配置解析一個正向區域：
1、定義區域
在主配置文件中（/etc/named.conf）或主配置文件輔助配置文件（/etc/named.rfc1912.conf）中實現：
(1) 在/etc/named.rfc1912.cnof中實現
[root@pxe120 named]# vim /etc/named.rfc1912.zones
type master;
file “named.loopback”;
allow-update { none; };
};
zone “0.in-addr.arpa” IN {
type master;
file “named.empty”;
allow-update { none; };
};
zone “ilinux.io” IN {
type master;
file “ilinux.io.zone”;
};
注意寫入的時候一定要加“；”號
(2) 在/etc/named.conf中實現
[root@pxe120 named]# vim /etc/named.conf
options {
listen-on port 53 { 0.0.0.0; }; 此行需要將后面的地址改為 0.0.0.0；（注意0前的空格和“；”號后的空格）
listen-on-v6 port 53 { ::1; };
directory “/var/named”;
dump-file “/var/named/data/cache_dump.db”;
statistics-file “/var/named/data/named_stats.txt”;
memstatistics-file “/var/named/data/named_mem_stats.txt”;
//allow-query { localhost; }; 此行需要注釋掉或將花括號內更改為{ any； } （注意輸入空格和“；”號）
/*
– If you are building an AUTHORITATIVE DNS server, do NOT enable recursion.
– If you are building a RECURSIVE (caching) DNS server, you need to enable
recursion.
– If your recursive DNS server has a public IP address, you MUST enable access
control to limit queries to your legitimate users. Failing to do so will
cause your server to become part of large scale DNS amplification
attacks. Implementing BCP38 within your network would greatly
reduce such attack surface
*/
recursion yes;
//dnssec-enable yes; 此行需要注釋掉，用//
//dnssec-validation yes; 此行需要注釋掉，用//
/* Path to ISC DLV key */
bindkeys-file “/etc/named.iscdlv.key”;
managed-keys-directory “/var/named/dynamic”;
pid-file “/run/named/named.pid”;
session-keyfile “/run/named/session.key”;
};
logging {
channel default_debug {
file “data/named.run”;
severity dynamic;
};
};
zone “.” IN {
type hint;
file “named.ca”;
};
include “/etc/named.rfc1912.zones”;
include “/etc/named.root.key”;
2、建立區域數據文件（主要記錄為A或AAAA記錄）在/var/named目錄下建立區域數據文件；
# vim /var/named/ilinux.io.zone
$TTL 600
ilinux.io. IN SOA ilinux.io. nsadmin.ilinux.io. (
2017052301
1H
5M
1W
6H )
IN NS dns1.ilinux.io.
IN NS dns2.ilinux.io. 此行若沒有其他可以不寫
IN MX 10 mail
dns1.ilinux.io. IN A 172.16.253.120 此處IP地址為本地IP
dns2.ilinux.io. IN A 172.16.253.121 此行沒有其他的可以不寫
www.ilinux.io. IN A 172.16.0.1
web IN CNAME www
ftp IN A 172.16.0.2
mail IN A 172.16.0.3
（注意加”.” ，不加就意味著詞句是可以自動補全的）
3、檢查語法錯誤
named-checkconf
named-checkzone “ilinux.io” ilinux.io.zone
4、權限及屬組修改：
chown :named ilinux.io.zone
chmod o= /var/named/ilinux.io.zone
5、讓服務器重載配置文件和區域數據文件
rndc reload
配置解析一個反向區域
1、定義區域
在主配置文件中（/etc/named.conf）或主配置文件輔助配置文件（/etc/named.rfc1912.conf）中實現：
(1) 在/etc/named.rfc1912.cnof中實現
# vim /etc/named.rfc1912.zones
type master;
file “named.loopback”;
allow-update { none; };
};
zone “0.in-addr.arpa” IN {
type master;
file “named.empty”;
allow-update { none; };
};
zone “ilinux.io” IN {
type master;
file “ilinux.io.zone”;
};
zone “16.172.in-addr.arpa” IN { 注意：反向區域的名字反寫的網段地址 16.172.in-addr.arpa
type master;
file “172.16.zone”;
};
2、定義區域解析庫文件（主要記錄為PTR）
創建：在/var/named目錄下創建172.16.zone
$TTL 1200
@ IN SOA ilinux.io. nsadmin.ilinux.io. (
2017052301
3H
20M
1W
1D )
@ IN NS dns1.ilinux.io.
@ IN NS dns2.ilinux.io.
120.253 IN PTR dns1.ilinux.io.
121.253 IN PTR dns2.ilinux.io.
1.0 IN PTR www.ilinux.io.
注意事項與正向相同
3、檢查語法錯誤
named-checkconf
named-checkzone “1.0.16.172.in-addr.arpa” 172.16.zone
4、權限及屬組修改：
chown :named 172.16.zone
chmod o= /var/named/172.16.zone
5、讓服務器重載配置文件和區域數據文件
rndc reload
或 systemctl reload name.service
主從服務器配置（需要在兩臺或多臺服務器上操作）
1、同步時間（如果時間不同步后續會產生不必要的一些麻煩）
$ ntpdate NTP_SERVER
因為在上面的實驗里，我們已經配置好了一臺具有DNS解析功能的服務器了，所以我們就把那一臺機器作為主服務器使用。
配置從服務器
2、使用yum 安裝bind
3、修改配置文件
# vim /etc/named.conf
ptions {
// listen-on port 53 { 127.0.0.1; }; 將此行用//注釋掉
listen-on-v6 port 53 { ::1; };
memstatistics-file “/var/named/data/named_mem_stats.txt”;
allow-query { any; }; 將花括號內更改為any
dnssec-enable no; 將yes更改為no
dnssec-validation no; 將yes更改為no
4、定義一個從域
# vim /etc/named.rfc1912.zones
zone “ilinux.io” IN {
type slave;
file “slaves/ilinux.io.zone”;
masters { 172.16.253.120; };
};
zone “16.172.in-addr.apra” IN {
type slave;
file “slaves/172.16.zone”;
masters { 172.16.253.120; };
};
檢查語法： named-checkconf
開啟服務：systemctl start named.service
測試：dig -t A www.ilinux.io @172.16.251.5
; <<>> DiG 9.9.4-RedHat-9.9.4-29.el7 <<>> -t A www.ilinux.io @172.16.251.5
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 45865
;; flags: qr aa rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 2, ADDITIONAL: 3
;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 4096
;; QUESTION SECTION:
;www.ilinux.io. IN A
;; ANSWER SECTION:
www.ilinux.io. 600 IN A 172.16.0.1
;; AUTHORITY SECTION:
ilinux.io. 600 IN NS dns1.ilinux.io.
ilinux.io. 600 IN NS dns2.ilinux.io.
;; ADDITIONAL SECTION:
dns1.ilinux.io. 600 IN A 172.16.253.120
dns2.ilinux.io. 600 IN A 172.16.253.121
;; Query time: 2 msec
;; SERVER: 172.16.251.5#53(172.16.251.5)
;; WHEN: Fri May 26 17:12:17 CST 2017
;; MSG SIZE rcvd: 128
dig -t NS ilinux.io @172.16.251.5
; <<>> DiG 9.9.4-RedHat-9.9.4-29.el7 <<>> -t NS ilinux.io @172.16.251.5
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 652
;; flags: qr aa rd ra; QUERY: 1, ANSWER: 2, AUTHORITY: 0, ADDITIONAL: 3
;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 4096
;; QUESTION SECTION:
;ilinux.io. IN NS
;; ANSWER SECTION:
ilinux.io. 600 IN NS dns1.ilinux.io.
ilinux.io. 600 IN NS dns2.ilinux.io.
;; ADDITIONAL SECTION:
dns1.ilinux.io. 600 IN A 172.16.253.120
dns2.ilinux.io. 600 IN A 172.16.253.121
;; Query time: 1 msec
;; SERVER: 172.16.251.5#53(172.16.251.5)
;; WHEN: Fri May 26 18:07:19 CST 2017
;; MSG SIZE rcvd: 108
子域授權
在主DNS服務器上進行授權
1、將以下內容添加到ilinux.io.zone
# vim /var/named/ilinux.io.zone
ops.ilinux.com. IN NS dns1.ops.ilinux.io
ops.ilinux.com. IN NS dns2.ops.ilinux.io
dns1.ops.ilinux.com. IN A 172.16.251.5
dns2.ops.ilinux.com. IN A 172.16.251.6
2、在子域DNS服務器上配置
使用yum安裝bind
修改配置文件
# vim /etc/named.conf
options {
// listen-on port 53 { 127.0.0.1; }; 使用//注釋掉此行
listen-on-v6 port 53 { ::1; };
dump-file “/var/named/data/cache_dump.db”;
statistics-file “/var/named/data/named_stats.txt”;
memstatistics-file “/var/named/data/named_mem_stats.txt”;
allow-query { any; }; 將括號內的內容更改為any
dnssec-enable no; 將此行與下一行的yes更改為no
dnssec-validation no;
3、在/etc/named.rfc1912.zones中添加子域信息
# vim /etc/named.rfc1912.zones
zone “ops.ilinux.com” IN {
type master;
file “ops.ilinux.zone”;
};
4、定義子域解析庫：
# vim /var/named/ops.ilinux.zone
$TTL 300
@ IN SOA ilinux.com. nsadmin.ilinux.com. (
2017052301
1H
2M
3D
1D )
IN NS dns1.ops.ilinux.com.
IN NS dns2.ops.ilinux.com.
dns1 IN A 172.16.251.5
dns2 IN A 172.16.251.6
www IN A 172.16.251.13
5、配置完成后測試：
# systemctl restart named
通過本機解析本域主機名
# host -t A www.ops.ilinux.com 172.16.251.5
Using domain server:
Name: 172.16.251.5
Address: 172.16.251.5#53
Aliases:
www.ops.ilinux.com has address 172.16.251.13
原創文章，作者：木，如若轉載，請注明出處：http://www.www58058.com/76827
