[TOC]

一、BIND服务安装、启动

1、安装BIND

yum -y install bind*

2.启动DNS服务

#CentOS6：
service named start
#开机自启
#添加nginx服务
chkconfig --add httpd 
#开机自启nginx服务
chkconfig httpd on 
#关闭开机自启
chkconfig httpd off 
#查看
chkconfig --list | grep apache 

#CentOS7：
systemctl start named.service
#开机自启
systemctl enable named

3、查看named进程状态

ps -eaf | grep named

4、验证端口监听

netstat -an | grep 53

5.开放端口：

#firewall
firewall-cmd --zone=public --add-port=53/tcp --permanent
firewall-cmd --zone=public --add-port=53/udp --permanent
firewall-cmd --reload

#iptables
vi /etc/sysconfig/iptables
-I INPUT -p tcp --dport 53 -j ACCEPT
-I INPUT -p udp --dport 53 -j ACCEPT

service iptables restart
iptables -L -n

二、DNS服务相关配置文件

1、named.conf配置文件

(1) 位置：

named.conf 配置文件

/etc/named.conf

/etc/named.conf包含include进来的其它文件。

解析库文件

/var/named/

一般名字为：ZONE_NAME.zone

(2) 格式

# 全局配置段
options{...}
# 日志配置段
logging{...}
# 区域配置段
zone{...}

(3) 备份

cp -p /etc/named.conf /etc/named.conf.bak

(4) 修改

vim /etc/named.conf

修改内容

//
// named.conf
//
// Provided by Red Hat bind package to configure the ISC BIND named(8) DNS
// server as a caching only nameserver (as a localhost DNS resolver only).
//
// See /usr/share/doc/bind*/sample/ for example named configuration files.
//
// See the BIND Administrator's Reference Manual (ARM) for details about the
// configuration located in /usr/share/doc/bind-{version}/Bv9ARM.html

options {
        listen-on port 53 { any; };         #开放IPv4
        listen-on-v6 port 53 { any; };  #开放IPv6
        directory       "/var/named";
        dump-file       "/var/named/data/cache_dump.db";
        statistics-file "/var/named/data/named_stats.txt";
        memstatistics-file "/var/named/data/named_mem_stats.txt";
        recursing-file  "/var/named/data/named.recursing";
        secroots-file   "/var/named/data/named.secroots";
        allow-query     { any; };       #开放请求

        /* 
         - If you are building an AUTHORITATIVE DNS server, do NOT enable recursion.
         - If you are building a RECURSIVE (caching) DNS server, you need to enable 
           recursion. 
         - If your recursive DNS server has a public IP address, you MUST enable access 
           control to limit queries to your legitimate users. Failing to do so will
           cause your server to become part of large scale DNS amplification 
           attacks. Implementing BCP38 within your network would greatly
           reduce such attack surface 
        */
        recursion yes;

        dnssec-enable yes;
        dnssec-validation yes;

        /* Path to ISC DLV key */
        bindkeys-file "/etc/named.root.key";

        managed-keys-directory "/var/named/dynamic";

        pid-file "/run/named/named.pid";
        session-keyfile "/run/named/session.key";
};

logging {
        channel default_debug {
                file "data/named.run";
                severity dynamic;
        };
};

zone "." IN {
        type hint;
        file "named.ca";
};

include "/etc/named.rfc1912.zones";
include "/etc/named.root.key";

2、rfc1912.zone配置文件

(1) 位置

vim /etc/named.rfc1912.zones

(2) 格式

zone "ZONE_NAME" IN {
    type {master|slave|hint|forward};
    file "ZONE_NAME.zone";
};

示例

vim /etc/named.rfc1912.zones
# 添加如下内容
zone "test.com." IN {
    type master;
    file "test.com.zone";
};

3、建立test.com.zone数据文件

(1) 创建位置

vim /var/named/test.com.zone

(2) 格式

;$TTL 600
$ORIGIN mytest.cn.
; SOA record
; owner-name ttl class rr      name-server      email-addr  (sn ref ret ex min)
@                 IN   SOA     ns1.mytest.cn.   root.mytest.cn. (
                    2017031088 ; sn = serial number
                    3600       ; ref = refresh = 20m
                    180        ; uret = update retry = 1m
                    1209600    ; ex = expiry = 2w
                    10800      ; nx = nxdomain ttl = 3h
                    )
; type syntax
; host ttl class type data
; NS records
@  86400  IN  NS  ns1.mytest.cn.
@  86400  IN  NS  ns2.mytest.cn.
; A records
ns1  600  IN  A  10.10.8.1
ns2  600  IN  A  10.10.8.2

| 项目 | 说明 |
| :-: | :-- |
| TTL指令定义默认的TTL值。|

示例

$TTL 3600
$ORIGIN test.com.
@       IN      SOA     test.com.  admin.test.com. (
                2017011901
                1H
                10M
                3D
                1D)
                
@       IN      NS      ns1.test.com.
@       IN      MX  10  mail.test.com.
ns1     IN      A       22.22.22.22
mail    IN      A       22.22.22.22
www     IN      A       22.22.22.22
bbs     IN      A       22.22.22.22
bbs     IN      A       22.22.22.22

(3)修改权限

#   进入zone文件目录
cd /var/named
# 修改区域文件的属组为named用户
chown :named /var/named/test.com.zone
chgrp named /var/named/test.com.zone
# 修改区域文件的权限为640
chmod 640 /var/named/test.com.zone

(4)检查语法

使用named-checkconf命令：

named-checkzone test.com. /var/named/test.com.zone

    zone test.com/IN: loaded serial 2017011901
    OK

(5)重载

rndc reload
#centos6
service named reload
service named restart
#server reload successful
#或者执行
systemctl reload named.service
systemctl restart named.service

三、正向区域测试

dig test.com @10.3.3.211
dig -t A www.test.com @10.3.3.211
dig -t NS test.com @10.3.3.211