环境

操作系统CentOS 7

IP地址10.27.106.201

测试域名aec.testuc.com

作用主要提供解析aec.testuc.com域名的服务

安装

yum -y install bind

修改配置文件

主配置文件

vim /etc/named.conf

主要修改以下两个地方

listen-on port 53 { any; };

allow-query { any; };

//
// named.conf
//
// Provided by Red Hat bind package to configure the ISC BIND named(8) DNS
// server as a caching only nameserver (as a localhost DNS resolver only).
//
// See /usr/share/doc/bind*/sample/ for example named configuration files.
//
// See the BIND Administrator's Reference Manual (ARM) for details about the
// configuration located in /usr/share/doc/bind-{version}/Bv9ARM.html

options {
        listen-on port 53 { any; };
        # listen-on port 53 { 127.0.0.1; };
        listen-on-v6 port 53 { ::1; };
        directory       "/var/named";
        dump-file       "/var/named/data/cache_dump.db";
        statistics-file "/var/named/data/named_stats.txt";
        memstatistics-file "/var/named/data/named_mem_stats.txt";
        recursing-file  "/var/named/data/named.recursing";
        secroots-file   "/var/named/data/named.secroots";
        allow-query     { any; };
        # allow-query     { localhost; };

        /* 
         - If you are building an AUTHORITATIVE DNS server, do NOT enable recursion.
         - If you are building a RECURSIVE (caching) DNS server, you need to enable 
           recursion. 
         - If your recursive DNS server has a public IP address, you MUST enable access 
           control to limit queries to your legitimate users. Failing to do so will
           cause your server to become part of large scale DNS amplification 
           attacks. Implementing BCP38 within your network would greatly
           reduce such attack surface 
        */
        recursion yes;

        dnssec-enable yes;
        dnssec-validation yes;

        /* Path to ISC DLV key */
        bindkeys-file "/etc/named.root.key";

        managed-keys-directory "/var/named/dynamic";

        pid-file "/run/named/named.pid";
        session-keyfile "/run/named/session.key";
};

logging {
        channel default_debug {
                file "data/named.run";
                severity dynamic;
        };
};

zone "." IN {
        type hint;
        file "named.ca";
};

include "/etc/named.rfc1912.zones";
include "/etc/named.root.key";

区域配置文件添加正向解析配置

vim /etc/named.rfc1912.zones

末尾添加如下配置

zone "aec.starnetuc.com" IN {             #正向解析为"aec.starnetuc.com"
        type master;                      #类型主缓存为master
        file "aec.starnetuc.com.zone";    #指定区域数据文件为aec.starnetuc.com.zone
        allow-update { none; };
};

正向区域数据文件

拷贝其他区域数据文件保留源文件的权限和属主的属性复制

cp -a /var/named/named.localhost /var/named/aec.starnetuc.com.zone

修改该文件结果如下

$TTL 1D  	#有效解析记录的生成周期
@       IN SOA  aec.starnetuc.com. root.aec.starnetuc.com. (
#@表示当前的DNS区域名表示这个域名  
#SOA表示授权信息开启 
# 后面表示邮件地址因为@有特殊含义 所以使用.代替 
                                        0       ; serial  #更新序列号可以是10以内的整数
                                        1D      ; refresh #刷新时间重新下载地址数据的间隔
                                        1H      ; retry   #重试延迟下载失败后的重试延迟
                                        1W      ; expire  #失效时间超过该时间仍无法下载则放弃
                                        3H )    ; minimum #无效解析记录的生存周期
        IN      NS      aec.starnetuc.com. #记录当前区域DNS服务器的名称
        IN      MX 10   aec.starnetuc.com. #MX为邮件服务器 10表示优先级 数字越大优先级越低
        IN      A       10.27.106.214      #记录正向解析域名对应的IP即将域名与IP绑捆

检查配置是否正确

named-checkconf -z /etc/named.conf

仅检查语法不检查逻辑关系。当显示的全为0时表示没有语法错误

zone localhost.localdomain/IN: loaded serial 0
zone localhost/IN: loaded serial 0
zone 1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.ip6.arpa/IN: loaded serial 0
zone 1.0.0.127.in-addr.arpa/IN: loaded serial 0
zone 0.in-addr.arpa/IN: loaded serial 0
zone aec.starnetuc.com/IN: loaded serial 0

启动DNS服务

启动前检查防火墙、SELINUX安全模式是否是关闭或允许状态

启动

systemctl start named
systemctl enable named

查看53号监听端口是否开启

测试

将测试系统的DNS改为10.27.106.201然后去

ping aec.starnetuc.com

PING aec.starnetuc.com (10.27.106.214) 56(84) bytes of data.
64 bytes from 10.27.106.214 (10.27.106.214): icmp_seq=1 ttl=64 time=1024 ms
64 bytes from 10.27.106.214 (10.27.106.214): icmp_seq=2 ttl=64 time=4.31 ms
64 bytes from 10.27.106.214 (10.27.106.214): icmp_seq=3 ttl=64 time=5.53 ms

表明配置成功。