我遇到了一个绑定设置，其中只有一个 DNSSEC 值设置如下：
dnssec-validation yes;
并且named.conf.options中的键声明如下：
include "/etc/bind.keys"
然而，其余部分：
dnssec-enable yes;
dnssec-lookaside auto;
根本没有在任何地方设置。
现在的问题是这个设置到底能不能用？我没有看到任何错误。如果能提供任何评论/建议/意见，我将不胜感激。提前致谢！
答案1
阅读评论后，让我使用 bind 展示两种情况（dnssec针对您的域和dnssec客户端）的设置views。
考虑以下配置（我在生产中使用）
options {
listen-on port 53 { any; };
max-cache-size 128M;
interface-interval 0;
notify explicit;
allow-transfer { none; };
allow-update { none; };
allow-recursion { none; };
forwarders {
2620:119:35::35;
2620:119:53::53;
208.67.222.222;
208.67.220.220;
2001:4860:4860::8888;
2001:4860:4860::8844;
8.8.8.8;
8.8.4.4;
};
//dig -t txt -c chaos VERSION.BIND @<dns.server.com>
version "Microsoft Windobe 2008 DNS Server. Et je t'emmerde (-_-)";
auth-nxdomain no; # love RFC1035
dnssec-enable yes;
dnssec-validation auto;
};
acl internal {
127.0.0.0/8;
::1/128;
10.0.0.0/8;
fd9f::/64;
};
acl external {
any;
};
view "internal" {
match-clients {
internal;
};
allow-recursion {
any;
};
};
view "external" {
match-clients {
any;
};
recursion no;
zone "127-0-0-1.fr" {
type master;
file "/var/lib/bind/127-0-0-1.fr.db";
key-directory "/var/lib/bind";
auto-dnssec maintain;
inline-signing yes;
};
};
该 BIND9 服务器充当域的权威名称服务器127-0-0-1.fr，并充当内部（私人）客户端的递归名称服务器。
让我们尝试以内部客户端的身份解析启用 DNSSEC（完整链正常）的域dig @fd9f::10:0:0:2 www.isc.org
; <<>> DiG 9.14.4 <<>> @fd9f::10:0:0:2 isc.org
; (1 server found)
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 49658
;; flags: qr rd ra ad; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 1
;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 4096
; COOKIE: d1c6f836121beafdedbc5fae5d5e281dc5c58851413f4fb2 (good)
;; QUESTION SECTION:
;isc.org. IN A
;; ANSWER SECTION:
isc.org. 59 IN A 149.20.1.66
;; Query time: 136 msec
;; SERVER: fd9f::10:0:0:2#53(fd9f::10:0:0:2)
;; WHEN: Thu Aug 22 07:29:01 CEST 2019
;; MSG SIZE rcvd: 80
注意ad标志意味着经过验证的数据. 请查看delv @fd9f::10:0:0:2 www.isc.org
;; fetch: isc.org/A
;; fetch: isc.org/DNSKEY
;; fetch: isc.org/DS
;; fetch: org/DNSKEY
;; fetch: org/DS
;; fetch: ./DNSKEY
; fully validated
isc.org. 59 IN A 149.20.1.66
isc.org. 59 IN RRSIG A 5 2 60 (
20190904145623 20190805140610 28347 isc.org.
ty+0um1WeOQvOIDMfA0w4spR4qNwm4Pj581KA9xXMFro
0+N0bKDAcDJ3O8EpdEHzjejXU0GqrJvIyml7fpvmbcN4
b2QWr/INjW8e+MzFz49oajGF0G1Oi6Qzp/XIljibsSig
FUTZsnp5yL77PF2eJEc4CDlfgJOCGsYnWTEaNuI= )
isc.org. 59 IN RRSIG A 13 2 60 (
20190904145623 20190805140610 27566 isc.org.
QiL6Al0ycqO/Fxl4OUR017ck/Y6xnRG4qt/pRvzG1H/y
+xyt9EU3pvNqbus5mQYF7ruH6BFyQg5w94bnnjivGg== )
现在同样的检查不 DNSSESC已启用的域dig @fd9f::10:0:0:2 dnssec-failed.org
; <<>> DiG 9.14.4 <<>> @fd9f::10:0:0:2 dnssec-failed.org
; (1 server found)
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: SERVFAIL, id: 21410
;; flags: qr rd ra; QUERY: 1, ANSWER: 0, AUTHORITY: 0, ADDITIONAL: 1
;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 4096
; COOKIE: 758deba64c4f30ba6ac402da5d5e28d3572fa9aa192352cd (good)
;; QUESTION SECTION:
;dnssec-failed.org. IN A
;; Query time: 4298 msec
;; SERVER: fd9f::10:0:0:2#53(fd9f::10:0:0:2)
;; WHEN: Thu Aug 22 07:32:03 CEST 2019
;; MSG SIZE rcvd: 74
如您所见，解析失败，SERVFAIL并且绑定日志显示
bind | 22-Aug-2019 04:17:09.845 client @0x55b0a804ea80 fd9f::1#49348 (www.dnssec-failed.org): view internal: query: www.dnssec-failed.org IN A +E(0)K (fd9f::10:0:0:2)
bind | 22-Aug-2019 04:17:09.938 view internal: validating www.dnssec-failed.org/A: bad cache hit (dnssec-failed.org/DNSKEY)
bind | 22-Aug-2019 04:17:09.938 broken trust chain resolving 'www.dnssec-failed.org/A/IN': 2001:4860:4860::8888#53
bind | 22-Aug-2019 04:17:09.938 client @0x55b0a804ea80 fd9f::1#49348 (www.dnssec-failed.org): view internal: query failed (broken trust chain) for www.dnssec-failed.org/IN/A at query.c:6786
但是如果我强制解决，dig @fd9f::10:0:0:2 dnssec-failed.org +cd我能够得到响应，但没有do标志，响应就不会被签名。
127-0-0-1.fr现在让我们从外部对我的域进行一些检查delv @2001:4860:4860::8888 www.127-0-0-1.fr +rtrace +multiline
;; fetch: www.127-0-0-1.fr/A
;; fetch: 127-0-0-1.fr/DNSKEY
;; fetch: 127-0-0-1.fr/DS
;; fetch: fr/DNSKEY
;; fetch: fr/DS
;; fetch: ./DNSKEY
; fully validated
www.127-0-0-1.fr. 3599 IN A 164.132.222.187
www.127-0-0-1.fr. 3599 IN RRSIG A 7 2 3600 (
20190914021052 20190815015938 64469 127-0-0-1.fr.
aaQN/x+ZEfV1Vgp78QGdCEByau22cmt61pQ+7c+VdiUh
gmOy0+sPHcJZT6aq6FKRLMc+I76R/ZrzAnCK7mr96vXb
SCyiIVYGMva9lsl95zi4DK5FxacekonBkwB/l/upBhxb
Iiw+l3AZ4J19I7nQgGCSxj7vWqtQD1sb8jue/fw= )
最后检查一下dig @2001:4860:4860::8888 www.127-0-0-1.fr
; <<>> DiG 9.14.4 <<>> @2001:4860:4860::8888 www.127-0-0-1.fr
; (1 server found)
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 45032
;; flags: qr rd ra ad; QUERY: 1, ANSWER: 1, AUTHORITY: 2, ADDITIONAL: 1
;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 512
;; QUESTION SECTION:
;www.127-0-0-1.fr. IN A
;; ANSWER SECTION:
www.127-0-0-1.fr. 3536 IN A 164.132.222.187
;; AUTHORITY SECTION:
127-0-0-1.fr. 3536 IN NS brown-sugar.127-0-0-1.fr.
127-0-0-1.fr. 3536 IN NS black-pearl.127-0-0-1.fr.
;; Query time: 10 msec
;; SERVER: 2001:4860:4860::8888#53(2001:4860:4860::8888)
;; WHEN: Thu Aug 22 06:23:52 CEST 2019
;; MSG SIZE rcvd: 113
展示ad旗帜意味着经过验证的数据。您可以使用基于 Web 的工具进行检查，例如dnssec 分析器