DNS子域授权
当一个域很大时，而且还有上，下层关系，如果所有的记录变更都由某一台服务器来管理的话，那将会是什么样子？就好比一个公司的总经理直接管理公司1000个人的所有事项，恐怕会被累死。所以会在总经理下面设科室，科室下面又分班组，这样一层管理一层会比较好管理些。
同样道理，DNS中也分域和子域，上层DNS可以将子域的管理授权给子域中的DNS服务器来管理记录的变更，这种做法就叫子域授权。
子域授权配置
假设父域为：frank.com,NS地址：master.frank.com 子域为：mf.frank.com,NS地址：sub.mf.frank.com
父域服务器配置
只需在区域解析库文件中添加下层DNS服务器的NS与A记录即可。
# vi /var/named/frank.com.zone
$TTL 1D
frank.com. IN SOA master.frank.com. admin.frank.com. (
201802002 ;序列号
3H ;刷新时间
10M ;重试时间间隔
1W ;过期时间
1D ;无法解析时否定答案的TTL值
)
frank.com. IN NS master.frank.com.
mf.frank.com. IN NS sub.mf.frank.com.
master.frank.com. IN A 192.168.138.200
sub.mf.frank.com. IN A 192.168.138.201
frank.com. IN MX 10 mx1.frank.com.
IN MX 20 mx2.frank.com.
mx1.frank.com. IN A 192.168.138.200
mx2.frank.com. IN A 192.168.138.200
www IN A 192.168.138.200
master IN CNAME www.frank.com.
web IN CNAME www.frank.com.
子域服务器配置
子域需要有完整的区域相关的配置，配置内容和主，从配置相同。
- 在/etc/named.rfc1912.zones中加入子域区域定义。
# vi /etc/named.conf
...
zone "mf.frank.com" IN {
type master;
file "mf.frank.com.zone";
};
- 创建mf.frank.com.zone区域解析库文件
# vi /var/named/mf.frank.com.zone
$TTL 600
@ IN SOA sub.mf.frank.com. admin.sub.mf.frank.com. (
201802001
2H
15M
1W
1D )
@ IN NS sub.mf.frank.com.
sub IN A 192.168.138.201
www IN A 192.168.138.201
配置完成重载配置文件
# rndc reload
server reload successful
在父域测试解析子域名www.mf.frank.com的A记录
# dig -t A www.mf.frank.com @192.168.138.200
; <<>> DiG 9.9.4-RedHat-9.9.4-51.el7_4.2 <<>> -t A www.mf.frank.com @192.168.138.200
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 17968
;; flags: qr rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 1, ADDITIONAL: 2
;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 4096
;; QUESTION SECTION:
;www.mf.frank.com. IN A
;; ANSWER SECTION:
www.mf.frank.com. 600 IN A 192.168.138.201
;; AUTHORITY SECTION:
mf.frank.com. 600 IN NS sub.mf.frank.com.
;; ADDITIONAL SECTION:
sub.mf.frank.com. 600 IN A 192.168.138.201
;; Query time: 19 msec
;; SERVER: 192.168.138.200#53(192.168.138.200)
;; WHEN: Sat Feb 24 22:27:22 CST 2018
;; MSG SIZE rcvd: 95
在子域DNS服务器添加指向父域的转发器
# vi /etc/named.rfc1912.conf
...
zone "mf.frank.com" IN {
type master;
file "mf.frank.com.zone";
};
//将查询父域的请求转发给父域DNS
zone "frank.com" IN {
type forward;
forward only;
forwarders { 192.168.138.200; };
};
配置完成重载配置文件
# rndc reload
server reload successful
在子域服务器上使用自己的DNS解析父域www.frank.com的A记录
# dig -t A www.frank.com @192.168.138.201
; <<>> DiG 9.9.4-RedHat-9.9.4-51.el7_4.2 <<>> -t A www.frank.com @192.168.138.201
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 63485
;; flags: qr rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 1, ADDITIONAL: 2
;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 4096
;; QUESTION SECTION:
;www.frank.com. IN A
;; ANSWER SECTION:
www.frank.com. 142 IN A 192.168.138.200
;; AUTHORITY SECTION:
frank.com. 142 IN NS master.frank.com.
;; ADDITIONAL SECTION:
master.frank.com. 142 IN A 192.168.138.200
;; Query time: 0 msec
;; SERVER: 192.168.138.201#53(192.168.138.201)
;; WHEN: Sat Feb 24 22:46:24 CST 2018
;; MSG SIZE rcvd: 95