Configuring the DNS service on Linux

Source: Internet
Author: User
Tags domain name server nslookup

I. Introduction to DNS Services

DNS is the abbreviation for the computer domain Name System or domain name Service, which consists of a parser and a domain name server. A domain name server is a domain name and corresponding IP address that holds all the hosts in the network, and a server that converts the domain name to the IP address feature.

Second, the DNS installation configuration

Preparatory work
1. Configure the installation package required by the DNS server

DNS Service Package: Bind
DNS Related libraries: Bind-libs
DNS Client: Bind-utils
Limit DNS in one directory: Bind-chroot
Firewall off: iptables-f
Close Selinux:setenforce 0
2. Edit the configuration file

Global configuration file/etc/named.conf

options {        listen-on port 53 { localhost; };      #括号内改为localhost是将本机ip监听在53端口上,也可以写上本机IP,注意最后的;号        listen-on-v6 port 53 { ::1; };        directory       "/var/named";        dump-file       "/var/named/data/cache_dump.db";        statistics-file "/var/named/data/named_stats.txt";        memstatistics-file "/var/named/data/named_mem_stats.txt";        allow-query     { any; };     #改为any是指允许任何人通过你的服务器来解析DNS,也可以指定IP。
logging {        channel default_debug {                file "data/";                severity dynamic;        };};zone "." IN {        type hint;        file "";};#上面两个就是DNS解析域名的模板,可以在下面接着写也可以写在下面的文件中/etc/named.rfc1912.zonesinclude "/etc/named.rfc1912.zones";include "/etc/named.root.key";

We write the DNS resolution domain in/etc/named.rfc1912.zones

zone "" IN {      #正向解析域名        type master;      #主域名        file "";      #域名对应的文件};zone "" IN {     #反向解析域名        type master;             file "";};

The zone database files are stored in/var/named/, which also has template files, and we can copy the template files for modification.

[[email protected] named]# cp -p named.localhost[[email protected] named]# cp -p named.localhost

Note that when the copy is added to-p because this file belongs to the group is named, no-p belongs to the group will become the current user belongs to the group, named can not access.
To edit a forward zone database configuration file

$TTL 1D@       IN SOA (                                        20132702        ; serial                                        1D      ; refresh                                        1H      ; retry                                        1W      ; expire                                        3H )    ; minimum        IN      NS     IN      A    IN      A

TTL: Lifetime refers to the cache time of this DNS on the client. BR/>1D: Cache time is 1 days
@: Reference the current domain name

SOA: Records of master-slave authentication and authorization Primary Domain Administrator Mailbox
20132702; Serial: This is a serial number, the basis for updating between master and slave.
1D; Refresh: The time of the update, how often the server proactively requests updates. 1 D represents the day
1H; Retry: The retry time is updated as soon as the update from the server fails. 1H stands for 1 hours
1W; Expire: Expiration time, which is no longer updated when there is no successful update from the server. 1 W stands for 1 weeks
3H); Minimum: Equivalent to the TTL value. Do not write by default using global configuration.
In NS record, followed by the name of the name server
NSL in A record the corresponding server address
Edit a reverse zone database file

[[email protected] named]# vim $TTL 1D@       IN SOA (                                        20132703        ; serial                                        1D      ; refresh                                        1H      ; retry                                        1W      ; expire                                        3H )    ; minimum@       NS      PTR     PTR                               

The Reverse zone database file is similar to the forward zone database file, and the difference is one more RPT record
PTR format: The preceding is the corresponding IP address, followed by the host name.

Third, testing

Restart Service
[email protected] named]# systemctl Restart named
We're testing on a different machine.
First we want to set the DNS server address:

[[email protected]~]# vim/etc/resolv.conf nameserver #把里面的内容都注释掉添加一个DNS服务器地址 [[email protected]~]# dig @; <<>> DiG 9.9.4-redhat-9.9.4-61.el7 <<>> @; Global options: +cmd;; Got answer:;; ->>header<<-opcode:query, Status:noerror, id:821; FLAGS:QR AA Rd RA; Query:1, Answer:1, Authority:1, additional:1 #aa代表的是权威, means that this parsing is parsed out by the server itself rather than by forwarding it.; OPT pseudosection:; edns:version:0, Flags:; udp:4096;;            QUESTION section:; in A;;     ANSWER 86400 in A #解析出来的A记录对应的地址;;     Authority 86400 in NS; Query time:1 msec;; server: (; when:wed 01:50:46 CST 2018;; MSG SIZE rcvd:73[[email protected]~]# nslookup #反向解析Server: name =
Four, pan domain name resolution

When we need to add DNS resolution in bulk, we can use wildcard characters to write the following

[[email protected] named]# vim$GENERATE 1-100 server$ A       3.3.3.$     #在正向域名解析中添加一条这样的记录

This adds a record from to, and the corresponding IP is from to, respectively.

[[email protected] named]# nslookup server1.lpx123.comServer:   server1.lpx123.comAddress:[[email protected] named]# nslookup server2.lpx123.comServer:   server2.lpx123.comAddress:[[email protected] named]# nslookup server100.lpx123.comServer:   server100.lpx123.comAddress:

There is a time when we have entered a W can also access to the site we want to visit, or the wrong can also access, this is the use of the pan-domain name resolution
The wording is as follows
* A

[[email protected] named]# nslookup www.lpx123.comServer:   www.lpx123.comAddress:[[email protected] named]# nslookup dns.lpx123.comServer:   dns.lpx123.comAddress:[[email protected] named]# nslookup nsl.lpx123.comServer:   nsl.lpx123.comAddress:

As long as we do not write domain names are all resolved to the host, the write is not affected.

V. DNS master/Slave

We've set up the primary DNS server, so now we just need to build another one from the DNS server.
1. We are ready to set up the environment first, install the package (IBID.)
2. Edit the global profile (same as the master configuration file)
3. Write the zone database file/etc/named.conf

options {        listen-on port 53 { localhost; };     #这里还是改为localhost        listen-on-v6 port 53 { ::1; };        directory       "/var/named";        dump-file       "/var/named/data/cache_dump.db";        statistics-file "/var/named/data/named_stats.txt";        memstatistics-file "/var/named/data/named_mem_stats.txt";        allow-query     { any; };      #这里改为any

We add the following template

zone "" IN {        type slave;     #代表为从域名        file "slaves/";     #复制主域名库文件后的存放位置        masters {; };     #主域名的IP地址};

Start the service, we will see in the/var/named/slaves directory there is a file, which is from the Domain name library file, we use another machine to see if we can parse

[[email protected] ~]# dig @; <<>> DiG 9.8.2rc1-RedHat-9.8.2-0.62.rc1.el6 <<>> @;; global options: +cmd;; Got answer:;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 32433;; flags: qr aa rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 1, ADDITIONAL: 0;; QUESTION SECTION:;            IN  A;; ANSWER     86400   IN  A;; AUTHORITY     86400   IN  NS;; Query time: 4 msec;; SERVER:;; WHEN: Thu May 24 21:03:47 2018;; MSG SIZE  rcvd: 62

Parse success
Specify the transmission machine
We found that when we set up the slave server, the master server did not agree that we had taken the server and obtained the zone library file, which was not secure for the primary DNS, so we added a designated transmission machine
Add a/etc/named.conf in the
allow-transfer {;}; #括号内填写从服务器ip地址
We use the server to get the data.

[[email protected] slaves]# dig -t axfr @; <<>> DiG 9.9.4-RedHat-9.9.4-50.el7 <<>> -t axfr @;; global options:     86400   IN  SOA 20132702 86400 3600 604800     86400   IN  NS*       86400   IN  A    86400   IN  A

The data can not be crawled with other machines, but not affected by the normal access to the domain name

[[email protected]~]# DIG-AXFR @; <<>> DiG 9.8.2rc1-redhat-9.8.2-0.62.rc1.el6 <<>>-t AXFR @; Global options: +cmd; Transfer failed. [[email protected]~]# dig @; <<>> DiG 9.8.2rc1-redhat-9.8.2-0.62.rc1.el6 <<>> @; Global options: +cmd;; Got answer:;; ->>header<<-opcode:query, Status:noerror, id:12384; FLAGS:QR AA Rd RA; Query:1, Answer:1, Authority:1, additional:0;            QUESTION section:; in A;;     ANSWER 86400 in A;     Authority 86400 in NS; Query time:1 msec;; server: (; When:thu 24 21:23:47 2018;; MSG SIZE rcvd:62

PS: We set the primary DNS, from the DNS also to do set up or others can also be from your DNS fetch data, but from the DNS if not from the parentheses from the DNS can be changed to none.

Configuring the DNS service on Linux

Contact Us

The content source of this page is from Internet, which doesn't represent Alibaba Cloud's opinion; products and services mentioned on that page don't have any relationship with Alibaba Cloud. If the content of the page makes you feel confusing, please write us an email, we will handle the problem within 5 days after receiving your email.

If you find any instances of plagiarism from the community, please send an email to: and provide relevant evidence. A staff member will contact you within 5 working days.

A Free Trial That Lets You Build Big!

Start building with 50+ products and up to 12 months usage for Elastic Compute Service

  • Sales Support

    1 on 1 presale consultation

  • After-Sales Support

    24/7 Technical Support 6 Free Tickets per Quarter Faster Response

  • Alibaba Cloud offers highly flexible support services tailored to meet your exact needs.