DNS子域受权

DNS子域受权

当一个域很大时，并且还有上，下层关系，若是全部的记录变动都由某一台服务器来管理的话，那将会是什么样子？就比如一个公司的总经理直接管理公司1000我的的全部事项，恐怕会被累死。因此会在总经理下面设科室，科室下面又分班组，这样一层管理一层会比较好管理些。
一样道理，DNS中也分域和子域，上层DNS能够将子域的管理受权给子域中的DNS服务器来管理记录的变动，这种作法就叫子域受权。

子域受权配置

假设父域为：frank.com,NS地址：master.frank.com 子域为：mf.frank.com,NS地址：sub.mf.frank.com

父域服务器配置

只需在区域解析库文件中添加下层DNS服务器的NS与A记录便可。

# vi /var/named/frank.com.zone
$TTL 1D
frank.com.  IN SOA  master.frank.com.    admin.frank.com. (
        201802002   ;序列号
        3H          ;刷新时间
        10M         ;重试时间间隔
        1W          ;过时时间
        1D          ;没法解析时否认答案的TTL值
        )
frank.com.           IN  NS  master.frank.com.
mf.frank.com.        IN  NS  sub.mf.frank.com.
master.frank.com.    IN  A   192.168.138.200
sub.mf.frank.com.    IN  A   192.168.138.201
frank.com.           IN  MX 10  mx1.frank.com.
                     IN  MX 20  mx2.frank.com.
mx1.frank.com.       IN  A   192.168.138.200
mx2.frank.com.       IN  A   192.168.138.200
www                  IN  A   192.168.138.200
master               IN  CNAME   www.frank.com.
web                  IN  CNAME   www.frank.com.

子域服务器配置

子域须要有完整的区域相关的配置，配置内容和主，从配置相同。

• 在/etc/named.rfc1912.zones中加入子域区域定义。

# vi /etc/named.conf
...
zone "mf.frank.com" IN {
    type master;
    file "mf.frank.com.zone";
};

• 建立mf.frank.com.zone区域解析库文件

# vi /var/named/mf.frank.com.zone
$TTL 600
@   IN SOA  sub.mf.frank.com.   admin.sub.mf.frank.com. ( 
        201802001
        2H
        15M
        1W
        1D )
@   IN  NS  sub.mf.frank.com.
sub IN  A   192.168.138.201
www IN  A   192.168.138.201

配置完成重载配置文件

# rndc reload
server reload successful

在父域测试解析子域名www.mf.frank.com的A记录

# dig -t A www.mf.frank.com @192.168.138.200

; <<>> DiG 9.9.4-RedHat-9.9.4-51.el7_4.2 <<>> -t A www.mf.frank.com @192.168.138.200
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 17968
;; flags: qr rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 1, ADDITIONAL: 2

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 4096
;; QUESTION SECTION:
;www.mf.frank.com.      IN  A

;; ANSWER SECTION:
www.mf.frank.com.   600 IN  A   192.168.138.201

;; AUTHORITY SECTION:
mf.frank.com.       600 IN  NS  sub.mf.frank.com.

;; ADDITIONAL SECTION:
sub.mf.frank.com.   600 IN  A   192.168.138.201

;; Query time: 19 msec
;; SERVER: 192.168.138.200#53(192.168.138.200)
;; WHEN: Sat Feb 24 22:27:22 CST 2018
;; MSG SIZE  rcvd: 95

在子域DNS服务器添加指向父域的转发器

# vi /etc/named.rfc1912.conf
...
zone "mf.frank.com" IN {
    type    master;
    file "mf.frank.com.zone";
};
//将查询父域的请求转发给父域DNS
zone "frank.com" IN {
    type    forward;
    forward only;
    forwarders { 192.168.138.200; };
};

配置完成重载配置文件

# rndc reload
server reload successful

在子域服务器上使用本身的DNS解析父域www.frank.com的A记录

# dig -t A www.frank.com @192.168.138.201

; <<>> DiG 9.9.4-RedHat-9.9.4-51.el7_4.2 <<>> -t A www.frank.com @192.168.138.201
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 63485
;; flags: qr rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 1, ADDITIONAL: 2

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 4096
;; QUESTION SECTION:
;www.frank.com.         IN  A

;; ANSWER SECTION:
www.frank.com.      142 IN  A   192.168.138.200

;; AUTHORITY SECTION:
frank.com.      142 IN  NS  master.frank.com.

;; ADDITIONAL SECTION:
master.frank.com.   142 IN  A   192.168.138.200

;; Query time: 0 msec
;; SERVER: 192.168.138.201#53(192.168.138.201)
;; WHEN: Sat Feb 24 22:46:24 CST 2018
;; MSG SIZE  rcvd: 95