主页 / server / 问题 / 682649
Accepted
Digital ink
Asked: 2015-04-15 09:37:12 +0800 CST

试图理解 DNS 解析不一致

  • 772

我正在使用我遇到的 DNS 问题来帮助我更好地理解 DNS 解析。我似乎无法弄清楚解析 www.fandompost.com 时看到的不一致。我的查询列表顶部是 OpenDNS。当被查询时，他们将返回一个适当的 ip。列表中的下一个是我们的内部 DNS 服务器。它确实返回有用的信息，但不是可用的 IP。最后是我查询权威的NS。尽管如此，与 OpenDNS 不同的是，最终的结果是没有可用的 IP。我/我们在内部 DNS 服务器上做错了什么，导致我们的服务器在 OpenDNS 成功的地方出现故障？

> www.fandompost.com.
Server:  [208.67.222.222]
Address:  208.67.222.222

------------
SendRequest(), len 36
    HEADER:
        opcode = QUERY, id = 45, rcode = NOERROR
        header flags:  query
        questions = 1,  answers = 0,  authority records = 0,  additional = 0

    QUESTIONS:
        www.fandompost.com, type = A, class = IN

------------
------------
Got answer (119 bytes):
    HEADER:
        opcode = QUERY, id = 45, rcode = NOERROR
        header flags:  response, recursion avail.
        questions = 1,  answers = 3,  authority records = 0,  additional = 0

    QUESTIONS:
        www.fandompost.com, type = A, class = IN
    ANSWERS:
    ->  www.fandompost.com
        type = CNAME, class = IN, dlen = 39
        canonical name = www.fandompost.com.cdn.cloudflare.net
        ttl = 0 (0 secs)
    ->  www.fandompost.com.cdn.cloudflare.net
        type = A, class = IN, dlen = 4
        internet address = 108.162.206.239
        ttl = 0 (0 secs)
    ->  www.fandompost.com.cdn.cloudflare.net
        type = A, class = IN, dlen = 4
        internet address = 108.162.205.239
        ttl = 0 (0 secs)

------------
Non-authoritative answer:
------------
SendRequest(), len 36
    HEADER:
        opcode = QUERY, id = 46, rcode = NOERROR
        header flags:  query
        questions = 1,  answers = 0,  authority records = 0,  additional = 0

    QUESTIONS:
        www.fandompost.com, type = AAAA, class = IN

------------
------------
Got answer (36 bytes):
    HEADER:
        opcode = QUERY, id = 46, rcode = SERVFAIL
        header flags:  response, recursion avail.
        questions = 1,  answers = 0,  authority records = 0,  additional = 0

    QUESTIONS:
        www.fandompost.com, type = AAAA, class = IN

------------
Name:    www.fandompost.com.cdn.cloudflare.net
Addresses:  108.162.206.239
          108.162.205.239
Aliases:  www.fandompost.com

> www.fandompost.com.
Server:  [192.168.1.101]
Address:  192.168.1.101

------------
SendRequest(), len 36
    HEADER:
        opcode = QUERY, id = 48, rcode = NOERROR
        header flags:  query
        questions = 1,  answers = 0,  authority records = 0,  additional = 0

    QUESTIONS:
        www.fandompost.com, type = A, class = IN

------------
------------
Got answer (162 bytes):
    HEADER:
        opcode = QUERY, id = 48, rcode = NOERROR
        header flags:  response, recursion avail.
        questions = 1,  answers = 0,  authority records = 3,  additional = 3

    QUESTIONS:
        www.fandompost.com, type = A, class = IN
    AUTHORITY RECORDS:
    ->  fandompost.com
        type = NS, class = IN, dlen = 16
        nameserver = ns1.dreamhost.com
        ttl = 84200 (23 hours 23 mins 20 secs)
    ->  fandompost.com
        type = NS, class = IN, dlen = 6
        nameserver = ns2.dreamhost.com
        ttl = 84200 (23 hours 23 mins 20 secs)
    ->  fandompost.com
        type = NS, class = IN, dlen = 6
        nameserver = ns3.dreamhost.com
        ttl = 84200 (23 hours 23 mins 20 secs)
    ADDITIONAL RECORDS:
    ->  ns1.dreamhost.com
        type = A, class = IN, dlen = 4
        internet address = 66.33.206.206
        ttl = 84581 (23 hours 29 mins 41 secs)
    ->  ns2.dreamhost.com
        type = A, class = IN, dlen = 4
        internet address = 208.97.182.10
        ttl = 84581 (23 hours 29 mins 41 secs)
    ->  ns3.dreamhost.com
        type = A, class = IN, dlen = 4
        internet address = 66.33.216.216
        ttl = 84581 (23 hours 29 mins 41 secs)

------------
------------
SendRequest(), len 36
    HEADER:
        opcode = QUERY, id = 49, rcode = NOERROR
        header flags:  query
        questions = 1,  answers = 0,  authority records = 0,  additional = 0

    QUESTIONS:
        www.fandompost.com, type = AAAA, class = IN

------------
------------
Got answer (162 bytes):
    HEADER:
        opcode = QUERY, id = 49, rcode = NOERROR
        header flags:  response, recursion avail.
        questions = 1,  answers = 0,  authority records = 3,  additional = 3

    QUESTIONS:
        www.fandompost.com, type = AAAA, class = IN
    AUTHORITY RECORDS:
    ->  fandompost.com
        type = NS, class = IN, dlen = 16
        nameserver = ns2.dreamhost.com
        ttl = 84200 (23 hours 23 mins 20 secs)
    ->  fandompost.com
        type = NS, class = IN, dlen = 6
        nameserver = ns3.dreamhost.com
        ttl = 84200 (23 hours 23 mins 20 secs)
    ->  fandompost.com
        type = NS, class = IN, dlen = 6
        nameserver = ns1.dreamhost.com
        ttl = 84200 (23 hours 23 mins 20 secs)
    ADDITIONAL RECORDS:
    ->  ns2.dreamhost.com
        type = A, class = IN, dlen = 4
        internet address = 208.97.182.10
        ttl = 84581 (23 hours 29 mins 41 secs)
    ->  ns3.dreamhost.com
        type = A, class = IN, dlen = 4
        internet address = 66.33.216.216
        ttl = 84581 (23 hours 29 mins 41 secs)
    ->  ns1.dreamhost.com
        type = A, class = IN, dlen = 4
        internet address = 66.33.206.206
        ttl = 84581 (23 hours 29 mins 41 secs)

------------
Name:    www.fandompost.com
Served by:
- ns1.dreamhost.com
          66.33.206.206
          fandompost.com
- ns2.dreamhost.com
          208.97.182.10
          fandompost.com
- ns3.dreamhost.com
          66.33.216.216
          fandompost.com

> www.fandompost.com.
Server:  [66.33.206.206]
Address:  66.33.206.206

------------
SendRequest(), len 36
    HEADER:
        opcode = QUERY, id = 51, rcode = NOERROR
        header flags:  query
        questions = 1,  answers = 0,  authority records = 0,  additional = 0

    QUESTIONS:
        www.fandompost.com, type = A, class = IN

------------
------------
Got answer (148 bytes):
    HEADER:
        opcode = QUERY, id = 51, rcode = NXDOMAIN
        header flags:  response, auth. answer
        questions = 1,  answers = 1,  authority records = 1,  additional = 0

    QUESTIONS:
        www.fandompost.com, type = A, class = IN
    ANSWERS:
    ->  www.fandompost.com
        type = CNAME, class = IN, dlen = 39
        canonical name = www.fandompost.com.cdn.cloudflare.net
        ttl = 300 (5 mins)
    AUTHORITY RECORDS:
    ->  cloudflare.net
        type = SOA, class = IN, dlen = 49
        ttl = 14400 (4 hours)
        primary name server = ns1.dreamhost.com
        responsible mail addr = hostmaster.dreamhost.com
        serial  = 2014071000
        refresh = 14908 (4 hours 8 mins 28 secs)
        retry   = 1800 (30 mins)
        expire  = 1814400 (21 days)
        default TTL = 14400 (4 hours)

------------
------------
SendRequest(), len 36
    HEADER:
        opcode = QUERY, id = 52, rcode = NOERROR
        header flags:  query
        questions = 1,  answers = 0,  authority records = 0,  additional = 0

    QUESTIONS:
        www.fandompost.com, type = AAAA, class = IN

------------
------------
Got answer (148 bytes):
    HEADER:
        opcode = QUERY, id = 52, rcode = NXDOMAIN
        header flags:  response, auth. answer
        questions = 1,  answers = 1,  authority records = 1,  additional = 0

    QUESTIONS:
        www.fandompost.com, type = AAAA, class = IN
    ANSWERS:
    ->  www.fandompost.com
        type = CNAME, class = IN, dlen = 39
        canonical name = www.fandompost.com.cdn.cloudflare.net
        ttl = 300 (5 mins)
    AUTHORITY RECORDS:
    ->  cloudflare.net
        type = SOA, class = IN, dlen = 49
        ttl = 14400 (4 hours)
        primary name server = ns1.dreamhost.com
        responsible mail addr = hostmaster.dreamhost.com
        serial  = 2014071000
        refresh = 14908 (4 hours 8 mins 28 secs)
        retry   = 1800 (30 mins)
        expire  = 1814400 (21 days)
        default TTL = 14400 (4 hours)

------------
*** [66.33.206.206] can't find www.fandompost.com.: Non-existent domain


------------------------------------------------------------------------------------------------
------------------------------------------------------------------------------------------------
------------------------------------------------------------------------------------------------

> www.fandompost.com.cdn.cloudflare.net.
Server:  [66.33.206.206]
Address:  66.33.206.206

------------
SendRequest(), len 55
    HEADER:
        opcode = QUERY, id = 55, rcode = NOERROR
        header flags:  query, want recursion
        questions = 1,  answers = 0,  authority records = 0,  additional = 0

    QUESTIONS:
        www.fandompost.com.cdn.cloudflare.net, type = A, class = IN

------------
------------
Got answer (119 bytes):
    HEADER:
        opcode = QUERY, id = 55, rcode = NXDOMAIN
        header flags:  response, auth. answer, want recursion
        questions = 1,  answers = 0,  authority records = 1,  additional = 0

    QUESTIONS:
        www.fandompost.com.cdn.cloudflare.net, type = A, class = IN
    AUTHORITY RECORDS:
    ->  cloudflare.net
        type = SOA, class = IN, dlen = 52
        ttl = 14400 (4 hours)
        primary name server = ns1.dreamhost.com
        responsible mail addr = hostmaster.dreamhost.com
        serial  = 2014071000
        refresh = 14908 (4 hours 8 mins 28 secs)
        retry   = 1800 (30 mins)
        expire  = 1814400 (21 days)
        default TTL = 14400 (4 hours)

------------
------------
SendRequest(), len 55
    HEADER:
        opcode = QUERY, id = 56, rcode = NOERROR
        header flags:  query, want recursion
        questions = 1,  answers = 0,  authority records = 0,  additional = 0

    QUESTIONS:
        www.fandompost.com.cdn.cloudflare.net, type = AAAA, class = IN

------------
------------
Got answer (119 bytes):
    HEADER:
        opcode = QUERY, id = 56, rcode = NXDOMAIN
        header flags:  response, auth. answer, want recursion
        questions = 1,  answers = 0,  authority records = 1,  additional = 0

    QUESTIONS:
        www.fandompost.com.cdn.cloudflare.net, type = AAAA, class = IN
    AUTHORITY RECORDS:
    ->  cloudflare.net
        type = SOA, class = IN, dlen = 52
        ttl = 14400 (4 hours)
        primary name server = ns1.dreamhost.com
        responsible mail addr = hostmaster.dreamhost.com
        serial  = 2014071000
        refresh = 14908 (4 hours 8 mins 28 secs)
        retry   = 1800 (30 mins)
        expire  = 1814400 (21 days)
        default TTL = 14400 (4 hours)

------------
*** [66.33.206.206] can't find www.fandompost.com.cdn.cloudflare.net.: Non-exist
ent domain
domain-name-system

1 个回答

  1. Best Answer

    首先，让我们比较三个响应案例。

    • 第一种情况（resolver1.opendns.com/208.67.222.222）：NOERROR的响应码。看起来不错：一个非权威的答案。
    • 第二种情况（192.168.1.101）：NOERROR 的响应码。零回答。存在授权部分，这表明与上游 DNS 服务器通信没有问题。（不是防火墙问题）
    • 第三种情况（ns1.dreamhost.com/66.33.206.206）：NXDOMAIN 的响应码。一个带有“auth answer”（AA）标志的答案：www.fandompost.com.cdn.cloudflare.net.

    第三个很有趣。返回一个权威答案，ANSWER部分有一条记录，但响应码为NXDOMAIN。通常，在这种情况下您会看到 NOERROR 的响应代码：权威名称服务器通常不会尝试为您递归解析 CNAME。

    再看一下该答案的权威部分： 

    ANSWERS:
->  www.fandompost.com
    type = CNAME, class = IN, dlen = 39
    canonical name = www.fandompost.com.cdn.cloudflare.net
    ttl = 300 (5 mins)
AUTHORITY RECORDS:
->  cloudflare.net
    type = SOA, class = IN, dlen = 49
    ttl = 14400 (4 hours)
    primary name server = ns1.dreamhost.com

    看到“主名称服务器”了吗？显然，这个cloudflare.net区域是从 ns1.dreamhost.com 提供的。我自己的快速刮擦证实了这一点：

    $ dig @ns1.dreamhost.com +norecurse fandompost.com cloudflare.net SOA | grep -E 'HEADER|flags'
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 11600
;; flags: qr aa rd; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 0
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 32367
;; flags: qr aa rd; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 0

    aa两个 SOA 查询都存在该标志。您从 ns1.dreamhost.com 收到 NXDOMAIN 响应的原因是该名称服务器正在尝试为您解析www.fandompost.com.cdn.cloudflare.net.，因为它认为自己对该域也具有权威性，并且该记录似乎丢失了。为什么 Dreamhost 有一个cloudflare.net.区域？问 Dreamhost。对于大多数递归解析器来说，这个 NXDOMAIN rcode 似乎没有问题。我已经有一段时间没有关注 RFC 了，但我最好的猜测是他们忽略了响应代码并使用返回的答案。

    这最终将我们带到您的问题：您的 DNS 服务器有问题吗？不知道您正在使用的软件很难说。我可以说 BIND 和 Windows DNS 对这种配置没有任何问题，并且您的软件处理的可能与NXDOMAIN这两种实现不同。

    • 3

相关问题