## /etc/named.conf ``` // // named.conf // // Provided by Red Hat bind package to configure the ISC BIND named(8) DNS // server as a caching only nameserver (as a localhost DNS resolver only). // // See /usr/share/doc/bind*/sample/ for example named configuration files. // // See the BIND Administrator's Reference Manual (ARM) for details about the // configuration located in /usr/share/doc/bind-{version}/Bv9ARM.html options { listen-on port 53 { 127.0.0.1; }; # 指定 IPv4 监听端口和 IP listen-on-v6 port 53 { ::1; }; # 指定 IPv6 监听的端口和 IP directory "/var/named"; # 指定 named 数据文件目录 dump-file "/var/named/data/cache_dump.db"; # 设置域名缓存数据库文件位置 statistics-file "/var/named/data/named_stats.txt"; # 设置状态统计文件的位置 memstatistics-file "/var/named/data/named_mem_stats.txt"; # 设置服务器输出的内存使用统计信息 allow-query { localhost; }; # 设置允许 DNS 查询的客户端地址 /* - If you are building an AUTHORITATIVE DNS server, do NOT enable recursion. - If you are building a RECURSIVE (caching) DNS server, you need to enable recursion. - If your recursive DNS server has a public IP address, you MUST enable access control to limit queries to your legitimate users. Failing to do so will cause your server to become part of large scale DNS amplification attacks. Implementing BCP38 within your network would greatly reduce such attack surface */ recursion yes; # 设置递归查询 dnssec-enable yes; # 设置是否启用 DNSSEC 支持来验证 DNS 数据的有效性 dnssec-validation yes; # 设置是否启用 DNSSEC 确认 /* Path to ISC DLV key */ bindkeys-file "/etc/named.iscdlv.key"; # 设置内置信任的秘钥文件 managed-keys-directory "/var/named/dynamic"; # 指定目录中的文件存储位置，跟踪管理 DNSSEC 秘钥 pid-file "/run/named/named.pid"; session-keyfile "/run/named/session.key"; }; logging { # 配置定义 bind 服务的调试日志消息 channel default_debug { # 定义日志输出方式 file "data/named.run"; # 输出到纯文本文件 severity dynamic; # 消息的严重性等级，有 critical、error、warning、notice、info、debug[level]、dynamic 等，一般设置为 info 级别 }; }; zone "." IN { # 使用 zone 关键字来定义一个区域，一个 zone 关键字定义一个区域 type hint; # type 类型有三种，分别是 master（主域名服务器）、slave（辅助域名服务器） 和 hint（互联网中的根域名服务器） file "named.ca"; # file 用来指定存放 DNS 记录的数据库文件名称 allow-update { none; }; # 是否允许客户主机或服务器自行更新 DNS 记录 }; include "/etc/named.rfc1912.zones"; include "/etc/named.root.key"; ``` ### 正向区域 ``` zone "example.com" IN { type master; file "example.com"; }; ``` ### 反向区域 ``` zone "1.168.192.in-addr.arpa" { type master; file "1.168.192.zone"; }; ```