我正在使用我遇到的 DNS 问题来帮助我更好地理解 DNS 解析。我似乎无法弄清楚解析 www.fandompost.com 时看到的不一致之处。我的查询列表顶部是 OpenDNS。查询时，他们会返回适当的 IP。列表中的下一个是我们的内部 DNS 服务器。它确实返回了有用的信息，但没有可用的 IP。最后是我查询权威 NS。不过，与 OpenDNS 相反，最终结果是没有可用的 IP。我/我们是否对我们的内部 DNS 服务器做错了什么，导致我们的服务器失败而 OpenDNS 成功？
> www.fandompost.com.
Server: [208.67.222.222]
Address: 208.67.222.222
------------
SendRequest(), len 36
HEADER:
opcode = QUERY, id = 45, rcode = NOERROR
header flags: query
questions = 1, answers = 0, authority records = 0, additional = 0
QUESTIONS:
www.fandompost.com, type = A, class = IN
------------
------------
Got answer (119 bytes):
HEADER:
opcode = QUERY, id = 45, rcode = NOERROR
header flags: response, recursion avail.
questions = 1, answers = 3, authority records = 0, additional = 0
QUESTIONS:
www.fandompost.com, type = A, class = IN
ANSWERS:
-> www.fandompost.com
type = CNAME, class = IN, dlen = 39
canonical name = www.fandompost.com.cdn.cloudflare.net
ttl = 0 (0 secs)
-> www.fandompost.com.cdn.cloudflare.net
type = A, class = IN, dlen = 4
internet address = 108.162.206.239
ttl = 0 (0 secs)
-> www.fandompost.com.cdn.cloudflare.net
type = A, class = IN, dlen = 4
internet address = 108.162.205.239
ttl = 0 (0 secs)
------------
Non-authoritative answer:
------------
SendRequest(), len 36
HEADER:
opcode = QUERY, id = 46, rcode = NOERROR
header flags: query
questions = 1, answers = 0, authority records = 0, additional = 0
QUESTIONS:
www.fandompost.com, type = AAAA, class = IN
------------
------------
Got answer (36 bytes):
HEADER:
opcode = QUERY, id = 46, rcode = SERVFAIL
header flags: response, recursion avail.
questions = 1, answers = 0, authority records = 0, additional = 0
QUESTIONS:
www.fandompost.com, type = AAAA, class = IN
------------
Name: www.fandompost.com.cdn.cloudflare.net
Addresses: 108.162.206.239
108.162.205.239
Aliases: www.fandompost.com
> www.fandompost.com.
Server: [192.168.1.101]
Address: 192.168.1.101
------------
SendRequest(), len 36
HEADER:
opcode = QUERY, id = 48, rcode = NOERROR
header flags: query
questions = 1, answers = 0, authority records = 0, additional = 0
QUESTIONS:
www.fandompost.com, type = A, class = IN
------------
------------
Got answer (162 bytes):
HEADER:
opcode = QUERY, id = 48, rcode = NOERROR
header flags: response, recursion avail.
questions = 1, answers = 0, authority records = 3, additional = 3
QUESTIONS:
www.fandompost.com, type = A, class = IN
AUTHORITY RECORDS:
-> fandompost.com
type = NS, class = IN, dlen = 16
nameserver = ns1.dreamhost.com
ttl = 84200 (23 hours 23 mins 20 secs)
-> fandompost.com
type = NS, class = IN, dlen = 6
nameserver = ns2.dreamhost.com
ttl = 84200 (23 hours 23 mins 20 secs)
-> fandompost.com
type = NS, class = IN, dlen = 6
nameserver = ns3.dreamhost.com
ttl = 84200 (23 hours 23 mins 20 secs)
ADDITIONAL RECORDS:
-> ns1.dreamhost.com
type = A, class = IN, dlen = 4
internet address = 66.33.206.206
ttl = 84581 (23 hours 29 mins 41 secs)
-> ns2.dreamhost.com
type = A, class = IN, dlen = 4
internet address = 208.97.182.10
ttl = 84581 (23 hours 29 mins 41 secs)
-> ns3.dreamhost.com
type = A, class = IN, dlen = 4
internet address = 66.33.216.216
ttl = 84581 (23 hours 29 mins 41 secs)
------------
------------
SendRequest(), len 36
HEADER:
opcode = QUERY, id = 49, rcode = NOERROR
header flags: query
questions = 1, answers = 0, authority records = 0, additional = 0
QUESTIONS:
www.fandompost.com, type = AAAA, class = IN
------------
------------
Got answer (162 bytes):
HEADER:
opcode = QUERY, id = 49, rcode = NOERROR
header flags: response, recursion avail.
questions = 1, answers = 0, authority records = 3, additional = 3
QUESTIONS:
www.fandompost.com, type = AAAA, class = IN
AUTHORITY RECORDS:
-> fandompost.com
type = NS, class = IN, dlen = 16
nameserver = ns2.dreamhost.com
ttl = 84200 (23 hours 23 mins 20 secs)
-> fandompost.com
type = NS, class = IN, dlen = 6
nameserver = ns3.dreamhost.com
ttl = 84200 (23 hours 23 mins 20 secs)
-> fandompost.com
type = NS, class = IN, dlen = 6
nameserver = ns1.dreamhost.com
ttl = 84200 (23 hours 23 mins 20 secs)
ADDITIONAL RECORDS:
-> ns2.dreamhost.com
type = A, class = IN, dlen = 4
internet address = 208.97.182.10
ttl = 84581 (23 hours 29 mins 41 secs)
-> ns3.dreamhost.com
type = A, class = IN, dlen = 4
internet address = 66.33.216.216
ttl = 84581 (23 hours 29 mins 41 secs)
-> ns1.dreamhost.com
type = A, class = IN, dlen = 4
internet address = 66.33.206.206
ttl = 84581 (23 hours 29 mins 41 secs)
------------
Name: www.fandompost.com
Served by:
- ns1.dreamhost.com
66.33.206.206
fandompost.com
- ns2.dreamhost.com
208.97.182.10
fandompost.com
- ns3.dreamhost.com
66.33.216.216
fandompost.com
> www.fandompost.com.
Server: [66.33.206.206]
Address: 66.33.206.206
------------
SendRequest(), len 36
HEADER:
opcode = QUERY, id = 51, rcode = NOERROR
header flags: query
questions = 1, answers = 0, authority records = 0, additional = 0
QUESTIONS:
www.fandompost.com, type = A, class = IN
------------
------------
Got answer (148 bytes):
HEADER:
opcode = QUERY, id = 51, rcode = NXDOMAIN
header flags: response, auth. answer
questions = 1, answers = 1, authority records = 1, additional = 0
QUESTIONS:
www.fandompost.com, type = A, class = IN
ANSWERS:
-> www.fandompost.com
type = CNAME, class = IN, dlen = 39
canonical name = www.fandompost.com.cdn.cloudflare.net
ttl = 300 (5 mins)
AUTHORITY RECORDS:
-> cloudflare.net
type = SOA, class = IN, dlen = 49
ttl = 14400 (4 hours)
primary name server = ns1.dreamhost.com
responsible mail addr = hostmaster.dreamhost.com
serial = 2014071000
refresh = 14908 (4 hours 8 mins 28 secs)
retry = 1800 (30 mins)
expire = 1814400 (21 days)
default TTL = 14400 (4 hours)
------------
------------
SendRequest(), len 36
HEADER:
opcode = QUERY, id = 52, rcode = NOERROR
header flags: query
questions = 1, answers = 0, authority records = 0, additional = 0
QUESTIONS:
www.fandompost.com, type = AAAA, class = IN
------------
------------
Got answer (148 bytes):
HEADER:
opcode = QUERY, id = 52, rcode = NXDOMAIN
header flags: response, auth. answer
questions = 1, answers = 1, authority records = 1, additional = 0
QUESTIONS:
www.fandompost.com, type = AAAA, class = IN
ANSWERS:
-> www.fandompost.com
type = CNAME, class = IN, dlen = 39
canonical name = www.fandompost.com.cdn.cloudflare.net
ttl = 300 (5 mins)
AUTHORITY RECORDS:
-> cloudflare.net
type = SOA, class = IN, dlen = 49
ttl = 14400 (4 hours)
primary name server = ns1.dreamhost.com
responsible mail addr = hostmaster.dreamhost.com
serial = 2014071000
refresh = 14908 (4 hours 8 mins 28 secs)
retry = 1800 (30 mins)
expire = 1814400 (21 days)
default TTL = 14400 (4 hours)
------------
*** [66.33.206.206] can't find www.fandompost.com.: Non-existent domain
------------------------------------------------------------------------------------------------
------------------------------------------------------------------------------------------------
------------------------------------------------------------------------------------------------
> www.fandompost.com.cdn.cloudflare.net.
Server: [66.33.206.206]
Address: 66.33.206.206
------------
SendRequest(), len 55
HEADER:
opcode = QUERY, id = 55, rcode = NOERROR
header flags: query, want recursion
questions = 1, answers = 0, authority records = 0, additional = 0
QUESTIONS:
www.fandompost.com.cdn.cloudflare.net, type = A, class = IN
------------
------------
Got answer (119 bytes):
HEADER:
opcode = QUERY, id = 55, rcode = NXDOMAIN
header flags: response, auth. answer, want recursion
questions = 1, answers = 0, authority records = 1, additional = 0
QUESTIONS:
www.fandompost.com.cdn.cloudflare.net, type = A, class = IN
AUTHORITY RECORDS:
-> cloudflare.net
type = SOA, class = IN, dlen = 52
ttl = 14400 (4 hours)
primary name server = ns1.dreamhost.com
responsible mail addr = hostmaster.dreamhost.com
serial = 2014071000
refresh = 14908 (4 hours 8 mins 28 secs)
retry = 1800 (30 mins)
expire = 1814400 (21 days)
default TTL = 14400 (4 hours)
------------
------------
SendRequest(), len 55
HEADER:
opcode = QUERY, id = 56, rcode = NOERROR
header flags: query, want recursion
questions = 1, answers = 0, authority records = 0, additional = 0
QUESTIONS:
www.fandompost.com.cdn.cloudflare.net, type = AAAA, class = IN
------------
------------
Got answer (119 bytes):
HEADER:
opcode = QUERY, id = 56, rcode = NXDOMAIN
header flags: response, auth. answer, want recursion
questions = 1, answers = 0, authority records = 1, additional = 0
QUESTIONS:
www.fandompost.com.cdn.cloudflare.net, type = AAAA, class = IN
AUTHORITY RECORDS:
-> cloudflare.net
type = SOA, class = IN, dlen = 52
ttl = 14400 (4 hours)
primary name server = ns1.dreamhost.com
responsible mail addr = hostmaster.dreamhost.com
serial = 2014071000
refresh = 14908 (4 hours 8 mins 28 secs)
retry = 1800 (30 mins)
expire = 1814400 (21 days)
default TTL = 14400 (4 hours)
------------
*** [66.33.206.206] can't find www.fandompost.com.cdn.cloudflare.net.: Non-exist
ent domain
答案1
首先我们来比较一下三种响应情况。
- 第一种情况（resolver1.opendns.com/208.67.222.222）：响应代码为 NOERROR。看起来不错：一个非权威答案。
- 第二种情况（192.168.1.101）：响应代码为 NOERROR。零答案。存在权限部分，这表明与上游 DNS 服务器通信没有问题。（不是防火墙问题）
- 第三种情况（ns1.dreamhost.com/66.33.206.206）：NXDOMAIN 的响应代码。一个
AA设置了“auth answer”（）标志的答案：www.fandompost.com.cdn.cloudflare.net.
第三个很有趣。返回了一个权威答案，一条记录位于 ANSWER 部分，但响应代码是 NXDOMAIN。通常，在这种情况下，您会期望看到 NOERROR 的响应代码：权威名称服务器通常不会尝试为您递归解析 CNAME。
再看一下该答案的权威部分：
ANSWERS:
-> www.fandompost.com
type = CNAME, class = IN, dlen = 39
canonical name = www.fandompost.com.cdn.cloudflare.net
ttl = 300 (5 mins)
AUTHORITY RECORDS:
-> cloudflare.net
type = SOA, class = IN, dlen = 49
ttl = 14400 (4 hours)
primary name server = ns1.dreamhost.com
看到“主名称服务器”了吗？cloudflare.net显然，这个区域是由 ns1.dreamhost.com 提供的。我自己的快速搜索证实了这一点：
$ dig @ns1.dreamhost.com +norecurse fandompost.com cloudflare.net SOA | grep -E 'HEADER|flags'
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 11600
;; flags: qr aa rd; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 0
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 32367
;; flags: qr aa rd; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 0
两个 SOA 查询均存在该aa标志。您从 ns1.dreamhost.com 获得 NXDOMAIN 响应的原因是该名称服务器试为您解析www.fandompost.com.cdn.cloudflare.net.，因为它也认为自己对该域具有权威性，并且记录似乎丢失了。为什么 Dreamhost 有区域cloudflare.net.？询问 Dreamhost。这个 NXDOMAIN rcode 似乎不会对大多数递归解析器造成问题；我有一段时间没有关注过这个 RFC，但我最好的猜测是他们忽略了该响应代码并使用返回的答案。
这最终引出了您的问题：您的 DNS 服务器有问题吗？如果不知道您使用的软件，很难说。我可以说 BIND 和 Windows DNS 对此配置没有问题，并且您的软件处理方式可能与NXDOMAIN这两种实现方式不同。