회사 네트워크의 서브넷에 DNS 서버가 있고 확인할 수 없는 경우 기본 DNS 서버로 전달하도록 지시하고 싶습니다.
이것은 내 파일입니다:
//
// named.conf
//
// Provided by Red Hat bind package to configure the ISC BIND named(8) DNS
// server as a caching only nameserver (as a localhost DNS resolver only).
//
// See /usr/share/doc/bind*/sample/ for example named configuration files.
//
options {
listen-on port 53 { any; };
directory "/var/named";
dump-file "/var/named/data/cache_dump.db";
forwarders { 10.90.0.135; 10.90.0.174; };
forward first;
statistics-file "/var/named/data/named_stats.txt";
memstatistics-file "/var/named/data/named_mem_stats.txt";
allow-query { any; };
recursion yes;
dnssec-enable yes;
dnssec-validation yes;
dnssec-lookaside auto;
/* Path to ISC DLV key */
bindkeys-file "/etc/named.iscdlv.key";
managed-keys-directory "/var/named/dynamic";
};
logging {
channel default_debug {
file "data/named.run";
severity dynamic;
};
};
zone "." IN {
type hint;
file "named.ca";
};
include "/etc/named.rfc1912.zones";
include "/etc/named.root.key";
zone "appletop.local" IN {
type master;
file "appletop.local";
allow-update { none; };
};
나는 DNS 서버 10.90.0.35가 좋다는 것을 알고 있으며 그것을 사용하여 dig를 사용하여 문제를 해결하면 괜찮습니다.
[root@ns1 etc]# dig www.yahoo.com @10.90.0.135
; <<>> DiG 9.8.2rc1-RedHat-9.8.2-0.17.rc1.0.2.el6_4.6 <<>> www.yahoo.com @10.90.0.135
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 24437
;; flags: qr rd ra; QUERY: 1, ANSWER: 6, AUTHORITY: 0, ADDITIONAL: 0
;; QUESTION SECTION:
;www.yahoo.com. IN A
;; ANSWER SECTION:
www.yahoo.com. 278 IN CNAME fd-fp3.wg1.b.yahoo.com.
fd-fp3.wg1.b.yahoo.com. 278 IN CNAME ds-fp3.wg1.b.yahoo.com.
ds-fp3.wg1.b.yahoo.com. 1 IN CNAME ds-eu-fp3-lfb.wa1.b.yahoo.com.
ds-eu-fp3-lfb.wa1.b.yahoo.com. 235 IN CNAME ds-eu-fp3.wa1.b.yahoo.com.
ds-eu-fp3.wa1.b.yahoo.com. 26 IN A 87.248.122.122
ds-eu-fp3.wa1.b.yahoo.com. 26 IN A 87.248.112.181
;; Query time: 49 msec
;; SERVER: 10.90.0.135#53(10.90.0.135)
;; WHEN: Thu Sep 12 17:37:15 2013
;; MSG SIZE rcvd: 167
하지만 내 일반적인 요청을 해당 서버로 전달하도록 할 수는 없습니다.
내가 뭘 잘못했나요 인터넷에 있는 예제의 항목을 복사했는데 작동이 안 돼요
감사합니다
답변1
문제는 파일에서 dns-sec를 활성화했다는 것입니다. 모든 sec 항목을 제거하고 작동했습니다.
감사해요
답변2
다음을 추가해 보셨나요?
allow-recursion { 192.168.0.0/24; };
바인드 옵션에? 여기서 192.168.0.0/24는 로컬 서브넷입니다.
다음의 결과를 게시할 수 있습니까?
dig @yourdnsserver www.yahoo.com
?
내 답변 대신 귀하의 질문에 이러한 내용을 추가하는 것을 고려할 수 있습니다.
===아래 요청자의 편집 내용=== 발굴 중단:
발굴 + 추적 www.yahoo.com
; <<>> DiG 9.8.2rc1-RedHat-9.8.2-0.17.rc1.0.2.el6_4.6 <<>> +trace www.yahoo.com ;; 전역 옵션: +cmd . NS H.ROOT-SERVERS.NET의 518400. . NS G.ROOT-SERVERS.NET의 518400. . NS M.ROOT-SERVERS.NET의 518400. . NS
K.ROOT-SERVERS.NET의 518400. . NS
J.ROOT-SERVERS.NET의 518400. . NS
L.ROOT-SERVERS.NET의 518400. . NS
I.ROOT-SERVERS.NET의 518400. . NS
A.ROOT-SERVERS.NET의 518400. . NS
D.ROOT-SERVERS.NET의 518400. . NS
C.ROOT-SERVERS.NET의 518400. . NS
E.ROOT-SERVERS.NET의 518400. . NS
F.ROOT-SERVERS.NET의 518400. . NS
B.ROOT-SERVERS.NET의 518400.
또한 var/log/messages는 다음으로 가득 차 있습니다:
> Sep 12 18:08:51 ns1 named-sdb[25026]: validating @0x7fef184578a0: .
> NS: got insecure response; parent indicates it should be secure Sep 12
> 18:08:51 ns1 named-sdb[25026]: error (insecurity proof failed)
> resolving './NS/IN': 10.90.0.174#53 Sep 12 18:08:51 ns1
> named-sdb[25026]: validating @0x7fef184b2ea0: . NS: got insecure
> response; parent indicates it should be secure Sep 12 18:08:51 ns1
> named-sdb[25026]: error (insecurity proof failed) resolving './NS/IN':
> 10.90.0.135#53 Sep 12 18:08:53 ns1 named-sdb[25026]: error (network unreachable) resolving 'NET/DS/IN': 2001:7fe::53#53 Sep 12 18:08:55
> ns1 named-sdb[25026]: error (network unreachable) resolving './NS/IN':
> 2001:503:c27::2:30#53 Sep 12 18:08:57 ns1 named-sdb[25026]: error
> (network unreachable) resolving './NS/IN': 2001:500:2f::f#53 Sep 12
> 18:08:58 ns1 named-sdb[25026]: error (network unreachable) resolving
> 'NET/DS/IN': 2001:503:c27::2:30#53 Sep 12 18:09:01 ns1
> named-sdb[25026]: error (network unreachable) resolving 'NET/DS/IN':
> 2001:500:3::42#53 Sep 12 18:09:01 ns1 named-sdb[25026]: error (no
> valid DS) resolving 'F.ROOT-SERVERS.NET/A/IN': 10.90.0.174#53 Sep 12
> 18:09:01 ns1 named-sdb[25026]: error (no valid DS) resolving
> 'F.ROOT-SERVERS.NET/AAAA/IN': 10.90.0.174#53 Sep 12 18:09:01 ns1
> named-sdb[25026]: error (no valid DS) resolving
> 'E.ROOT-SERVERS.NET/A/IN': 10.90.0.174#53 Sep 12 18:09:05 ns1
> named-sdb[25026]: error (network unreachable) resolving 'NET/DS/IN':
> 2001:500:1::803f:235#53 Sep 12 18:09:09 ns1 named-sdb[25026]: error
> (network unreachable) resolving 'NET/DS/IN': 2001:7fe::53#53 Sep 12
> 18:09:09 ns1 named-sdb[25026]: error (network unreachable) resolving
> 'NET/DS/IN': 2001:500:2d::d#53 Sep 12 18:09:09 ns1 named-sdb[25026]:
> error (network unreachable) resolving './NS/IN': 2001:500:2d::d#53 Sep
> 12 18:09:11 ns1 named-sdb[25026]: error (network unreachable)
> resolving 'NET/DS/IN': 2001:dc3::35#53