我已经在 virtualmin 上设置了一个 bind9 dns 服务器，并为以下域和以下名称服务器创建了 dns 区域。
域名 = thecrystalsms.com 名称服务器 ns5.crystalhost.net ns6.crystalhost.net
ns5 和 ns6 均正确解析为 182.93.78.27
当我在我的服务器中运行以下命令时
host -t ns thecrystalsms.com
表明
thecrystalsms.com name server ns6.crystalhost.net.
thecrystalsms.com name server ns5.crystalhost.net.
但是当我从外部查询 thecrystalsms.com 的 DNS 时，它失败了。
以下是我的 DNS 区域条目
$ttl 38400
@ IN SOA ns5.crystalhost.net. root.ns5.crystalhost.net. (
1559739241
10800
3600
604800
38400 )
@ IN NS ns5.crystalhost.net.
@ IN NS ns6.crystalhost.net.
thecrystalsms.com. IN A 182.93.78.27
www.thecrystalsms.com. IN A 182.93.78.27
ftp.thecrystalsms.com. IN A 182.93.78.27
m.thecrystalsms.com. IN A 182.93.78.27
localhost.thecrystalsms.com. IN A 127.0.0.1
webmail.thecrystalsms.com. IN A 182.93.78.27
admin.thecrystalsms.com. IN A 182.93.78.27
mail.thecrystalsms.com. IN A 182.93.78.27
thecrystalsms.com. IN MX 5 mail.thecrystalsms.com.
thecrystalsms.com. IN TXT "v=spf1 a mx a:thecrystalsms.com ip4:182.93.78.27 ip4:182.93.78.27 ip6:fe80::250:56ff:fe8c:d4ad -all"
_dmarc.thecrystalsms.com. IN TXT "v=DMARC1; pct=100; ruf=mailto:[email protected]; rua=mailto:[email protected]; p=reject"
不明白问题是什么。
也重启了服务器多次。
输出netstat -an|grep :53给出
tcp 0 0 182.93.78.27:53 0.0.0.0:* LISTEN
tcp 0 0 127.0.0.1:53 0.0.0.0:* LISTEN
tcp6 0 0 :::53 :::* LISTEN
udp 0 0 182.93.78.27:53 0.0.0.0:*
udp 0 0 127.0.0.1:53 0.0.0.0:*
udp6 0 0 :::53 :::*
端口扫描器结果
Not shown: 840 closed ports, 142 filtered ports
PORT STATE SERVICE
21/tcp open ftp
22/tcp open ssh
25/tcp open smtp
53/tcp open domain
80/tcp open http
110/tcp open pop3
143/tcp open imap
443/tcp open https
465/tcp open smtps
587/tcp open submission
993/tcp open imaps
995/tcp open pop3s
2222/tcp open unknown
8000/tcp open http-alt
8001/tcp open unknown
8002/tcp open teradataordbms
10000/tcp open snet-sensor-mgmt
20000/tcp open unknown
Nmap done: 1 IP address (1 host up) scanned in 20.40 seconds
我运行了 zenmap 工具并发现以下结果
nmap -sS -sU -T4 -A -v thecrystalsms.com
Starting Nmap 7.70 ( https://nmap.org ) at 2019-06-11 12:02 Nepal Standard Time
NSE: Loaded 148 scripts for scanning.
NSE: Script Pre-scanning.
Initiating NSE at 12:02
Completed NSE at 12:02, 0.00s elapsed
Initiating NSE at 12:02
Completed NSE at 12:02, 0.00s elapsed
Initiating Ping Scan at 12:02
Scanning thecrystalsms.com (182.93.78.27) [4 ports]
Completed Ping Scan at 12:02, 0.75s elapsed (1 total hosts)
Initiating Parallel DNS resolution of 1 host. at 12:02
Completed Parallel DNS resolution of 1 host. at 12:02, 0.01s elapsed
Initiating SYN Stealth Scan at 12:02
Scanning thecrystalsms.com (182.93.78.27) [1000 ports]
Discovered open port 443/tcp on 182.93.78.27
Discovered open port 995/tcp on 182.93.78.27
Discovered open port 80/tcp on 182.93.78.27
Discovered open port 21/tcp on 182.93.78.27
Discovered open port 53/tcp on 182.93.78.27
Discovered open port 143/tcp on 182.93.78.27
Discovered open port 993/tcp on 182.93.78.27
Discovered open port 587/tcp on 182.93.78.27
Discovered open port 22/tcp on 182.93.78.27
Discovered open port 110/tcp on 182.93.78.27
Discovered open port 10000/tcp on 182.93.78.27
Discovered open port 20000/tcp on 182.93.78.27
Discovered open port 8007/tcp on 182.93.78.27
Discovered open port 465/tcp on 182.93.78.27
Discovered open port 8002/tcp on 182.93.78.27
Discovered open port 8000/tcp on 182.93.78.27
Discovered open port 2222/tcp on 182.93.78.27
Completed SYN Stealth Scan at 12:02, 2.04s elapsed (1000 total ports)
Initiating UDP Scan at 12:02
Scanning thecrystalsms.com (182.93.78.27) [1000 ports]
Discovered open port 53/udp on 182.93.78.27
Increasing send delay for 182.93.78.27 from 0 to 50 due to max_successful_tryno increase to 5
Increasing send delay for 182.93.78.27 from 50 to 100 due to max_successful_tryno increase to 6
Warning: 182.93.78.27 giving up on port because retransmission cap hit (6).
UDP Scan Timing: About 31.30% done; ETC: 12:04 (0:01:08 remaining)
UDP Scan Timing: About 37.70% done; ETC: 12:05 (0:01:41 remaining)
看来我的服务器也打开了 udp 端口。此外，当我通过命令行查找 ns 时，它显示以下结果
nslookup thecrystalsms.com 182.93.78.27
Server: UnKnown
Address: 182.93.78.27
Name: thecrystalsms.com
Address: 182.93.78.27
但是当我运行 nslookup thecrystalsms.com 8.8.8.8 时，响应是
DNS request timed out.
timeout was 2 seconds.
Server: UnKnown
Address: 192.93.78.27
DNS request timed out.
timeout was 2 seconds.
DNS request timed out.
timeout was 2 seconds.
DNS request timed out.
timeout was 2 seconds.
DNS request timed out.
timeout was 2 seconds.
*** Request to UnKnown timed-out
无法找出 bind9 或其他地方的问题。
答案1
如果我通过 UDP 查询你的名称服务器，则会出现超时：
triss:~> dig @ns6.crystalhost.net. thecrystalsms.com soa
; <<>> DiG 9.9.4-RedHat-9.9.4-73.el7_6 <<>> @ns6.crystalhost.net. thecrystalsms.com soa
; (1 server found)
;; global options: +cmd
;; connection timed out; no servers could be reached
如果我使用 TCP 进行查询，它会起作用：
triss:~> dig @ns6.crystalhost.net. thecrystalsms.com soa +tcp
; <<>> DiG 9.9.4-RedHat-9.9.4-73.el7_6 <<>> @ns6.crystalhost.net. thecrystalsms.com soa +tcp
; (1 server found)
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 52568
;; flags: qr aa rd; QUERY: 1, ANSWER: 1, AUTHORITY: 2, ADDITIONAL: 1
;; WARNING: recursion requested but not available
;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 4096
;; QUESTION SECTION:
;thecrystalsms.com. IN SOA
;; ANSWER SECTION:
thecrystalsms.com. 38400 IN SOA ns5.crystalhost.net. root.ns5.crystalhost.net. 1559739241 10800 3600 604800 38400
;; AUTHORITY SECTION:
thecrystalsms.com. 38400 IN NS ns5.crystalhost.net.
thecrystalsms.com. 38400 IN NS ns6.crystalhost.net.
;; Query time: 218 msec
;; SERVER: 182.93.78.27#53(182.93.78.27)
;; WHEN: wto cze 11 09:07:34 CEST 2019
;; MSG SIZE rcvd: 138
显然有人阻止了您的 DNS UDP 端口。端口开放的事实与端口可能被阻止的事实是相互关联的：要么是您的主机上的防火墙阻止了端口，要么是网络上的某个人阻止了您的主机。请先检查您的防火墙，如果这不是罪魁祸首 - 请与您的 ISP 合作，确定他们是否阻止了对 DNS UDP 端口的访问 - 有些人可能这样做是为了防止 DNS 放大攻击。