Linux学习之旅之DNS域名系统基本认知一、DNS 域名系统1、什么是dnsDNSDomain Name System域名系统是互联网的地址翻译系统。作用把人类好记的域名如 www.baidu.com翻译成计算机能识别的IP 地址如 180.101.49.11实现上网访问。2、查询流程豆包生成仅供参考3、DNS记录类型记录类型核心作用QQ 域名示例AIPv4 地址解析www.qq.com → 120.92.198.131AAAAIPv6 地址解析www.qq.com → 2409:8c5c:2111:306::3CNAME域名别名跳转m.qq.com → mobile.qq.comMX邮件服务器指定qq.com → mx1.qq.com优先级 10TXT域名验证 / 反垃圾邮件qq.com → SPF 反垃圾记录NS权威 DNS 服务器指定qq.com → ns1.qq.com、ns2.qq.com4、本地hosts文件#linux存放位置[rootrockydesk ~]# cat /etc/hosts127.0.0.1 localhost localhost.localdomain localhost4 localhost4.localdomain4 ::1 localhost localhost.localdomain localhost6 localhost6.localdomain610.0.0.6 xyx.com[rootrockydesk ~]##Windows存放位置C:\Windows\System32\drivers\etc\hosts6、常见dns查询命令dig最详细的DNS查询工具#基本查询[rootrockydesk ~]# dig jd.com A;DiG9.18.33jd.com A;;global options: cmd;;Got answer:;;-HEADER-opcode: QUERY, status: NOERROR, id:59564;;flags: qr rd ra;QUERY:1, ANSWER:4, AUTHORITY:5, ADDITIONAL:5;;OPT PSEUDOSECTION:;EDNS: version:0, flags:;udp:1232;;QUESTION SECTION:;jd.com. IN A;;ANSWER SECTION: jd.com.600IN A211.144.24.218 jd.com.600IN A111.13.149.108 jd.com.600IN A211.144.27.126 jd.com.600IN A106.39.171.134;;AUTHORITY SECTION: jd.com.166415IN NS ns4.jdcache.com. jd.com.166415IN NS ns1.jdcache.com. jd.com.166415IN NS ns5.jdcache.com. jd.com.166415IN NS ns2.jdcache.com. jd.com.166415IN NS ns3.jdcache.com.;;ADDITIONAL SECTION: ns1.jdcache.com.55985IN A111.13.28.10 ns2.jdcache.com.55881IN A111.206.226.10 ns3.jdcache.com.57298IN A120.52.149.254 ns4.jdcache.com.56526IN A106.39.177.32;;Query time:5msec;;SERVER:218.85.152.99#53(218.85.152.99) (UDP);;WHEN: Wed Aug 0510:10:47 CST2026;;MSG SIZE rcvd:264#精简查询[rootrockydesk ~]# dig jd.com short111.13.149.108211.144.27.126211.144.24.218106.39.171.134#指定阿里云dns查询[rootrockydesk ~]# dig 223.5.5.5 jd.com short211.144.24.218106.39.171.134111.13.149.108211.144.27.126nslookup 简单查询#基本查询[rootrockydesk ~]# nslookup qq.comServer:218.85.152.99 Address:218.85.152.99#53Non-authoritative answer: Name: qq.com Address:123.150.76.218 Name: qq.com Address:113.108.81.189#指定dns查询[rootrockydesk ~]# nslookup qq.com 223.5.5.5Server:223.5.5.5 Address:223.5.5.5#53Non-authoritative answer: Name: qq.com Address:123.150.76.218 Name: qq.com Address:113.108.81.189host 简洁输出#基本查询[rootrockydesk ~]# host qq.comqq.com has address113.108.81.189 qq.com has address123.150.76.218 qq.com mail is handled by20mx2.qq.com. qq.com mail is handled by30mx1.qq.com. qq.com mail is handled by10mx3.qq.com.#查询主域名的A记录IPv4地址[rootrockydesk ~]# host -t A qq.comqq.com has address123.150.76.218 qq.com has address113.108.81.189# 查询MX邮件交换记录邮件服务器[rootrockydesk ~]# host -t MX qq.comqq.com mail is handled by30mx1.qq.com. qq.com mail is handled by20mx2.qq.com. qq.com mail is handled by10mx3.qq.com.# 查询SOA授权起始记录区域权威信息[rootrockydesk ~]# host -t SOA qq.comqq.com has SOA record ns1.qq.com. webmaster.qq.com.1330914143360030086400300[rootrockydesk ~]##指定dns查询[rootrockydesk ~]# host qq.com 223.5.5.5Using domain server: Name:223.5.5.5 Address:223.5.5.5#53Aliases: qq.com has address113.108.81.189 qq.com has address123.150.76.218 qq.com mail is handled by30mx1.qq.com. qq.com mail is handled by20mx2.qq.com. qq.com mail is handled by10mx3.qq.com.[rootrockydesk ~]#二、部署DNS和配置1、安装和启动DNS[rootrockydesk ~]# dnf -y install bind bind-utilsrootrockydesk ~]# systemctl enable --now named.service2、修改主配置文档[rootrockydesk ~]# vim /etc/named.conf[rootrockydesk ~]# cat /etc/named.confoptions{listen-on port53{any;};#将127.0.0.1改为any监听任意ip53端口listen-on-v6 port53{::1;};directory/var/named;dump-file/var/named/data/cache_dump.db;statistics-file/var/named/data/named_stats.txt;memstatistics-file/var/named/data/named_mem_stats.txt;secroots-file/var/named/data/named.secroots;recursing-file/var/named/data/named.recursing;allow-query{any;};#将localhost改为any允许任意客户端查询[rootrockydesk ~]#参数核心含义listen-on监听哪些 IP 地址的 53 端口allow-query允许哪些客户端查询any 表示所有allow-transfer允许哪些服务器进行区域传输安全设置forwarders上游 DNS 服务器用于解析外部域名forward first先查 forwarders查不到再查根服务器recursion yes允许递归查询3、配置政协解析配置正向解析区域声明 xyx.com[rootrockydesk ~]# vim /etc/named.rfc1912.zones[rootrockydesk ~]# tail -7 /etc/named.rfc1912.zoneszonexyx.comIN{# 声明区域typemaster;# 类型为 masterfilexyx.com.zone;# 区域文件allow-update{none;};# 禁止更新可选};配置正向解析区域文件 xyx.com.zone;代表注释[rootrockydesk ~]# vim /var/named/xyx.com.zone[rootrockydesk ~]# cat /var/named/xyx.com.zone;;文件名: /var/named/xyx.com.zone;域名: xyx.com 正向解析区域文件;维护人: xyx;最后修改:2026-08-05;$TTL36800 IN SOA ns1.xyx.com. admin.xyx.com.(20260805013600180032768043990) IN NS ns1.xyx.com. IN A10.0.0.6 ns1 IN A10.0.0.6 myy IN A10.0.0.9 xyy IN A10.0.0.10 ubt2604ser IN A10.0.0.44、验证和启动#检查主配置文件语法[rootrockydesk ~]# named-checkconf /etc/named.conf#检查区域文件语法[rootrockydesk ~]# named-checkzone xyx.com /var/named/xyx.com.zonezone xyx.com/IN: loaded serial2026080501OK#上面安装时以及启动我这边重新加载配置文件[rootrockydesk ~]# systemctl reload named.service#验证53端口[rootrockydesk ~]# ss -tunlp |grep :53udp UNCONN0010.0.0.6:530.0.0.0:* users:((named,pid3943,fd41))udp UNCONN0010.0.0.6:530.0.0.0:* users:((named,pid3943,fd40))udp UNCONN00127.0.0.1:530.0.0.0:* users:((named,pid3943,fd25))udp UNCONN00127.0.0.1:530.0.0.0:* users:((named,pid3943,fd26))udp UNCONN00[::1]:53[::]:* users:((named,pid3943,fd32))udp UNCONN00[::1]:53[::]:* users:((named,pid3943,fd31))tcp LISTEN010127.0.0.1:530.0.0.0:* users:((named,pid3943,fd29))tcp LISTEN010127.0.0.1:530.0.0.0:* users:((named,pid3943,fd27))tcp LISTEN01010.0.0.6:530.0.0.0:* users:((named,pid3943,fd43))tcp LISTEN01010.0.0.6:530.0.0.0:* users:((named,pid3943,fd42))tcp LISTEN010[::1]:53[::]:* users:((named,pid3943,fd33))tcp LISTEN010[::1]:53[::]:* users:((named,pid3943,fd34))#测试解析[rootrockydesk ~]# dig 10.0.0.6 xyx.com A;DiG9.18.3310.0.0.6 xyx.com A;(1server found);;global options: cmd;;Got answer:;;-HEADER-opcode: QUERY, status: NOERROR, id:53506;;flags: qr aa rd ra;QUERY:1, ANSWER:1, AUTHORITY:0, ADDITIONAL:1;;OPT PSEUDOSECTION:;EDNS: version:0, flags:;udp:1232;COOKIE: 2d94296908891b44010000006a72ade9c05d5e68398f70e8(good);;QUESTION SECTION:;xyx.com. IN A;;ANSWER SECTION: xyx.com.36800IN A10.0.0.6;;Query time:0msec;;SERVER:10.0.0.6#53(10.0.0.6) (UDP);;WHEN: Wed Aug 0511:28:41 CST2026;;MSG SIZE rcvd:805、客户端测试#Ubuntu客户端rootubt2604ser:~# vim /etc/netplan/00-installer-config.yamlrootubt2604ser:~# cat /etc/netplan/00-installer-config.yaml# This is the network config written by subiquitynetwork: ethernets: ens32: addresses: -10.0.0.4/24 dhcp6:truematch: macaddress: 00:0c:29:e9:1e:90 nameservers: addresses: -10.0.0.6 -10.0.0.2 search:[]routes: - to: default via:10.0.0.2 set-name: ens32 version:2rootubt2604ser:~# netplan tryrootubt2604ser:~# netplan applyrootubt2604ser:~# resolvectl statusGlobal Protocols:-LLMNR-mDNS-DNSOverTLSDNSSECno/unsupported resolv.conf mode: stub Link2(ens32)Current Scopes: DNS Protocols: DefaultRoute-LLMNR-mDNS-DNSOverTLSDNSSECno/unsupported Current DNS Server:10.0.0.2 DNS Servers:10.0.0.610.0.0.2 Default Route:yes#或者使用nmcli修改dnsrootubt2604ser:~# nmcli connection modify ens32 ipv4.dns 10.0.0.6rootubt2604ser:~# nmcli connection reload#dig测试rootubt2604ser:~# dig 10.0.0.6 xyx.com short10.0.0.6 rootubt2604ser:~# dig 10.0.0.6 myy.xyx.com short10.0.0.9 rootubt2604ser:~# dig 10.0.0.6 xyy.xyx.com short10.0.0.106、防火墙配置#如果测试时提示可以检查防火墙是否放行DNS服务rootubt2604ser:~# dig 10.0.0.6 xyx.com A;;communications error to10.0.0.6#53: host unreachable;;communications error to10.0.0.6#53: host unreachable;;communications error to10.0.0.6#53: host unreachable;DiG9.20.18-1ubuntu2-Ubuntu10.0.0.6 xyx.com A;(1server found);;global options: cmd;;no servers could be reached#rocky放行#永久放行DNS服务或者53端口二选其一[rootrockydesk ~]# firewall-cmd --permanent --add-servicednssuccess[rootrockydesk ~]# firewall-cmd --permanent --add-port53/tcpsuccess[rootrockydesk ~]# firewall-cmd --permanent --add-port53/udpsuccess#重新加载[rootrockydesk ~]# firewall-cmd --reloadsuccess#验证[rootrockydesk ~]# firewall-cmd --list-allpublic(default, active)target: default ingress-priority:0egress-priority:0icmp-block-inversion: no interfaces: ens160 sources: services: cockpit dhcpv6-client dnssshports:53/tcp53/udp protocols: forward:yesmasquerade: no forward-ports: source-ports: icmp-blocks: rich rules:[rootrockydesk ~]##Ubuntu放行rootubt2604ser:~# ufw allow 53/tcpRule added Rule added(v6)rootubt2604ser:~# ufw allow 53/udpRule added Rule added(v6)rootubt2604ser:~# ufw reloadFirewall reloaded rootubt2604ser:~# ufw status numberedStatus: active To Action From -- ------ ----[1]22ALLOW IN Anywhere[2]53/tcp ALLOW IN Anywhere[3]53/udp ALLOW IN Anywhere[4]22(v6)ALLOW IN Anywhere(v6)[5]53/tcp(v6)ALLOW IN Anywhere(v6)[6]53/udp(v6)ALLOW IN Anywhere(v6)Action From -- ------ ----[ 1] 22 ALLOW IN Anywhere[ 2] 53/tcp ALLOW IN Anywhere[ 3] 53/udp ALLOW IN Anywhere[ 4] 22 (v6) ALLOW IN Anywhere (v6)[ 5] 53/tcp (v6) ALLOW IN Anywhere (v6)[ 6] 53/udp (v6) ALLOW IN Anywhere (v6)