MrTaik's questions

我有一个问题已经让我发疯了三天！我正在用新的权威 DNS 服务器替换我的权威 DNS 服务器，然后我再次重置所有 BIND9 配置，以便在替换的情况下进行更多“微调”。

我已经配置了一个 MASTER 服务器和两个 SLAVE 服务器，我已经配置了一个区域用作测试，而我通常用于测试的域 (FQDN)，问题是这样的：

• 当我更新区域并重新启动/重新加载绑定时，从日志中我看到通知已正确发送，但所有从属设备都没有收到（也使用 tcpdump 端口 53 验证：没有从主设备输出）

Feb 12 20:42:13 svr-3 named[12957]: zone test.com/IN: sending notifies (serial 20210 21201)

• 如果我改为添加指令“also-notify {slave_ip_1; slave_ip_2;}; 通知被正确发送和接收（使用 tcpdump 端口 53 和绑定日志验证），显然传输过程正确开始和结束

在这一点上，我认为是我的 MASTER 的某些配置有问题，我已经转义或设置不正确，因为从机接收正确；看起来好像它没有读取权威的 NS 记录。

我正在附上配置文件，或许有你的帮助，我可以找到错误（文件要补全，遇到这个问题我就停了）

命名.conf.options

options {
        directory "/var/cache/bind";

        // If there is a firewall between you and nameservers you want
        // to talk to, you may need to fix the firewall to allow multiple
        // ports to talk.  See http://www.kb.cert.org/vuls/id/800113

        // If your ISP provided one or more IP addresses for stable
        // nameservers, you probably want to use them as forwarders.
        // Uncomment the following block, and insert the addresses replacing
        // the all-0's placeholder.

        // forwarders {
        //      0.0.0.0;
        // };

        //========================================================================
        // If BIND logs error messages about the root key being expired,
        // you will need to update your keys.  See https://www.isc.org/bind-keys
        //========================================================================
        dnssec-validation auto;

        listen-on { xxx; };
        listen-on-v6 { any; };

        //IP da utilizzare per le richieste in uscita di aggiornamento zone e il forward dei dynamic updates
        transfer-source xxx;

        //Abilito le notifiche
        notify yes;

        //Quale IP utilizzare per le notifiche in uscita
        notify-source xxx;

        //IP da notificare in aggiunta degli NS RR
//      also-notify { yyy; zzz;  };

        auth-nxdomain no;

        // hide version number from clients for security reasons.
        version "Not Available";

        // disable recursion on authoritative DNS server.
        recursion no;

        // enable the query log
        querylog yes;

        // disallow zone transfer
        allow-transfer { none; };

};

区域文件

; BIND reverse data file for empty rfc1918 zone
;
; DO NOT EDIT THIS FILE - it is used for multiple zones.
; Instead, copy it, edit named.conf, and use that copy.
;

$TTL    86400           ;TTL (1 Giorno)
$ORIGIN test.com.    ;Base Dominio

; Record Start of Authority (SOA)
@       IN      SOA     ns1.test.net. hostmaster.test.net. (
                       2021021201       ; Serial
                          21600         ; Refresh (6H)
                          10800         ; Retry (3H)
                         604800         ; Expire (1 Settimana)
                         604800 )       ; Negative Cache TTL (1 Settimana)
; Record A
@       10800   IN      A       123.345.678.123
www     10800   IN      A       123.345.678.123

; Record AAAA

; Record CNAME

; Record TXT

; Record SRV

; Record MX
@       3600    IN      MX      1       mail.test.net.
@       3600    IN      MX      10      mail2.test.net.

; Record NS
@       IN      NS      ns1.test.net.
@       IN      NS      ns2.test.net.
@       IN      NS      dns.otherdomain.it.

命名.conf.local

//
// Do any local configuration here
//

// Consider adding the 1918 zones here, if they are not used in your
// organization
//include "/etc/bind/zones.rfc1918";

zone "test.com" {
      type master;
      file "/etc/bind/zones/db.test.com";
      allow-query { any; };
      allow-transfer { key keytest; };
};