17-Linux学习之旅之DNS域名系统基本认知

Linux学习之旅之DNS域名系统基本认知

一、DNS 域名系统

1、什么是dns

DNS（Domain Name System，域名系统），是互联网的地址翻译系统。 作用：把人类好记的域名（如 www.baidu.com）翻译成计算机能识别的IP 地址（如 180.101.49.11），实现上网访问。

2、查询流程

豆包生成仅供参考

3、DNS记录类型

4、本地hosts文件

#linux存放位置
[root@rockydesk ~]# cat /etc/hosts
127.0.0.1 localhost localhost.localdomain localhost4 localhost4.localdomain4
::1 localhost localhost.localdomain localhost6 localhost6.localdomain6
10.0.0.6 xyx.com
[root@rockydesk ~]#

#Windows存放位置：C:\\Windows\\System32\\drivers\\etc\\hosts

6、常见dns查询命令

dig：最详细的DNS查询工具

#基本查询
[root@rockydesk ~]# dig jd.com A

; <<>> DiG 9.18.33 <<>> jd.com A
;; global options: +cmd
;; Got answer:
;; –>>HEADER<<- opcode: QUERY, status: NOERROR, id: 59564
;; flags: qr rd ra; QUERY: 1, ANSWER: 4, AUTHORITY: 5, ADDITIONAL: 5

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 1232
;; QUESTION SECTION:
;jd.com. IN A

;; ANSWER SECTION:
jd.com. 600 IN A 211.144.24.218
jd.com. 600 IN A 111.13.149.108
jd.com. 600 IN A 211.144.27.126
jd.com. 600 IN A 106.39.171.134

;; AUTHORITY SECTION:
jd.com. 166415 IN NS ns4.jdcache.com.
jd.com. 166415 IN NS ns1.jdcache.com.
jd.com. 166415 IN NS ns5.jdcache.com.
jd.com. 166415 IN NS ns2.jdcache.com.
jd.com. 166415 IN NS ns3.jdcache.com.

;; ADDITIONAL SECTION:
ns1.jdcache.com. 55985 IN A 111.13.28.10
ns2.jdcache.com. 55881 IN A 111.206.226.10
ns3.jdcache.com. 57298 IN A 120.52.149.254
ns4.jdcache.com. 56526 IN A 106.39.177.32

;; Query time: 5 msec
;; SERVER: 218.85.152.99#53(218.85.152.99) (UDP)
;; WHEN: Wed Aug 05 10:10:47 CST 2026
;; MSG SIZE rcvd: 264

#精简查询
[root@rockydesk ~]# dig jd.com +short
111.13.149.108
211.144.27.126
211.144.24.218
106.39.171.134

#指定阿里云dns查询
[root@rockydesk ~]# dig @223.5.5.5 jd.com +short
211.144.24.218
106.39.171.134
111.13.149.108
211.144.27.126

nslookup 简单查询

#基本查询
[root@rockydesk ~]# nslookup qq.com
Server: 218.85.152.99
Address: 218.85.152.99#53

Non-authoritative answer:
Name: qq.com
Address: 123.150.76.218
Name: qq.com
Address: 113.108.81.189

#指定dns查询
[root@rockydesk ~]# nslookup qq.com 223.5.5.5
Server: 223.5.5.5
Address: 223.5.5.5#53

Non-authoritative answer:
Name: qq.com
Address: 123.150.76.218
Name: qq.com
Address: 113.108.81.189

host 简洁输出

#基本查询
[root@rockydesk ~]# host qq.com
qq.com has address 113.108.81.189
qq.com has address 123.150.76.218
qq.com mail is handled by 20 mx2.qq.com.
qq.com mail is handled by 30 mx1.qq.com.
qq.com mail is handled by 10 mx3.qq.com.

#查询主域名的A记录（IPv4地址）
[root@rockydesk ~]# host -t A qq.com
qq.com has address 123.150.76.218
qq.com has address 113.108.81.189

# 查询MX邮件交换记录（邮件服务器）
[root@rockydesk ~]# host -t MX qq.com
qq.com mail is handled by 30 mx1.qq.com.
qq.com mail is handled by 20 mx2.qq.com.
qq.com mail is handled by 10 mx3.qq.com.

# 查询SOA授权起始记录（区域权威信息）
[root@rockydesk ~]# host -t SOA qq.com
qq.com has SOA record ns1.qq.com. webmaster.qq.com. 1330914143 3600 300 86400 300
[root@rockydesk ~]#

#指定dns查询
[root@rockydesk ~]# host qq.com 223.5.5.5
Using domain server:
Name: 223.5.5.5
Address: 223.5.5.5#53
Aliases:

qq.com has address 113.108.81.189
qq.com has address 123.150.76.218
qq.com mail is handled by 30 mx1.qq.com.
qq.com mail is handled by 20 mx2.qq.com.
qq.com mail is handled by 10 mx3.qq.com.
[root@rockydesk ~]#

二、部署DNS和配置

1、安装和启动DNS

[root@rockydesk ~]# dnf -y install bind bind-utils
root@rockydesk ~]# systemctl enable –now named.service

2、修改主配置文档

[root@rockydesk ~]# vim /etc/named.conf
[root@rockydesk ~]# cat /etc/named.conf
options {
listen-on port 53 { any; };#将127.0.0.1改为any，监听任意ip53端口
listen-on-v6 port 53 { ::1; };
directory "/var/named";
dump-file "/var/named/data/cache_dump.db";
statistics-file "/var/named/data/named_stats.txt";
memstatistics-file "/var/named/data/named_mem_stats.txt";
secroots-file "/var/named/data/named.secroots";
recursing-file "/var/named/data/named.recursing";
allow-query { any; }; #将localhost改为any，允许任意客户端查询

[root@rockydesk ~]#

3、配置政协解析

配置正向解析区域声明 xyx.com

[root@rockydesk ~]# vim /etc/named.rfc1912.zones
[root@rockydesk ~]# tail -7 /etc/named.rfc1912.zones
zone "xyx.com" IN { # 声明区域
type master; # 类型为 master
file "xyx.com.zone"; # 区域文件
allow-update { none; }; # 禁止更新（可选）
};

配置正向解析区域文件 xyx.com.zone

; 代表注释
[root@rockydesk ~]# vim /var/named/xyx.com.zone
[root@rockydesk ~]# cat /var/named/xyx.com.zone
; ============================================================
; 文件名: /var/named/xyx.com.zone
; 域名: xyx.com 正向解析区域文件
; 维护人: xyx
; 最后修改: 2026-08-05
; ===========================================================

$TTL 36800
@ IN SOA ns1.xyx.com. admin.xyx.com. (
2026080501 3600 1800 327680 43990
)
@ IN NS ns1.xyx.com.
@ IN A 10.0.0.6
ns1 IN A 10.0.0.6
myy IN A 10.0.0.9
xyy IN A 10.0.0.10
ubt2604ser IN A 10.0.0.4

4、验证和启动

#检查主配置文件语法
[root@rockydesk ~]# named-checkconf /etc/named.conf

#检查区域文件语法
[root@rockydesk ~]# named-checkzone xyx.com /var/named/xyx.com.zone
zone xyx.com/IN: loaded serial 2026080501
OK

#上面安装时以及启动，我这边重新加载配置文件
[root@rockydesk ~]# systemctl reload named.service

#验证53端口
[root@rockydesk ~]# ss -tunlp |grep :53
udp UNCONN 0 0 10.0.0.6:53 0.0.0.0:* users:(("named",pid=3943,fd=41))
udp UNCONN 0 0 10.0.0.6:53 0.0.0.0:* users:(("named",pid=3943,fd=40))
udp UNCONN 0 0 127.0.0.1:53 0.0.0.0:* users:(("named",pid=3943,fd=25))
udp UNCONN 0 0 127.0.0.1:53 0.0.0.0:* users:(("named",pid=3943,fd=26))
udp UNCONN 0 0 [::1]:53 [::]:* users:(("named",pid=3943,fd=32))
udp UNCONN 0 0 [::1]:53 [::]:* users:(("named",pid=3943,fd=31))
tcp LISTEN 0 10 127.0.0.1:53 0.0.0.0:* users:(("named",pid=3943,fd=29))
tcp LISTEN 0 10 127.0.0.1:53 0.0.0.0:* users:(("named",pid=3943,fd=27))
tcp LISTEN 0 10 10.0.0.6:53 0.0.0.0:* users:(("named",pid=3943,fd=43))
tcp LISTEN 0 10 10.0.0.6:53 0.0.0.0:* users:(("named",pid=3943,fd=42))
tcp LISTEN 0 10 [::1]:53 [::]:* users:(("named",pid=3943,fd=33))
tcp LISTEN 0 10 [::1]:53 [::]:* users:(("named",pid=3943,fd=34))

#测试解析
[root@rockydesk ~]# dig @10.0.0.6 xyx.com A

; <<>> DiG 9.18.33 <<>> @10.0.0.6 xyx.com A
; (1 server found)
;; global options: +cmd
;; Got answer:
;; –>>HEADER<<- opcode: QUERY, status: NOERROR, id: 53506
;; flags: qr aa rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 1

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 1232
; COOKIE: 2d94296908891b44010000006a72ade9c05d5e68398f70e8 (good)
;; QUESTION SECTION:
;xyx.com. IN A

;; ANSWER SECTION:
xyx.com. 36800 IN A 10.0.0.6

;; Query time: 0 msec
;; SERVER: 10.0.0.6#53(10.0.0.6) (UDP)
;; WHEN: Wed Aug 05 11:28:41 CST 2026
;; MSG SIZE rcvd: 80

5、客户端测试

#Ubuntu客户端
root@ubt2604ser:~# vim /etc/netplan/00-installer-config.yaml
root@ubt2604ser:~# cat /etc/netplan/00-installer-config.yaml
# This is the network config written by 'subiquity'
network:
ethernets:
ens32:
addresses:
– 10.0.0.4/24
dhcp6: true
match:
macaddress: 00:0c:29:e9:1e:90
nameservers:
addresses:
– 10.0.0.6
– 10.0.0.2
search: []
routes:
– to: default
via: 10.0.0.2
set-name: ens32
version: 2

root@ubt2604ser:~# netplan try
root@ubt2604ser:~# netplan apply
root@ubt2604ser:~# resolvectl status
Global
Protocols: -LLMNR -mDNS -DNSOverTLS DNSSEC=no/unsupported
resolv.conf mode: stub

Link 2 (ens32)
Current Scopes: DNS
Protocols: +DefaultRoute -LLMNR -mDNS -DNSOverTLS DNSSEC=no/unsupported
Current DNS Server: 10.0.0.2
DNS Servers: 10.0.0.6 10.0.0.2
Default Route: yes

#或者使用nmcli修改dns
root@ubt2604ser:~# nmcli connection modify ens32 ipv4.dns "10.0.0.6"
root@ubt2604ser:~# nmcli connection reload

#dig测试
root@ubt2604ser:~# dig @10.0.0.6 xyx.com +short
10.0.0.6
root@ubt2604ser:~# dig @10.0.0.6 myy.xyx.com +short
10.0.0.9
root@ubt2604ser:~# dig @10.0.0.6 xyy.xyx.com +short
10.0.0.10

6、防火墙配置

#如果测试时提示可以检查防火墙是否放行DNS服务
root@ubt2604ser:~# dig @10.0.0.6 xyx.com A
;; communications error to 10.0.0.6#53: host unreachable
;; communications error to 10.0.0.6#53: host unreachable
;; communications error to 10.0.0.6#53: host unreachable

; <<>> DiG 9.20.18-1ubuntu2-Ubuntu <<>> @10.0.0.6 xyx.com A
; (1 server found)
;; global options: +cmd
;; no servers could be reached

#rocky放行
#永久放行DNS服务或者53端口二选其一
[root@rockydesk ~]# firewall-cmd –permanent –add-service=dns
success

[root@rockydesk ~]# firewall-cmd –permanent –add-port=53/tcp
success
[root@rockydesk ~]# firewall-cmd –permanent –add-port=53/udp
success

#重新加载
[root@rockydesk ~]# firewall-cmd –reload
success

#验证
[root@rockydesk ~]# firewall-cmd –list-all
public (default, active)
target: default
ingress-priority: 0
egress-priority: 0
icmp-block-inversion: no
interfaces: ens160
sources:
services: cockpit dhcpv6-client dns ssh
ports: 53/tcp 53/udp
protocols:
forward: yes
masquerade: no
forward-ports:
source-ports:
icmp-blocks:
rich rules:
[root@rockydesk ~]#

#Ubuntu放行

root@ubt2604ser:~# ufw allow 53/tcp
Rule added
Rule added (v6)
root@ubt2604ser:~# ufw allow 53/udp
Rule added
Rule added (v6)
root@ubt2604ser:~# ufw reload
Firewall reloaded
root@ubt2604ser:~# ufw status numbered
Status: active

To Action From
— —— —-
[ 1] 22 ALLOW IN Anywhere
[ 2] 53/tcp ALLOW IN Anywhere
[ 3] 53/udp ALLOW IN Anywhere
[ 4] 22 (v6) ALLOW IN Anywhere (v6)
[ 5] 53/tcp (v6) ALLOW IN Anywhere (v6)
[ 6] 53/udp (v6) ALLOW IN Anywhere (v6)

Action From
— —— —-

[ 1] 22 ALLOW IN Anywhere [ 2] 53/tcp ALLOW IN Anywhere [ 3] 53/udp ALLOW IN Anywhere [ 4] 22 (v6) ALLOW IN Anywhere (v6) [ 5] 53/tcp (v6) ALLOW IN Anywhere (v6) [ 6] 53/udp (v6) ALLOW IN Anywhere (v6)