{"id":21428,"date":"2026-10-26T10:15:27","date_gmt":"2026-10-26T02:15:27","guid":{"rendered":"https:\/\/blog.ywdevops.cn\/?p=21428"},"modified":"2026-11-05T14:56:01","modified_gmt":"2026-11-05T06:56:01","slug":"dns","status":"publish","type":"post","link":"https:\/\/blog.ywdevops.cn\/index.php\/2026\/10\/26\/dns\/","title":{"rendered":"DNS\u7b80\u4ecb"},"content":{"rendered":"\n

\u4e00\u3001DNS \u672c\u8d28\uff1a\u4e00\u4e2a\u5206\u5e03\u5f0f\u6570\u636e\u5e93 + \u7f13\u5b58\u7cfb\u7edf<\/mark><\/strong><\/p>\n\n\n\n

\u5b8c\u6574\u7684DNS\u67e5\u8be2\u94fe\u8def\uff08\u9012\u5f52\u89e3\u6790\uff09<\/p>\n\n\n\n

\u250c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2510   \u2460\u67e5\u8be2    \u250c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2510\n\u2502  \u6d4f\u89c8\u5668  \u2502\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2192\u2502 \u672c\u5730\u7f13\u5b58  \u2502 \u6709\uff1f\u76f4\u63a5\u8fd4\u56de\n\u2502  \/OS    \u2502            \u2514\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2518\n\u2514\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2518                  \u2193 \u6ca1\u6709\n                       \u2461\u95ee\u672c\u5730DNS\n                    \uff088.8.8.8 \/ 114.114.114.114\uff09\n                              \u2193\n                    \u2462\u672c\u5730DNS\u4e5f\u6ca1\u6709 \u2192 \u5f00\u59cb\u8fed\u4ee3\n                              \u2193\n                    \u6839\u670d\u52a1\u5668\uff08\u53ea\u77e5\u9053.com\u5728\u54ea\uff09\n                              \u2193\n                    .com\u9876\u7ea7\u57df\u670d\u52a1\u5668\n                              \u2193\n                    example.com\u6743\u5a01DNS\n                              \u2193\n                    \u8fd4\u56de A\u8bb0\u5f55 93.184.216.34<\/code><\/pre>\n\n\n\n
\u4e8c\u3001DNS \u8bb0\u5f55\u7c7b\u578b\uff08\u8fd0\u7ef4\u5fc5\u80cc\uff09<\/mark><\/strong><\/p>\n\n\n\n
\u7c7b\u578b<\/strong><\/th>\u5168\u79f0<\/strong><\/th>\u4f5c\u7528<\/strong><\/th>\u8fd0\u7ef4\u573a\u666f<\/strong><\/th><\/tr><\/thead>
A<\/strong>\u200b<\/td>Address<\/td>\u57df\u540d\u2192IPv4<\/td>\u6700\u5e38\u7528<\/td><\/tr>
AAAA<\/strong>\u200b<\/td>Quad-A<\/td>\u57df\u540d\u2192IPv6<\/td>\u53cc\u6808\u73af\u5883<\/td><\/tr>
CNAME<\/strong>\u200b<\/td>Canonical Name<\/td>\u522b\u540d\u2192\u53e6\u4e00\u4e2a\u57df\u540d<\/td>CDN\u3001\u4e91\u670d\u52a1\u6807\u914d<\/td><\/tr>
MX<\/strong>\u200b<\/td>Mail Exchange<\/td>\u90ae\u4ef6\u670d\u52a1\u5668<\/td>\u90ae\u4ef6\u7cfb\u7edf<\/td><\/tr>
TXT<\/strong>\u200b<\/td>Text<\/td>\u4efb\u610f\u6587\u672c<\/td>SPF\u3001DKIM\u3001\u57df\u540d\u9a8c\u8bc1<\/td><\/tr>
NS<\/strong>\u200b<\/td>Name Server<\/td>\u6307\u5b9a\u6743\u5a01DNS<\/td>\u57df\u540d\u6258\u7ba1<\/td><\/tr>
SOA<\/strong>\u200b<\/td>Start of Authority<\/td>\u533a\u57df\u6743\u5a01\u4fe1\u606f<\/td>\u4e3b\u4ece\u540c\u6b65\u3001\u5237\u65b0\u65f6\u95f4<\/td><\/tr>
PTR<\/strong>\u200b<\/td>Pointer<\/td>IP\u2192\u57df\u540d\uff08\u53cd\u5411\u89e3\u6790\uff09<\/td>\u90ae\u4ef6\u670d\u52a1\u5668\u53cd\u67e5<\/td><\/tr>
SRV<\/strong>\u200b<\/td>Service<\/td>\u670d\u52a1\u53d1\u73b0<\/td>K8s\u3001Consul\u3001LDAP<\/td><\/tr>
CAA<\/strong>\u200b<\/td>Cert Auth Auth<\/td>\u6307\u5b9a\u5141\u8bb8\u7b7e\u53d1\u8bc1\u4e66\u7684CA<\/td>HTTPS\u8bc1\u4e66\u5b89\u5168<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n
\u4e09\u3001TTL \u2014\u2014 DNS \u7684”\u53cc\u5203\u5251”<\/mark><\/strong><\/p>\n\n\n\n
TTL = Time To Live\uff08\u79d2\uff09\n\u542b\u4e49\uff1a\u8fd9\u6761\u8bb0\u5f55\u5728\u7f13\u5b58\u4e2d\u5b58\u6d3b\u591a\u4e45<\/code><\/pre>\n\n\n\n
\u573a\u666f<\/strong><\/th>TTL \u7b56\u7565<\/strong><\/th>\u539f\u56e0<\/strong><\/th><\/tr><\/thead>
\u65e5\u5e38\u8fd0\u884c<\/td>300~3600s<\/td>\u5e73\u8861\u8d1f\u8f7d\u548c\u7075\u6d3b\u6027<\/td><\/tr>
\u5373\u5c06\u5207\u6362IP<\/td>\u63d0\u524d\u6539\u5c0f\u5230 60s<\/td>\u8ba9\u65e7\u7f13\u5b58\u5feb\u901f\u8fc7\u671f<\/td><\/tr>
\u5207\u6362\u5b8c\u6210\u540e<\/td>\u6539\u56de\u6b63\u5e38\u503c<\/td>\u907f\u514dDNS\u670d\u52a1\u5668\u538b\u529b\u8fc7\u5927<\/td><\/tr>
\u6545\u969c\u5bb9\u707e<\/td>\u4f4eTTL + \u5065\u5eb7\u68c0\u67e5<\/td>\u5feb\u901f\u5207\u6d41<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n
\ud83d\udca1 \u7ecf\u5178\u7ffb\u8f66<\/strong>\uff1a\u6539\u4e86 DNS \u89e3\u6790\uff0c\u4f46 TTL \u662f 86400\uff0824\u5c0f\u65f6\uff09\uff0c\u7528\u623724\u5c0f\u65f6\u5185\u8fd8\u5728\u8bbf\u95ee\u65e7IP<\/p>\n\n\n\n
\u67e5\u770bTTL:<\/p>\n\n\n\n
dig www.baidu.com +noall +answer\n\n# \u8f93\u51fa\u793a\u4f8b\uff1a\n# www.baidu.com.  300  IN  A  180.101.50.242\n#                   \u2191 TTL\uff08\u79d2\uff09<\/code><\/pre>\n\n\n\n
\u56db\u3001DNS \u6392\u9519\u5de5\u5177\u7bb1\uff08\u8fd0\u7ef4\u5fc5\u4f1a\uff09<\/mark><\/strong><\/p>\n\n\n\n
1. dig \u2014\u2014 \u6392\u9519\u4e4b\u738b<\/p>\n\n\n\n
# \u57fa\u672c\u67e5\u8be2\ndig www.example.com\n\n# \u53ea\u770b\u7b54\u6848\ndig www.example.com +short\n\n# \u8ffd\u8e2a\u5b8c\u6574\u89e3\u6790\u94fe\u8def\uff08\u6392\u9519\u795e\u5668\uff09\ndig www.example.com +trace\n\n# \u6307\u5b9aDNS\u670d\u52a1\u5668\u67e5\u8be2\ndig @8.8.8.8 www.example.com\n\n# \u67e5\u6240\u6709\u8bb0\u5f55\ndig example.com ANY +short\n\n# \u53cd\u5411\u89e3\u6790\ndig -x 93.184.216.34\n\n# \u8be6\u7ec6\u8ba1\u65f6\uff08\u770b\u54ea\u91cc\u6162\uff09\ndig www.example.com +stats<\/code><\/pre>\n\n\n\n
2. nslookup \u2014\u2014 \u7b80\u5355\u5feb\u901f<\/p>\n\n\n\n
nslookup www.example.com\nnslookup www.example.com 8.8.8.8<\/code><\/pre>\n\n\n\n
3. host \u2014\u2014 \u4e00\u884c\u641e\u5b9a<\/p>\n\n\n\n
host www.example.com\nhost -t MX example.com        # \u67e5MX\u8bb0\u5f55\nhost -t NS example.com        # \u67e5NS\u8bb0\u5f55<\/code><\/pre>\n\n\n\n
4. \u7cfb\u7edf\u7ea7\u6392\u67e5<\/p>\n\n\n\n
# \u770b\u7cfb\u7edf\u7528\u54ea\u4e2aDNS\ncat \/etc\/resolv.conf\n\n# systemd-resolved \u73af\u5883\nsystemd-resolve --status\n\n# \u6e05\u672c\u5730DNS\u7f13\u5b58\nsystemd-resolve --flush-caches        # systemd\nrndc flush                            # BIND\nsystemctl restart nscd                # nscd<\/code><\/pre>\n\n\n\n
\u4e94\u3001\u9ad8\u9891\u6545\u969c\u573a\u666f\u4e0e\u6392\u9519\u601d\u8def<\/mark><\/strong><\/p>\n\n\n\n
\u573a\u666f1\uff1a\u6539\u4e86 DNS \u4f46\u4e0d\u751f\u6548<\/p>\n\n\n\n
\u6392\u67e5\u6e05\u5355\uff1a\n\u25a1 TTL \u8fd8\u6ca1\u8fc7\u671f\uff1f\u2192 dig \u770b TTL \u662f\u5426\u5728\u9012\u51cf\n\u25a1 \u672c\u5730\u7f13\u5b58\uff1f\u2192 systemd-resolve --flush-caches\n\u25a1 \u6d4f\u89c8\u5668\u7f13\u5b58\uff1f\u2192 \u65e0\u75d5\u6a21\u5f0f\u6d4b\u8bd5\n\u25a1 \/etc\/hosts \u6709\u786c\u7f16\u7801\uff1f\u2192 grep \u57df\u540d \/etc\/hosts\n\u25a1 \u8fd0\u8425\u5546DNS\u7f13\u5b58\uff1f\u2192 dig @\u8fd0\u8425\u5546DNS \u5bf9\u6bd4 dig @8.8.8.8<\/code><\/pre>\n\n\n\n
\u573a\u666f2\uff1a\u95f4\u6b47\u6027\u89e3\u6790\u5931\u8d25<\/p>\n\n\n\n
\u53ef\u80fd\u539f\u56e0\uff1a\n1. \u591a\u4e2aNS\u8bb0\u5f55\u4e2d\u67d0\u4e2aDNS\u670d\u52a1\u5668\u6302\u4e86\n   \u2192 dig @\u6bcf\u4e2aNS \u9010\u4e2a\u6d4b\u8bd5\n2. \u6743\u5a01DNS\u54cd\u5e94\u6162\uff0c\u9012\u5f52\u670d\u52a1\u5668\u8d85\u65f6\n   \u2192 dig +stats \u770b query time\n3. \u7f51\u7edc\u4e22\u5305\u5bfc\u81f4DNS\u8bf7\u6c42\u4e22\u5931\uff08UDP 53\uff09\n   \u2192 mtr DNS\u670d\u52a1\u5668IP\n4. \u5e76\u53d1\u67e5\u8be2\u88ab\u9650\u901f\n   \u2192 \u770b DNS \u670d\u52a1\u5668\u65e5\u5fd7<\/code><\/pre>\n\n\n\n
\u573a\u666f3\uff1a\u5bb9\u5668\u5185\u89e3\u6790\u6162\/\u5931\u8d25<\/p>\n\n\n\n
# K8s \u91cc\u5e38\u89c1\u95ee\u9898\n# 1. \u770b Pod \u7684 DNS \u914d\u7f6e\ncat \/etc\/resolv.conf\n# nameserver \u901a\u5e38\u6307\u5411 CoreDNS ClusterIP\n\n# 2. \u6d4b\u8bd5 CoreDNS \u662f\u5426\u6b63\u5e38\nnslookup kubernetes.default 10.96.0.10\n\n# 3. ndots \u914d\u7f6e\u5bfc\u81f4\u591a\u4f59\u67e5\u8be2\n# options ndots:5 \u2192 \u4efb\u4f55\u57df\u540d\u90fd\u5148\u5c1d\u8bd5\u52a0search\u540e\u7f00\n# \u89e3\u51b3\uff1apod.spec.dnsConfig.options: { name: ndots, value: \"2\" }<\/code><\/pre>\n\n\n\n
\u573a\u666f4\uff1aDNS \u52ab\u6301\/\u6c61\u67d3<\/p>\n\n\n\n
\u75c7\u72b6\uff1a\u8fd4\u56de\u4e86\u5947\u602a\u7684IP\uff08\u5e7f\u544a\u9875\u3001\u62e6\u622a\u9875\uff09\n\n\u6392\u67e5\uff1a\n\u25a1 dig @8.8.8.8 vs dig @\u672c\u5730DNS \u2192 \u7ed3\u679c\u4e0d\u540c = \u88ab\u52ab\u6301\n\u25a1 \u7528 DoH\/DoT \u7ed5\u8fc7\uff08\u89c1\u4e0b\u6587\uff09\n\u25a1 \u68c0\u67e5\u8def\u7531\u5668 DNS \u8bbe\u7f6e<\/code><\/pre>\n\n\n\n
\u516d\u3001DNS \u5b89\u5168\uff1aDNSSEC \/ DoH \/ DoT<\/p>\n\n\n\n
\u6280\u672f<\/strong><\/th>\u5168\u79f0<\/strong><\/th>\u89e3\u51b3\u7684\u95ee\u9898<\/strong><\/th>\u8fd0\u7ef4\u5173\u6ce8<\/strong><\/th><\/tr><\/thead>
DNSSEC<\/strong>\u200b<\/td>DNS Security Extensions<\/td>\u9632\u7be1\u6539\u3001\u9632\u6b3a\u9a97<\/td>\u7b7e\u540d\u94fe\u9a8c\u8bc1<\/td><\/tr>
DoH<\/strong>\u200b<\/td>DNS over HTTPS<\/td>\u9632\u76d1\u542c\u3001\u9632\u52ab\u6301<\/td>\u7aef\u53e3443\uff0c\u9632\u706b\u5899\u53cb\u597d<\/td><\/tr>
DoT<\/strong>\u200b<\/td>DNS over TLS<\/td>\u9632\u76d1\u542c\u3001\u9632\u52ab\u6301<\/td>\u7aef\u53e3853<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n
\ud83d\udca1 \u4f01\u4e1a\u5185\u7f51\u8fd0\u7ef4\u6ce8\u610f\uff1aDoH \u4f1a\u7ed5\u8fc7\u5185\u7f51 DNS \u7b56\u7565\uff0c\u9700\u8981\u7ba1\u63a7\u6d4f\u89c8\u5668 DoH \u8bbe\u7f6e<\/p>\n\n\n\n
\u4e03\u3001DNS \u76d1\u63a7\u4e0e\u544a\u8b66\uff08\u751f\u4ea7\u5fc5\u5907\uff09<\/p>\n\n\n\n
# 1. \u76d1\u63a7\u89e3\u6790\u6210\u529f\u7387\uff08\u5b9a\u65f6\u63a2\u6d4b\uff09\ndig +short @dns-server example.com || alert\n\n# 2. \u76d1\u63a7\u89e3\u6790\u5ef6\u8fdf\ndig example.com +stats | grep \"Query time\"\n\n# 3. \u76d1\u63a7\u8bc1\u4e66\u57df\u540d\u89e3\u6790\uff08\u9632\u6b62DNS\u6302\u4e86\u8bc1\u4e66\u7eed\u7b7e\u5931\u8d25\uff09\n# certbot \u4f9d\u8d56 DNS \u9a8c\u8bc1\u65f6\u5c24\u5176\u91cd\u8981\n\n# 4. \u76d1\u63a7 TTL \u53d8\u5316\uff08\u9632\u6b62\u88ab\u7be1\u6539\uff09\ndig +short example.com\n# \u5bf9\u6bd4\u5386\u53f2\u503c<\/code><\/pre>\n","protected":false},"excerpt":{"rendered":"
\u4e00\u3001DNS \u672c\u8d28\uff1a\u4e00\u4e2a\u5206\u5e03\u5f0f\u6570\u636e\u5e93 + \u7f13\u5b58\u7cfb\u7edf \u5b8c\u6574\u7684DNS\u67e5\u8be2\u94fe\u8def\uff08\u9012\u5f52\u89e3\u6790\uff09 \u4e8c\u3001DNS \u8bb0\u5f55\u7c7b\u578b\uff08\u8fd0\u7ef4 […]<\/p>\n","protected":false},"author":3,"featured_media":21432,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[26],"tags":[],"class_list":["post-21428","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-network"],"blocksy_meta":{"styles_descriptor":{"styles":{"desktop":"","tablet":"","mobile":""},"google_fonts":[],"version":8}},"_links":{"self":[{"href":"https:\/\/blog.ywdevops.cn\/index.php\/wp-json\/wp\/v2\/posts\/21428","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/blog.ywdevops.cn\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/blog.ywdevops.cn\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/blog.ywdevops.cn\/index.php\/wp-json\/wp\/v2\/users\/3"}],"replies":[{"embeddable":true,"href":"https:\/\/blog.ywdevops.cn\/index.php\/wp-json\/wp\/v2\/comments?post=21428"}],"version-history":[{"count":11,"href":"https:\/\/blog.ywdevops.cn\/index.php\/wp-json\/wp\/v2\/posts\/21428\/revisions"}],"predecessor-version":[{"id":21444,"href":"https:\/\/blog.ywdevops.cn\/index.php\/wp-json\/wp\/v2\/posts\/21428\/revisions\/21444"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/blog.ywdevops.cn\/index.php\/wp-json\/wp\/v2\/media\/21432"}],"wp:attachment":[{"href":"https:\/\/blog.ywdevops.cn\/index.php\/wp-json\/wp\/v2\/media?parent=21428"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/blog.ywdevops.cn\/index.php\/wp-json\/wp\/v2\/categories?post=21428"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/blog.ywdevops.cn\/index.php\/wp-json\/wp\/v2\/tags?post=21428"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}