Back to Details

dns

Compare original and translation side by side

🇺🇸

Original

English
🇨🇳

Translation

Chinese

DNS 配置与排查

DNS 配置与排查

概述

概述

DNS 配置、解析排查、BIND/CoreDNS 等技能。
DNS 配置、解析排查、BIND/CoreDNS 等技能。

DNS 查询工具

DNS 查询工具

dig

dig

bash
undefined
bash
undefined

基础查询

基础查询

dig example.com dig example.com A dig example.com AAAA dig example.com MX dig example.com NS dig example.com TXT dig example.com ANY
dig example.com dig example.com A dig example.com AAAA dig example.com MX dig example.com NS dig example.com TXT dig example.com ANY

简短输出

简短输出

dig +short example.com
dig +short example.com

指定 DNS 服务器

指定 DNS 服务器

dig @8.8.8.8 example.com dig @1.1.1.1 example.com
dig @8.8.8.8 example.com dig @1.1.1.1 example.com

追踪解析过程

追踪解析过程

dig +trace example.com
dig +trace example.com

反向解析

反向解析

dig -x 8.8.8.8
dig -x 8.8.8.8

查询特定记录

查询特定记录

dig example.com SOA dig example.com CNAME
dig example.com SOA dig example.com CNAME

禁用递归

禁用递归

dig +norecurse example.com
undefined
dig +norecurse example.com
undefined

nslookup

nslookup

bash
undefined
bash
undefined

基础查询

基础查询

nslookup example.com nslookup example.com 8.8.8.8
nslookup example.com nslookup example.com 8.8.8.8

查询特定类型

查询特定类型

nslookup -type=mx example.com nslookup -type=ns example.com nslookup -type=txt example.com
nslookup -type=mx example.com nslookup -type=ns example.com nslookup -type=txt example.com

反向解析

反向解析

nslookup 8.8.8.8
undefined
nslookup 8.8.8.8
undefined

host

host

bash
undefined
bash
undefined

基础查询

基础查询

host example.com host -t mx example.com host -t ns example.com
host example.com host -t mx example.com host -t ns example.com

反向解析

反向解析

host 8.8.8.8
host 8.8.8.8

详细输出

详细输出

host -v example.com
undefined
host -v example.com
undefined

本地 DNS 配置

本地 DNS 配置

/etc/resolv.conf

/etc/resolv.conf

bash
undefined
bash
undefined

查看配置

查看配置

cat /etc/resolv.conf
cat /etc/resolv.conf

配置示例

配置示例

nameserver 8.8.8.8 nameserver 8.8.4.4 search example.com options timeout:2 attempts:3
nameserver 8.8.8.8 nameserver 8.8.4.4 search example.com options timeout:2 attempts:3

临时修改（可能被覆盖）

临时修改（可能被覆盖）

echo "nameserver 8.8.8.8" > /etc/resolv.conf
undefined
echo "nameserver 8.8.8.8" > /etc/resolv.conf
undefined

/etc/hosts

/etc/hosts

bash
undefined
bash
undefined

查看

查看

cat /etc/hosts
cat /etc/hosts

添加记录

添加记录

echo "192.168.1.100 myserver.local" >> /etc/hosts
echo "192.168.1.100 myserver.local" >> /etc/hosts

格式

格式

127.0.0.1 localhost 192.168.1.100 myserver myserver.local
undefined
127.0.0.1 localhost 192.168.1.100 myserver myserver.local
undefined

systemd-resolved

systemd-resolved

bash
undefined
bash
undefined

查看状态

查看状态

systemd-resolve --status resolvectl status
systemd-resolve --status resolvectl status

查询

查询

resolvectl query example.com
resolvectl query example.com

刷新缓存

刷新缓存

systemd-resolve --flush-caches resolvectl flush-caches
systemd-resolve --flush-caches resolvectl flush-caches

配置文件

配置文件

/etc/systemd/resolved.conf
undefined
/etc/systemd/resolved.conf
undefined

BIND DNS 服务器

BIND DNS 服务器

安装与管理

安装与管理

bash
undefined
bash
undefined

安装

安装

apt install bind9 bind9utils # Debian/Ubuntu yum install bind bind-utils # CentOS/RHEL
apt install bind9 bind9utils # Debian/Ubuntu yum install bind bind-utils # CentOS/RHEL

服务管理

服务管理

systemctl start named systemctl enable named systemctl status named
systemctl start named systemctl enable named systemctl status named

检查配置

检查配置

named-checkconf named-checkzone example.com /etc/bind/zones/db.example.com
undefined
named-checkconf named-checkzone example.com /etc/bind/zones/db.example.com
undefined

主配置

主配置

bash
undefined
bash
undefined

/etc/bind/named.conf.options

/etc/bind/named.conf.options

options { directory "/var/cache/bind";
forwarders {
    8.8.8.8;
    8.8.4.4;
};

dnssec-validation auto;

listen-on { any; };
listen-on-v6 { any; };

allow-query { any; };
allow-recursion { 192.168.0.0/16; 10.0.0.0/8; };

recursion yes;
};
undefined
options { directory "/var/cache/bind";
forwarders {
    8.8.8.8;
    8.8.4.4;
};

dnssec-validation auto;

listen-on { any; };
listen-on-v6 { any; };

allow-query { any; };
allow-recursion { 192.168.0.0/16; 10.0.0.0/8; };

recursion yes;
};
undefined

区域配置

区域配置

bash
undefined
bash
undefined

/etc/bind/named.conf.local

/etc/bind/named.conf.local

zone "example.com" { type master; file "/etc/bind/zones/db.example.com"; allow-transfer { 192.168.1.2; }; };
zone "1.168.192.in-addr.arpa" { type master; file "/etc/bind/zones/db.192.168.1"; };
undefined
zone "example.com" { type master; file "/etc/bind/zones/db.example.com"; allow-transfer { 192.168.1.2; }; };
zone "1.168.192.in-addr.arpa" { type master; file "/etc/bind/zones/db.192.168.1"; };
undefined

区域文件

区域文件

bash
undefined
bash
undefined

/etc/bind/zones/db.example.com

/etc/bind/zones/db.example.com

$TTL 604800 @ IN SOA ns1.example.com. admin.example.com. ( 2024011501 ; Serial 604800 ; Refresh 86400 ; Retry 2419200 ; Expire 604800 ) ; Negative Cache TTL
; Name servers @ IN NS ns1.example.com. @ IN NS ns2.example.com.
; A records @ IN A 192.168.1.10 ns1 IN A 192.168.1.1 ns2 IN A 192.168.1.2 www IN A 192.168.1.10 mail IN A 192.168.1.20
; CNAME records ftp IN CNAME www.example.com.
; MX records @ IN MX 10 mail.example.com.
undefined
$TTL 604800 @ IN SOA ns1.example.com. admin.example.com. ( 2024011501 ; Serial 604800 ; Refresh 86400 ; Retry 2419200 ; Expire 604800 ) ; Negative Cache TTL
; Name servers @ IN NS ns1.example.com. @ IN NS ns2.example.com.
; A records @ IN A 192.168.1.10 ns1 IN A 192.168.1.1 ns2 IN A 192.168.1.2 www IN A 192.168.1.10 mail IN A 192.168.1.20
; CNAME records ftp IN CNAME www.example.com.
; MX records @ IN MX 10 mail.example.com.
undefined

CoreDNS

CoreDNS

配置文件

配置文件

bash
undefined
bash
undefined

Corefile

Corefile

.:53 { forward . 8.8.8.8 8.8.4.4 cache 30 log errors }
example.com:53 { file /etc/coredns/db.example.com log errors }
undefined
.:53 { forward . 8.8.8.8 8.8.4.4 cache 30 log errors }
example.com:53 { file /etc/coredns/db.example.com log errors }
undefined

Kubernetes CoreDNS

Kubernetes CoreDNS

yaml
undefined
yaml
undefined

ConfigMap

ConfigMap

apiVersion: v1 kind: ConfigMap metadata: name: coredns namespace: kube-system data: Corefile: | .:53 { errors health { lameduck 5s } ready kubernetes cluster.local in-addr.arpa ip6.arpa { pods insecure fallthrough in-addr.arpa ip6.arpa ttl 30 } prometheus :9153 forward . /etc/resolv.conf { max_concurrent 1000 } cache 30 loop reload loadbalance }
undefined
apiVersion: v1 kind: ConfigMap metadata: name: coredns namespace: kube-system data: Corefile: | .:53 { errors health { lameduck 5s } ready kubernetes cluster.local in-addr.arpa ip6.arpa { pods insecure fallthrough in-addr.arpa ip6.arpa ttl 30 } prometheus :9153 forward . /etc/resolv.conf { max_concurrent 1000 } cache 30 loop reload loadbalance }
undefined

常见场景

常见场景

场景 1：DNS 解析排查

场景 1：DNS 解析排查

bash
undefined
bash
undefined

1. 检查本地配置

1. 检查本地配置

cat /etc/resolv.conf
cat /etc/resolv.conf

2. 测试 DNS 服务器连通性

2. 测试 DNS 服务器连通性

ping 8.8.8.8
ping 8.8.8.8

3. 查询解析

3. 查询解析

dig example.com dig @8.8.8.8 example.com
dig example.com dig @8.8.8.8 example.com

4. 追踪解析路径

4. 追踪解析路径

dig +trace example.com
dig +trace example.com

5. 检查 DNS 缓存

5. 检查 DNS 缓存

systemd-resolve --statistics
undefined
systemd-resolve --statistics
undefined

场景 2：清除 DNS 缓存

场景 2：清除 DNS 缓存

bash
undefined
bash
undefined

systemd-resolved

systemd-resolved

systemd-resolve --flush-caches
systemd-resolve --flush-caches

nscd

nscd

systemctl restart nscd
systemctl restart nscd

dnsmasq

dnsmasq

systemctl restart dnsmasq
systemctl restart dnsmasq

BIND

BIND

rndc flush
rndc flush

macOS

macOS

sudo dscacheutil -flushcache sudo killall -HUP mDNSResponder
undefined
sudo dscacheutil -flushcache sudo killall -HUP mDNSResponder
undefined

场景 3：测试 DNS 性能

场景 3：测试 DNS 性能

bash
undefined
bash
undefined

使用 dig 测试响应时间

使用 dig 测试响应时间

dig example.com | grep "Query time"
dig example.com | grep "Query time"

批量测试

批量测试

for i in {1..10}; do dig +noall +stats example.com | grep "Query time" done
for i in {1..10}; do dig +noall +stats example.com | grep "Query time" done

使用 dnsperf

使用 dnsperf

dnsperf -s 8.8.8.8 -d queries.txt
undefined
dnsperf -s 8.8.8.8 -d queries.txt
undefined

场景 4：配置内部 DNS

场景 4：配置内部 DNS

bash
undefined
bash
undefined

添加内部域名解析

添加内部域名解析

/etc/hosts

/etc/hosts

192.168.1.100 app.internal 192.168.1.101 db.internal
192.168.1.100 app.internal 192.168.1.101 db.internal

或配置 dnsmasq

或配置 dnsmasq

/etc/dnsmasq.conf

/etc/dnsmasq.conf

address=/internal/192.168.1.100 server=8.8.8.8
undefined
address=/internal/192.168.1.100 server=8.8.8.8
undefined

故障排查

故障排查

问题排查方法
解析失败检查 resolv.conf、DNS 服务器
解析慢检查 DNS 服务器响应、网络延迟
缓存问题清除本地缓存、检查 TTL
记录不存在检查区域文件、SOA 序列号
bash
undefined
问题排查方法
解析失败检查 resolv.conf、DNS 服务器
解析慢检查 DNS 服务器响应、网络延迟
缓存问题清除本地缓存、检查 TTL
记录不存在检查区域文件、SOA 序列号
bash
undefined

检查 DNS 端口

�检查 DNS 端口

ss -ulnp | grep :53 netstat -ulnp | grep :53
ss -ulnp | grep :53 netstat -ulnp | grep :53

测试 TCP/UDP

测试 TCP/UDP

dig +tcp example.com dig +notcp example.com
dig +tcp example.com dig +notcp example.com

检查 BIND 日志

检查 BIND 日志

tail -f /var/log/named/query.log journalctl -u named -f
undefined
tail -f /var/log/named/query.log journalctl -u named -f
undefined