CentOS 6.10搭建本地DNS緩存服務器
系統環境

1 [root@test ~]# cat /etc/redhat-release 
2 CentOS release 6.10 (Final)
3 [root@test ~]# uname -r
4 2.6.32-754.el6.x86_64
5 [root@test ~]# getenforce 
6 Disabled
7 [root@test ~]# /etc/init.d/iptables stop

安裝DNS服務包

1 [root@test ~]# yum -y install bind bind-libs bind-utils

修改配置文件
bind DNS服務的主配置文件是/etc/named.conf，默認情況下是已經啟用了本地緩存功能。不過為了加快查詢速度和解決一些報錯，通常情況下我們還需要一些調整。

 1 [root@test ~]# cat /etc/named.conf
 2 //
 3 // named.conf
 4 //
 5 // Provided by Red Hat bind package to configure the ISC BIND named(8) DNS
 6 // server as a caching only nameserver (as a localhost DNS resolver only).
 
 7 //
 8 // See /usr/share/doc/bind*/sample/ for example named configuration files.
 9 //
10 
11 options {
12 listen-on port 53 { any; };
13 // listen-on-v6 port 53 { ::1; };
14 directory "/var/named";
15 dump-file "/var/named/data/cache_dump.db";
16 statistics-file "/var/named/data/named_stats.txt";
17 memstatistics-file
 
 "/var/named/data/named_mem_stats.txt";
18 allow-query { any; };
19 recursion yes;
20 forworders { 114.114.114.114; 8.8.8.8; };
21 dnssec-enable no;
22 dnssec-validation yes;
23 
24 /* Path to ISC DLV key */
25 bindkeys-file "/etc/named.iscdlv.key";
26 
27 managed-keys-directory "/var/named/dynamic";
28 };
29 
30 logging {
31 channel default_debug {
32 file "data/named.run";
33 severity dynamic;
34 };
35 };
36 
37 zone "." IN {
38 type hint;
39 file "named.ca";
40 };
41 
42 include "/etc/named.rfc1912.zones";
43 include "/etc/named.root.key";

此時已完成了一個本地緩存服務器的配置。
測試本地緩存服務器

 1 [root@test ~]# ip a
 2 1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN 
 3 link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
 4 inet 127.0.0.1/8 scope host lo
 5 inet6 ::1/128 scope host 
 6 valid_lft forever preferred_lft forever
 7 2: eth0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UP qlen 1000
 8 link/ether 00:0c:29:18:98:2b brd ff:ff:ff:ff:ff:ff
 9 inet 10.0.0.77/24 brd 10.0.0.255 scope global eth0
10 inet6 fe80::20c:29ff:fe18:982b/64 scope link 
11 valid_lft forever preferred_lft forever
12 
13 [root@test ~]# cat /etc/resolv.conf
14 nameserver 10.0.0.77
15 
16 [root@test ~]# nslookup
17 > www.baidu.com
18 Server: 10.0.0.77
19 Address: 10.0.0.77#53
20 
21 Non-authoritative answer:
22 www.baidu.com canonical name = www.a.shifen.com.
23 Name: www.a.shifen.com
24 Address: 115.239.210.27
25 Name: www.a.shifen.com
26 Address: 115.239.211.112
27 [root@test ~]# ping baidu.com
28 PING baidu.com (220.181.57.216) 56(84) bytes of data.
29 64 bytes from 220.181.57.216: icmp_seq=1 ttl=128 time=30.5 ms
30 64 bytes from 220.181.57.216: icmp_seq=2 ttl=128 time=30.9 ms

禁用IPv6解析
1）註釋主配置文件的IPv6選項
2）修改/etc/sysconfig/named文件
OPTIONS="whatever" 改為 OPTIONS="-4"
# 註意OPTIONS選項的值可以是：whatever、-4、-6中的一個
禁用dnssec功能
為什麽禁用？

1 Dec 20 14:52:22 test named[2159]: error (insecurity proof failed) resolving ‘in-addr.arpa/DNSKEY/IN‘: 114.114.114.114#53
2 Dec 20 14:52:22 test named[2159]: validating @0x7fc654456820: 123.in-addr.arpa SOA: got insecure response; parent indicates it should be secure
3 Dec 20 14:52:22 test named[2159]: error (no valid RRSIG) resolving ‘125.123.in-addr.arpa/DS/IN‘: 114.114.114.114#53
4 Dec 20 14:52:22 test named[2159]: validating @0x7fc6544574b0: 123.in-addr.arpa DNSKEY: got insecure response; parent indicates it should be secure

dnssec功能會對解析結果進行驗證，是否為權威解答，不是就會報錯，雖然不影響使用，但是看著不爽。
怎麽禁用？
修改主配置文件

1 # vim /etc/named.conf
2 dnssec-enable no;
3 dnssec-validation no;

創建本地DNS服務器，解析本地DNS記錄
我們只需要在上面的DNS緩存服務器上增加個zone區域文件即可。

1 # vim /etc/named.rfc1912.zones
2 # 最後面加上這個zone
3 zone "test" IN {
4 type master;
5 file "test.zone";
6 allow-update { none; };
7 };

# 創建對應的test.zone文件（配置解析記錄）

1 [root@test ~]# cp -a /var/named/named.localhost /var/named/test.zone

把要解析的記錄寫進該文件
重啟DNS服務即可
listen與query項出於安全考慮，也可以將any設置為192.168.1.0/24這樣的格式；
dump-file項需要註意的是默認情況下dns本地緩存數據都是存放在內存中，只有在使用rndc dumpdb -all 時才會將內存中的數據保存在本地盤中，保存的路徑就是該項配置的名稱；
啟用forwarders查詢會減少本地流量的浪費，直接從轉發的服務器上查詢的結果返回；

Linux下DNS緩存服務器的搭建