这篇文章是对之前博客写的DNS的再深一层的搭建，其中包括搭建私有根，还有顶级域以及授权子域，转发域，反向解析等等
上一篇DNS的博客链接：http://www.cnblogs.com/hjc4025/p/6708314.html
这是我自己用word画的图片，比较难看，但大体阐述了我搭建的层次
在以下的内容中都是笔者自己对DNS的理解，可能会有一定的错误
一：搭建平台及IP选定：
在VMware上使用的Centos6.7 64位
bind：使用的BIND9.8版本
.（根）：192.168.32.199
.com：192.168.32.150
hanjiacheng.com的主：192.168.32.128
hanjiacheng.com的从：192.168.32.129
fin.hanjiacheng.com：192.168.32.130
里面的一些没用授权的子域名对应的IP，都是笔者自己瞎写测试用的。
二：配置文件：
1. 根的配置文件
.(根)的named.conf文件：
options {
directory "/var/named";
allow-recursion { 192.168.32.0/24; };
};
zone "." IN {
type master;
file "named.zone";
};
zone "32.168.192.in-addr.arpa" IN {
type master;
file "192.168.32.zone";
};
zone "localhost" IN {
type master;
file "named.localhost";
};
zone "0.0.127.in-addr.arpa" IN {
type master;
file "named.loopback";
};
.（根）的/var/named/named.zone文件
$TTL 600
. IN SOA ns.root ns.root (
1
1H
5M
2D
6H )
. IN NS ns.root.
ns.root IN A 192.168.32.199
net IN A 192.168.32.233
com IN NS ns.com
ns.com IN A 192.168.32.150
.(根)的/var/named/192.168.32.zone文件
$TTL 600
@ IN SOA ns.root ns.root (
1
1H
5M
2D
6H )
IN NS ns.root.
IN NS ns.com.
199 IN PTR ns.root.
150 IN PTR ns.com.
233 IN PTR net
2. .com的配置
.com的配置文件named.conf
options {
directory "/var/named";
allow-recursion { 192.168.32.0/24; };
};
zone "." IN {
type hint;
file "named.ca";
};
zone "localhost" IN {
type master;
file "named.localhost";
};
zone "0.0.127.in-addr.arpa" IN {
type master;
file "named.loopback";
};
zone "com" IN {
type master;
file "com.zone";
};
zone "32.168.192.in-addr.arpa" IN {
type master;
file "192.168.32.zone";
};
.com的/var/named/com.zone：
$TTL 600
com. IN SOA ns admin.com. (
1
1H
5M
2D
6H )
com. IN NS ns.com.
ns IN A 192.168.32.150
jiachenghan IN A 192.168.32.188
hanjiacheng IN NS ns1.hanjiacheng
ns1.hanjiacheng IN A 192.168.32.128
.com的/var/named/192.168.32.zone:
$TTL 600
@ IN SOA ns admin.com. (
1
1H
5M
2D
6H )
IN NS ns.com.
IN NS ns1.hanjiacheng.com.
150 IN PTR ns.com.
128 IN PTR ns1.hanjiacheng.com.
188 IN PTR jiachenghan.com.
3. hanjiacheng.com的配置文件：
hanjiacheng.com（主域名服务器）的主配置文件named.conf：
options {
directory "/var/named";
allow-recursion { 192.168.32.0/24; };
};
zone "." IN {
type hint;
file "named.ca";
};
zone "localhost" IN {
type master;
file "named.localhost";
allow-transfer { none; };
};
zone "0.0.127.in-addr.arpa" IN {
type master;
file "named.loopback";
allow-transfer { none; };
};
zone "hanjiacheng.com" IN {
type master;
file "hanjiacheng.com.zone";
allow-transfer { 192.168.32.129; };
};
zone "32.168.192.in-addr.arpa" IN {
type master;
file "192.168.32.zone";
allow-transfer { 192.168.32.129; };
};
zone "com" IN {
type forward;
forward only;
forwarders { 192.168.32.150; };
};
hanjiacheng.com（主域名服务器）的区域文件：/var/named/hanjiacheng.com.zone
$TTL 600 hanjiacheng.com. IN SOA ns1 admin.hanjiacheng.com. ( 3 1H 5M 2D 6H ) hanjiacheng.com. IN NS ns1.hanjiacheng.com. hanjiacheng.com. IN NS ns2.hanjiacheng.com. hanjiacheng.com. IN MX 10 mail.hanjiacheng.com. ns1 IN A 192.168.32.128 ns2 IN A 192.168.32.129 mail IN A 192.168.32.77 www IN A 192.168.32.78 ftp IN CNAME www hehe IN A 192.168.32.222 fin IN NS ns1.fin ns1.fin IN A 192.168.32.130
hanjiacheng.com（主域名服务器）的区域文件：/var/named/192.168.32.zone
$TTL 600 @ IN SOA ns1 admin.hanjiacheng.com. ( 3 1H 5M 2D 6H ) IN NS ns1.hanjiacheng.com. IN NS ns2.hanjiacheng.com. IN NS ns1.fin.hanjiacheng.com. 128 IN PTR ns1.hanjiacheng.com. 129 IN PTR ns2.hanjiacheng.com. 130 IN PTR ns1.fin.hanjiacheng.com. 77 IN PTR mail.hanjiacheng.com. 78 IN PTR www.hanjiacheng.com. 78 IN PTR ftp.hanjiacheng.com.
hanjiacheng.com（从域名服务器）的主配置文件named.conf：
options {
directory "/var/named";
allow-recursion { 192.168.32.0/24; };
};
zone "." IN {
type hint;
file "named.ca";
};
zone "localhost" IN {
type master;
file "named.localhost";
allow-transfer { none; };
};
zone "0.0.127.in-addr.arpa" IN {
type master;
file "named.loopback";
allow-transfer { none; };
};
zone "hanjiacheng.com" IN {
type slave;
file "slaves/hanjiacheng.com.zone";
masters { 192.168.32.128; };
allow-transfer { none; };
};
zone "32.168.192.in-addr.arpa" IN {
type slave;
file "slaves/192.168.32.zone";
masters { 192.168.32.128; };
allow-transfer { none; };
};
zone "com" IN {
type forward;
forward only;
forwarders { 192.168.32.150; };
};
hanjiacheng.com（域名服务器）的区域文件都是从主服务器上传送过来的，所以不需要配置区域文件
4.fin.hanjiacheng.com的配置：
fin.hanjiacheng.com的主配置文件/etc/named.conf
options {
directory "/var/named";
allow-recursion { 192.168.32.0/24; };
};
zone "." IN {
type hint;
file "named.ca";
};
zone "localhost" IN {
type master;
file "named.localhost";
};
zone "0.0.127.in-addr.arpa" IN {
type master;
file "named.loopback";
};
zone "fin.hanjiacheng.com" IN {
type master;
file "fin.hanjiacheng.com";
};
zone "32.168.192.in-addr.arpa" IN {
type master;
file "192.168.32.zone";
};
zone "hanjiacheng.com" IN {
type forward;
forward first;
forwarders { 192.168.32.128;192.168.32.129; };
};
fin.hanjiacheng.com的区域配置文件/var/named/fin.hanjiacheng.com
$TTL 600 fin.hanjiacheng.com. IN SOA ns1 admin.fin.hanjiacheng.com. ( 2 1H 5M 2D 6H ) fin.hanjiacheng.com. IN NS ns1.fin.hanjiacheng.com. fin.hanjiacheng.com. IN MX 10 mail.fin.hanjiacheng.com. ns1 IN A 192.168.32.130 mail IN A 192.168.32.22 www IN A 192.168.32.33 ftp IN CNAME www kkk IN A 192.168.32.123
fin.hanjiacheng.com的区域配置文件/var/named/192.168.32.zone
$TTL 600
@ IN SOA ns1 admin.fin.hanjiacheng.com. (
1
1H
5M
2D
6H )
IN NS ns1.fin.hanjiacheng.com.
130 IN PTR ns1.fin.hanjiacheng.com.
22 IN PTR mail.fin.hanjiacheng.com.
33 IN PTR www.fin.hanjiacheng.com.
33 IN PTR ftp.fin.hanjiacheng.com.
5.至此配置文件就都写完了，这里一定要注意既然我们建立了私有的根域，那么一定要在每台机器上的/var/named/named.ca清空，并填写上自己的私有的根信息
使用命令：dig -t NS . @192.168.32.199 > /var/named/named.ca
这样即可，这里的信息应该如下：
; <<>> DiG 9.8.2rc1-RedHat-9.8.2-0.62.rc1.el6_9.2 <<>> -t NS . @192.168.32.199 ;; global options: +cmd ;; Got answer: ;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 28617 ;; flags: qr aa rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 1 ;; QUESTION SECTION: ;. IN NS ;; ANSWER SECTION: . 600 IN NS ns.root. ;; ADDITIONAL SECTION: ns.root. 600 IN A 192.168.32.199 ;; Query time: 1 msec ;; SERVER: 192.168.32.199#53(192.168.32.199) ;; WHEN: Sat May 27 00:51:44 2017 ;; MSG SIZE rcvd: 53
还要注意的一点就是一定要将每台机器的/etc/resolv.conf的文件里的nameserver地址更改成自己的ip地址
除此关闭防火墙，关闭selinux等一切不确定因素，并依此重启DNS服务器，每台机器执行service named restart
三、测试
下面我们随便找了一台测试机器，观察一下dig的情况：（@后面的地址可以随意的变更）
例如：
[root@localhost ~]# dig +trace -t A www.fin.hanjiacheng.com @192.168.32.128 ; <<>> DiG 9.8.2rc1-RedHat-9.8.2-0.62.rc1.el6_9.2 <<>> +trace -t A www.fin.hanjiacheng.com @192.168.32.128 ;; global options: +cmd . 600 IN NS ns.root. ;; Received 37 bytes from 192.168.32.128#53(192.168.32.128) in 9 ms com. 600 IN NS ns.com. ;; Received 74 bytes from 192.168.32.199#53(192.168.32.199) in 4 ms hanjiacheng.com. 600 IN NS ns1.hanjiacheng.com. ;; Received 75 bytes from 192.168.32.150#53(192.168.32.150) in 8 ms fin.hanjiacheng.com. 600 IN NS ns1.fin.hanjiacheng.com. ;; Received 75 bytes from 192.168.32.128#53(192.168.32.128) in 7 ms www.fin.hanjiacheng.com. 600 IN A 192.168.32.33 fin.hanjiacheng.com. 600 IN NS ns1.fin.hanjiacheng.com. ;; Received 91 bytes from 192.168.32.130#53(192.168.32.130) in 1 ms
例如：
[root@localhost ~]# dig -t A www.fin.hanjiacheng.com @192.168.32.150 ; <<>> DiG 9.8.2rc1-RedHat-9.8.2-0.62.rc1.el6_9.2 <<>> -t A www.fin.hanjiacheng.com @192.168.32.128 ;; global options: +cmd ;; Got answer: ;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 33879 ;; flags: qr rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 1, ADDITIONAL: 1 ;; QUESTION SECTION: ;www.fin.hanjiacheng.com. IN A ;; ANSWER SECTION: www.fin.hanjiacheng.com. 318 IN A 192.168.32.33 ;; AUTHORITY SECTION: fin.hanjiacheng.com. 318 IN NS ns1.fin.hanjiacheng.com. ;; ADDITIONAL SECTION: ns1.fin.hanjiacheng.com. 318 IN A 192.168.32.130 ;; Query time: 1 msec ;; SERVER: 192.168.32.128#53(192.168.32.128) ;; WHEN: Sat May 27 05:41:29 2017 ;; MSG SIZE rcvd: 91
随便测试几个就好
以上内容可能有部分错误的情况，请大家谅解，我也是个菜鸟，都是自己琢磨的，估计有很多不对的地方。