![为什么仅转发本地缓存 bind9 实例查询“根”区域服务器?](https://linux22.com/image/888773/%E4%B8%BA%E4%BB%80%E4%B9%88%E4%BB%85%E8%BD%AC%E5%8F%91%E6%9C%AC%E5%9C%B0%E7%BC%93%E5%AD%98%20bind9%20%E5%AE%9E%E4%BE%8B%E6%9F%A5%E8%AF%A2%E2%80%9C%E6%A0%B9%E2%80%9D%E5%8C%BA%E5%9F%9F%E6%9C%8D%E5%8A%A1%E5%99%A8%EF%BC%9F.png)
我正在配置本地仅转发 DNS(bind9)服务器。具有以下配置:
options {
directory "/var/cache/bind";
recursion yes; /* So that server could answer queries about domains its is not authoritative for. */
allow-query { homeclients; };
forwarders {
8.8.8.8;
8.8.4.4;
};
forward only;
dnssec-enable yes;
dnssec-validation yes;
auth-nxdomain no; # conform to RFC1035
listen-on port 53 {
127.0.0.1;
192.168.1.33;
};
listen-on-v6 { any; };
};
但当我这样做时:
dig @127.0.0.1 ubuntu.com +trace
我得到:
; (1 server found)
;; global options: +cmd
. 3600000 IN NS J.ROOT-SERVERS.NET.
...
. 3600000 IN NS K.ROOT-SERVERS.NET.
;; Received 811 bytes from 127.0.0.1#53(127.0.0.1) in 0 ms
ubuntu.com. 3600 IN A 91.189.94.40
;; Received 55 bytes from 192.33.4.12#53(C.ROOT-SERVERS.NET) in 1 ms
挖从本地获取信息绑定根据我的配置,该实例应将所有查询转发到 Google 的 DNS 服务器。但它也会询问根服务器...
为什么仅转发 DNS 服务器询问“根”服务器?谢谢。
答案1
我认为您误解了 dig 的跟踪模式的实际工作方式。查看 dig 的手册页,您会得到以下信息:
+[no]trace
Toggle tracing of the delegation path from the root name servers
for the name being looked up. Tracing is disabled by default. When
tracing is enabled, dig makes iterative queries to resolve the name
being looked up. It will follow referrals from the root servers,
showing the answer from each server that was used to resolve the
lookup.
If @server is also specified, it affects only the initial query for
the root zone name servers.
特别是最后一部分明确指出,它将dig +trace @server
向服务器询问根名称服务器,然后自行接管和迭代下一级的名称服务器。
不过,我理解你的疑惑——我必须自己去查一下;)