☰

在 Debian 和 linode 上设置 AXFR

tag-icon • tag-icon debian bind
在 Debian 和 linode 上设置 AXFR

按照本教程操作后出现错误： https://www.linode.com/docs/websites/cms/set-up-dns-services-on-cpanel/

DNS servers responded   
ERROR: One or more of your nameservers did not respond:
The ones that did not respond are:
162.159.27.72 162.159.26.99 162.159.24.25 162.159.24.39 162.159.25.129

我可以使用下面列出的名称服务器执行递归查询。我可能错了，但可能性很低。您不应该使用允许递归查询的名称服务器，因为这将允许几乎任何人使用您的名称服务器并可能导致问题。问题记录为：

162.159.26.99
162.159.24.39
162.159.24.25
162.159.27.72
162.159.25.129

我目前做了什么：

1）在我的域名注册商处添加名称服务器

ns1.example.com
ns2.example.com
ns1.linode.com
ns2.linode.com
ns3.linode.com
ns4.linode.com
ns5.linode.com

2）更新named.conf.options文件

3）添加从属区域

nano /etc/bind/named.conf.options

options {
        directory "/var/cache/bind";

        // If there is a firewall between you and nameservers you want
        // to talk to, you may need to fix the firewall to allow multiple
        // ports to talk.  See http://www.kb.cert.org/vuls/id/800113

        // If your ISP provided one or more IP addresses for stable
        // nameservers, you probably want to use them as forwarders.
        // Uncomment the following block, and insert the addresses replacing
        // the all-0's placeholder.

        // forwarders {
        //      0.0.0.0;
        // };

        //========================================================================
        // If BIND logs error messages about the root key being expired,
        // you will need to update your keys.  See https://www.isc.org/bind-keys
        //========================================================================
        dnssec-enable yes;
        dnssec-validation yes;
        dnssec-lookaside auto;

        auth-nxdomain no;    # conform to RFC1035
        listen-on-v6 { any; };


        allow-transfer {
     104.237.137.10;
     65.19.178.10;
     75.127.96.10;
     207.192.70.10;
     109.74.194.10;
     2600:3c00::a;
     2600:3c01::a;
     2600:3c02::a;
     2600:3c03::a;
     2a01:7e00::a;
 };
 also-notify {
     104.237.137.10;
     65.19.178.10;
     75.127.96.10;
     207.192.70.10;
     109.74.194.10;
     2600:3c00::a;
     2600:3c01::a;
     2600:3c02::a;
     2600:3c03::a;
     2a01:7e00::a;
 };

        // Do not make public version of BIND
        version none;
};

挖

; <<>> DiG 9.10.3-P4-Debian <<>> axfr @162.159.27.72 revelhost.net
; (1 server found)
;; global options: +cmd
; Transfer failed.

答案1

在评论和聊天中讨论这个问题时，named日志中说了这样的话

client 104.237.137.10#45797 (example.com): zone transfer 'example.com/AXFR/IN' denied

在进一步询问命名配置实际包含的内容后，结果发现问题中显示的allow-transfer全局级别（内部）的指令实际上在区域级别（相关内部）被覆盖，以不允许这些从属名称服务器。optionszone

相关内容