BIND DNS 服务器搭建完全教程 / 第 03 章：核心配置文件详解

// 1. 全局选项
options { ... };

// 2. ACL 定义
acl "name" { ... };

// 3. TSIG 密钥
key "name" { ... };

// 4. 日志配置
logging { ... };

// 5. 视图（可选）
view "name" { ... };

// 6. 区域定义
zone "example.com" { ... };

// 7. 引入其他文件
include "/etc/bind/named.conf.local";

# 主配置文件 /etc/bind/named.conf
include "/etc/bind/named.conf.options";    # 全局选项
include "/etc/bind/named.conf.local";      # 本地区域
include "/etc/bind/named.conf.default-zones";  # 默认区域
include "/etc/bind/named.conf.zones";      # 自定义业务区域（可选）

options {
    // ---- 工作目录 ----
    directory "/var/cache/bind";

    // ---- 网络监听 ----
    listen-on port 53 { 127.0.0.1; 192.168.1.10; };
    listen-on-v6 port 53 { ::1; fd00::1; };

    // ---- 查询控制 ----
    allow-query { localhost; localnets; };
    allow-query-cache { localhost; localnets; };
    recursion yes;
    allow-recursion { localhost; localnets; };

    // ---- 转发 ----
    forwarders {
        8.8.8.8;
        8.8.4.4;
        1.1.1.1;
    };
    forward first;  // 先转发，失败后自行迭代

    // ---- 安全 ----
    version "not disclosed";
    hostname "not disclosed";
    server-id "not disclosed";
    dnssec-validation auto;

    // ---- 性能 ----
    max-cache-size 256m;
    max-cache-ttl 3600;
    max-ncache-ttl 900;
    cleaning-interval 60;
    max-clients-per-query 100;
    max-udp-size 1232;

    // ---- EDNS ----
    edns-udp-size 1232;

    // ---- 文件 ----
    pid-file "/run/named/named.pid";
    session-keyfile "/run/named/session.key";
    managed-keys-directory "/var/cache/bind/managed-keys";
    bindkeys-file "/etc/bind/bind.keys";

    // ---- 其他 ----
    prefetch 2 9;   // 预取：在 TTL 剩余 2 秒且查询次数 >= 9 时预取
    minimal-responses yes;  // 减少响应大小
};

listen-on port 53 { 192.168.1.10; };

allow-query { any; };         // 谁可以查询（权威服务器通常用 any）
allow-query-cache { trusted; }; // 谁可以查看缓存（递归服务器限制）
allow-recursion { trusted; };   // 谁可以使用递归

forwarders { 8.8.8.8; 1.1.1.1; };
forward only;   // 仅转发，失败则返回 SERVFAIL
forward first;  // 先转发，失败后自行迭代查询

max-cache-size 256m;    // 最大缓存内存（0 = 无限制）
max-cache-ttl 3600;     // 正响应最大缓存时间（秒）
max-ncache-ttl 900;     // 负响应（NXDOMAIN）最大缓存时间
cleaning-interval 60;   // 缓存清理间隔（分钟）

// 使用 IP 地址和网络
acl "trusted" {
    127.0.0.1;          // 单个 IP
    192.168.1.0/24;     // 子网
    10.0.0.0/8;         // 大子网
    172.16.0.0/12;
    !192.168.1.100;     // 排除特定 IP
};

acl "office-beijing" {
    10.1.0.0/16;
};

acl "office-shanghai" {
    10.2.0.0/16;
};

acl "bad-actors" {
    192.168.100.0/24;   // 已知恶意来源
    10.255.0.0/16;
};

acl "trusted" {
    localhost;
    localnets;
    192.168.0.0/16;
};

options {
    allow-query { any; };               // 权威数据：任何人可查
    allow-query-cache { trusted; };     // 缓存数据：仅信任网络
    allow-recursion { trusted; };       // 递归查询：仅信任网络
    allow-transfer { secondary-servers; }; // 区域传输：仅从服务器
    blackhole { bad-actors; };          // 完全拒绝（不响应）
};

key "transfer-key" {
    algorithm hmac-sha256;
    secret "base64-encoded-secret-here";
};

acl "secondary-servers" {
    192.168.1.11;       // 从服务器 IP
    key transfer-key;   // 也可以按 TSIG 密钥匹配
};

logging {
    // ---- 通道定义 ----
    
    // 默认通道（调试用，生产环境建议关闭或降低级别）
    channel default_log {
        file "/var/log/named/default.log" versions 5 size 50m;
        severity info;
        print-time yes;
        print-severity yes;
        print-category yes;
    };

    // 查询日志
    channel query_log {
        file "/var/log/named/query.log" versions 10 size 100m;
        severity dynamic;
        print-time yes;
        print-severity yes;
        print-category yes;
    };

    // 安全日志
    channel security_log {
        file "/var/log/named/security.log" versions 10 size 50m;
        severity info;
        print-time yes;
        print-severity yes;
        print-category yes;
    };

    // 区域传输日志
    channel transfer_log {
        file "/var/log/named/transfer.log" versions 5 size 20m;
        severity info;
        print-time yes;
        print-severity yes;
        print-category yes;
    };

    // 动态更新日志
    channel update_log {
        file "/var/log/named/update.log" versions 5 size 20m;
        severity info;
        print-time yes;
        print-severity yes;
        print-category yes;
    };

    // DNSSEC 日志
    channel dnssec_log {
        file "/var/log/named/dnssec.log" versions 5 size 20m;
        severity info;
        print-time yes;
        print-severity yes;
        print-category yes;
    };

    // sysylog 通道示例
    channel syslog_channel {
        syslog daemon;
        severity info;
    };

    // ---- 类别绑定 ----
    category default { default_log; };
    category queries { query_log; };
    category security { security_log; };
    category xfer-in { transfer_log; };
    category xfer-out { transfer_log; };
    category update { update_log; };
    category update-security { update_log; security_log; };
    category dnssec { dnssec_log; };
    category lame-servers { null; };         // 丢弃（减少噪音）
    category edns-disabled { null; };        // 丢弃
};

// 内网视图 —— 允许递归，解析内部域名
view "internal" {
    match-clients { trusted; };
    recursion yes;

    zone "example.com" {
        type primary;
        file "internal/example.com.zone";
    };

    zone "." {
        type hint;
        file "db.root";
    };
};

// 外网视图 —— 仅返回权威数据
view "external" {
    match-clients { any; };
    recursion no;

    zone "example.com" {
        type primary;
        file "external/example.com.zone";
    };
};

// 生成 TSIG 密钥：
// tsig-keygen -a hmac-sha256 transfer-key

key "transfer-key" {
    algorithm hmac-sha256;
    secret "aBcDeFgHiJkLmNoPqRsTuVwXyZ0123456789=";
};

// /etc/bind/named.conf —— 递归 DNS 服务器

// ACL 定义
acl "trusted" {
    localhost;
    localnets;
    192.168.0.0/16;
    10.0.0.0/8;
};

// 全局选项
options {
    directory "/var/cache/bind";

    // 监听配置
    listen-on port 53 { any; };
    listen-on-v6 port 53 { any; };

    // 递归配置
    recursion yes;
    allow-recursion { trusted; };
    allow-query { trusted; };
    allow-query-cache { trusted; };

    // 转发器
    forwarders {
        8.8.8.8;
        1.1.1.1;
    };
    forward first;

    // 安全
    version "not disclosed";
    hostname "not disclosed";
    server-id "not disclosed";
    dnssec-validation auto;

    // 性能
    max-cache-size 512m;
    max-cache-ttl 3600;
    max-ncache-ttl 900;
    minimal-responses yes;

    // 文件
    pid-file "/run/named/named.pid";
    session-keyfile "/run/named/session.key";
};

// 日志
logging {
    channel default_log {
        file "/var/log/named/default.log" versions 5 size 50m;
        severity info;
        print-time yes;
        print-severity yes;
        print-category yes;
    };
    channel query_log {
        file "/var/log/named/query.log" versions 10 size 100m;
        severity dynamic;
        print-time yes;
    };
    category default { default_log; };
    category queries { query_log; };
    category lame-servers { null; };
    category edns-disabled { null; };
};

// 根提示
zone "." {
    type hint;
    file "db.root";
};

// 本地区域
zone "localhost" {
    type primary;
    file "db.local";
};

zone "127.in-addr.arpa" {
    type primary;
    file "db.127";
};

// RFC 1918 反向区域（推荐作为权威服务器）
zone "168.192.in-addr.arpa" {
    type primary;
    file "db.192.168";
    allow-query { trusted; };
};

// /etc/bind/named.conf —— 权威 DNS 服务器

acl "secondary-servers" {
    192.168.1.11;   // 从服务器 IP
};

options {
    directory "/var/cache/bind";

    // 监听所有地址
    listen-on port 53 { any; };
    listen-on-v6 port 53 { any; };

    // 禁用递归（纯权威）
    recursion no;
    allow-query { any; };
    allow-query-cache { none; };

    // 安全
    version "not disclosed";
    dnssec-validation no;

    // 区域传输控制
    allow-transfer { secondary-servers; };

    // 文件
    pid-file "/run/named/named.pid";
    session-keyfile "/run/named/session.key";
};

logging {
    channel default_log {
        file "/var/log/named/default.log" versions 5 size 50m;
        severity info;
        print-time yes;
        print-severity yes;
        print-category yes;
    };
    category default { default_log; };
    category lame-servers { null; };
};

zone "example.com" {
    type primary;
    file "primary/example.com.zone";
    allow-transfer { secondary-servers; };
    also-notify { 192.168.1.11; };
};

# 检查 named.conf 语法
sudo named-checkconf /etc/bind/named.conf

# 检查区域文件语法
sudo named-checkzone example.com /var/cache/bind/primary/example.com.zone

# 检查配置并显示加载的区域列表
sudo named-checkconf -l /etc/bind/named.conf

# 输出配置的解析结果（用于排查 include 问题）
sudo named-checkconf -p /etc/bind/named.conf