTL 1D  	#有效解析记录的生成周期
@       IN SOA  aec.starnetuc.com. root.aec.starnetuc.com. (
#@表示当前的DNS区域名表示这个域名  
#SOA表示授权信息开启 
# 后面表示邮件地址因为@有特殊含义 所以使用.代替 
                                        0       ; serial  #更新序列号，可以是10以内的整数
                                        1D      ; refresh #刷新时间，重新下载地址数据的间隔
                                        1H      ; retry   #重试延迟，下载失败后的重试延迟
                                        1W      ; expire  #失效时间，超过该时间仍无法下载则放弃
                                        3H )    ; minimum #无效解析记录的生存周期
        IN      NS      aec.starnetuc.com. #记录当前区域DNS服务器的名称
        IN      MX 10   aec.starnetuc.com. #MX为邮件服务器 10表示优先级 数字越大优先级越低
        IN      A       10.27.106.214      #记录正向解析域名对应的IP，即将域名与IP绑捆

named-checkconf -z /etc/named.conf

zone localhost.localdomain/IN: loaded serial 0
zone localhost/IN: loaded serial 0
zone 1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.ip6.arpa/IN: loaded serial 0
zone 1.0.0.127.in-addr.arpa/IN: loaded serial 0
zone 0.in-addr.arpa/IN: loaded serial 0
zone aec.starnetuc.com/IN: loaded serial 0

systemctl start named
systemctl enable named

ping aec.starnetuc.com

PING aec.starnetuc.com (10.27.106.214) 56(84) bytes of data.
64 bytes from 10.27.106.214 (10.27.106.214): icmp_seq=1 ttl=64 time=1024 ms
64 bytes from 10.27.106.214 (10.27.106.214): icmp_seq=2 ttl=64 time=4.31 ms
64 bytes from 10.27.106.214 (10.27.106.214): icmp_seq=3 ttl=64 time=5.53 ms