我已经设置好named了chroot，并且已经运行了几天。现在它找不到某个域的 IP：
# dig arstechnica.com
; <<>> DiG 9.8.2rc1-RedHat-9.8.2-0.30.rc1.el6_6.1 <<>> arstechnica.com
;; global options: +cmd
;; connection timed out; no servers could be reached
通常会发现其他域名：
# dig serverfault.com
; <<>> DiG 9.8.2rc1-RedHat-9.8.2-0.30.rc1.el6_6.1 <<>> serverfault.com
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 27016
;; flags: qr rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 2, ADDITIONAL: 2
;; QUESTION SECTION:
;serverfault.com. IN A
;; ANSWER SECTION:
serverfault.com. 98 IN A 198.252.206.140
;; AUTHORITY SECTION:
serverfault.com. 172598 IN NS cf-dns02.serverfault.com.
serverfault.com. 172598 IN NS cf-dns01.serverfault.com.
;; ADDITIONAL SECTION:
cf-dns02.serverfault.com. 172598 IN A 173.245.59.4
cf-dns01.serverfault.com. 172598 IN A 173.245.58.53
;; Query time: 0 msec
;; SERVER: 127.0.0.1#53(127.0.0.1)
;; WHEN: Mon Dec 22 11:06:10 2014
;; MSG SIZE rcvd: 127
named.conf：
# cat /var/named/chroot/var/named/chroot/etc/named.conf
options {
listen-on port 53 { 127.0.0.1; };
listen-on-v6 port 53 { ::1; };
directory "/var/named";
dump-file "/var/named/data/cache_dump.db";
statistics-file "/var/named/data/named_stats.txt";
memstatistics-file "/var/named/data/named_mem_stats.txt";
allow-query { localhost; };
recursion yes;
dnssec-enable yes;
dnssec-validation yes;
dnssec-lookaside auto;
/* Path to ISC DLV key */
bindkeys-file "/etc/named.iscdlv.key";
managed-keys-directory "/var/named/dynamic";
};
logging {
channel default_debug {
file "data/named.run";
severity dynamic;
};
};
zone "." IN {
type hint;
file "named.ca";
};
include "/etc/named.rfc1912.zones";
include "/etc/named.root.key";
该目录中的所有文件：
# ll /var/named/chroot/var/named/chroot/etc/
total 16
-rw-r--r--. 1 root root 118 Jul 21 2011 localtime
drwxr-x---. 2 root named 4096 Dec 12 02:25 named
-rw-r-----. 1 root named 1008 Dec 17 20:02 named.conf
-rw-r--r--. 1 root root 0 Dec 22 10:35 named.iscdlv.key
-rw-r--r--. 1 root root 0 Dec 22 10:35 named.rfc1912.zones
-rw-r--r--. 1 root root 0 Dec 22 10:35 named.root.key
drwxr-x---. 3 root named 4096 Dec 17 19:15 pki
-rw-r--r--. 1 root root 0 Dec 22 10:35 rndc.key
我错过了什么？
+trace添加：
# dig arstechnica.com +trace
; <<>> DiG 9.8.2rc1-RedHat-9.8.2-0.30.rc1.el6_6.1 <<>> arstechnica.com +trace
;; global options: +cmd
. 516879 IN NS m.root-servers.net.
. 516879 IN NS h.root-servers.net.
. 516879 IN NS g.root-servers.net.
. 516879 IN NS j.root-servers.net.
. 516879 IN NS a.root-servers.net.
. 516879 IN NS l.root-servers.net.
. 516879 IN NS e.root-servers.net.
. 516879 IN NS f.root-servers.net.
. 516879 IN NS k.root-servers.net.
. 516879 IN NS b.root-servers.net.
. 516879 IN NS d.root-servers.net.
. 516879 IN NS i.root-servers.net.
. 516879 IN NS c.root-servers.net.
;; Received 228 bytes from 127.0.0.1#53(127.0.0.1) in 577 ms
com. 172800 IN NS m.gtld-servers.net.
com. 172800 IN NS l.gtld-servers.net.
com. 172800 IN NS k.gtld-servers.net.
com. 172800 IN NS j.gtld-servers.net.
com. 172800 IN NS i.gtld-servers.net.
com. 172800 IN NS h.gtld-servers.net.
com. 172800 IN NS g.gtld-servers.net.
com. 172800 IN NS f.gtld-servers.net.
com. 172800 IN NS e.gtld-servers.net.
com. 172800 IN NS d.gtld-servers.net.
com. 172800 IN NS c.gtld-servers.net.
com. 172800 IN NS b.gtld-servers.net.
com. 172800 IN NS a.gtld-servers.net.
;; Received 493 bytes from 192.58.128.30#53(192.58.128.30) in 2270 ms
arstechnica.com. 172800 IN NS ns1.servercentral.net.
arstechnica.com. 172800 IN NS ns2.servercentral.net.
;; Received 118 bytes from 192.12.94.30#53(192.12.94.30) in 579 ms
;; connection timed out; no servers could be reached
挖掘到 github：
# dig github.com +trace
; <<>> DiG 9.8.2rc1-RedHat-9.8.2-0.30.rc1.el6_6.1 <<>> github.com +trace
;; global options: +cmd
. 516495 IN NS k.root-servers.net.
. 516495 IN NS e.root-servers.net.
. 516495 IN NS f.root-servers.net.
. 516495 IN NS b.root-servers.net.
. 516495 IN NS g.root-servers.net.
. 516495 IN NS d.root-servers.net.
. 516495 IN NS m.root-servers.net.
. 516495 IN NS c.root-servers.net.
. 516495 IN NS j.root-servers.net.
. 516495 IN NS h.root-servers.net.
. 516495 IN NS a.root-servers.net.
. 516495 IN NS i.root-servers.net.
. 516495 IN NS l.root-servers.net.
;; Received 508 bytes from 127.0.0.1#53(127.0.0.1) in 5 ms
com. 172800 IN NS a.gtld-servers.net.
com. 172800 IN NS b.gtld-servers.net.
com. 172800 IN NS c.gtld-servers.net.
com. 172800 IN NS d.gtld-servers.net.
com. 172800 IN NS e.gtld-servers.net.
com. 172800 IN NS f.gtld-servers.net.
com. 172800 IN NS g.gtld-servers.net.
com. 172800 IN NS h.gtld-servers.net.
com. 172800 IN NS i.gtld-servers.net.
com. 172800 IN NS j.gtld-servers.net.
com. 172800 IN NS k.gtld-servers.net.
com. 172800 IN NS l.gtld-servers.net.
com. 172800 IN NS m.gtld-servers.net.
;; Received 488 bytes from 193.0.14.129#53(193.0.14.129) in 74 ms
github.com. 172800 IN NS ns1.p16.dynect.net.
github.com. 172800 IN NS ns3.p16.dynect.net.
github.com. 172800 IN NS ns2.p16.dynect.net.
github.com. 172800 IN NS ns4.p16.dynect.net.
;; Received 178 bytes from 192.31.80.30#53(192.31.80.30) in 323 ms
github.com. 30 IN A 192.30.252.131
github.com. 86400 IN NS ns4.p16.dynect.net.
github.com. 86400 IN NS ns2.p16.dynect.net.
github.com. 86400 IN NS ns1.p16.dynect.net.
github.com. 86400 IN NS ns3.p16.dynect.net.
;; Received 130 bytes from 204.13.251.16#53(204.13.251.16) in 10 ms
答案1
服务器正在使用的 IP 地址上设置的网络掩码（64.x.x.x）为255.0.0.0，这太宽了，这意味着以该 IP 地址开头的任何域的请求64.都无法正确地路由出服务器。
解决这个问题的方法是将本地机器上 IP 地址使用的网络掩码降低为 255.255.255.0，这意味着任何以该地址开头的地址64.仍将在机器外部进行解析。