请教大家一个关于 local DNS 的问题

[yhehior]

我用 Bind9 搭建了一个 local DNS ，但是有的时候可以正常解析 IP ，第二天就有不行了，然后过两三天自己就又好了，今天我开了个 debug 看了一下：报如下错误，请问一下这是为什么。
29-Feb-2016 20:51:58.831 database: debug 5: adb: fetch of 'd.gtld-servers.net' AAAA failed: timed out
29-Feb-2016 20:51:58.831 database: debug 5: adb: fetch of 'e.gtld-servers.net' AAAA failed: timed out
29-Feb-2016 20:51:58.831 database: debug 5: adb: fetch of 'f.gtld-servers.net' AAAA failed: timed out
29-Feb-2016 20:51:58.831 database: debug 5: adb: fetch of 'g.gtld-servers.net' AAAA failed: timed out
29-Feb-2016 20:51:58.832 database: debug 5: adb: fetch of 'h.gtld-servers.net' AAAA failed: timed out
29-Feb-2016 20:51:58.832 database: debug 5: adb: fetch of 'i.gtld-servers.net' AAAA failed: timed out
29-Feb-2016 20:51:58.832 database: debug 5: adb: fetch of 'j.gtld-servers.net' AAAA failed: timed out
29-Feb-2016 20:51:58.832 database: debug 5: adb: fetch of 'k.gtld-servers.net' AAAA failed: timed out
29-Feb-2016 20:51:58.832 database: debug 5: adb: fetch of 'l.gtld-servers.net' AAAA failed: timed out
29-Feb-2016 20:51:58.832 database: debug 5: adb: fetch of 'm.gtld-servers.net' AAAA failed: timed out

[JJaicmkmy]

连接根服务器失败

[yhehior]

@JJaicmkmy 嗯，连接 X.root-servers.net 的时候应该没有问题， X.gtld-servers.net 顶级域名，怎么连接这些地址会失败呢?而且还是时好时坏。。真不明白。

[Ann1020]

软件开发交流群： 466678068

[GeekTest]

能否贴一下 config 文件 我一直也想搭一个但是官方资料太少

[qcloud]

同求

[qcloud]

同求怎么搭

[lenovo]

@qcloud
@GeekTest
@yhehior
Unbound + DNSCrypt 分流解析、防污染、防劫持
https://github.com/CNMan/unbound.conf

[raysonx]

其实用 BIND 搭递归 DNS 是很容易的。我这里有稳定运行了一年的配置。
系统 CentOS 7.2 ，如在 Ubuntu 系统下运行可能需要注意路径差异：

```
//
// named.conf
//
// Provided by Red Hat bind package to configure the ISC BIND named(8) DNS
// server as a caching only nameserver (as a localhost DNS resolver only).
//
// See /usr/share/doc/bind*/sample/ for example named configuration files.
//

options {
listen-on port 53 { any; };
listen-on-v6 port 53 { any; };
directory "/var/named";
dump-file "/var/named/data/cache_dump.db";
statistics-file "/var/named/data/named_stats.txt";
memstatistics-file "/var/named/data/named_mem_stats.txt";
allow-query { any; };

/*
- If you are building an AUTHORITATIVE DNS server, do NOT enable recursion.
- If you are building a RECURSIVE (caching) DNS server, you need to enable
recursion.
- If your recursive DNS server has a public IP address, you MUST enable access
control to limit queries to your legitimate users. Failing to do so will
cause your server to become part of large scale DNS amplification
attacks. Implementing BCP38 within your network would greatly
reduce such attack surface
*/
recursion yes;
empty-zones-enable no;

dnssec-enable yes;
dnssec-validation no;
dnssec-lookaside auto;

/* Path to ISC DLV key */
bindkeys-file "/etc/named.iscdlv.key";

managed-keys-directory "/var/named/dynamic";

pid-file "/run/named/named.pid";
session-keyfile "/run/named/session.key";
};

logging {
channel default_debug {
file "data/named.run";
severity dynamic;
};
};

zone "." IN {
type hint;
file "named.ca";
};

include "/etc/named.rfc1912.zones";
include "/etc/named.root.key";



; /var/named/named.ca

; <<>> DiG 9.9.2-P1-RedHat-9.9.2-6.P1.fc18 <<>> +bufsize=1200 +norec @a.root-servers.net
; (2 servers found)
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 25828
;; flags: qr aa; QUERY: 1, ANSWER: 13, AUTHORITY: 0, ADDITIONAL: 23

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 512
;; QUESTION SECTION:
;. IN NS

;; ANSWER SECTION:
. 518400 IN NS a.root-servers.net.
. 518400 IN NS b.root-servers.net.
. 518400 IN NS c.root-servers.net.
. 518400 IN NS d.root-servers.net.
. 518400 IN NS e.root-servers.net.
. 518400 IN NS f.root-servers.net.
. 518400 IN NS g.root-servers.net.
. 518400 IN NS h.root-servers.net.
. 518400 IN NS i.root-servers.net.
. 518400 IN NS j.root-servers.net.
. 518400 IN NS k.root-servers.net.
. 518400 IN NS l.root-servers.net.
. 518400 IN NS m.root-servers.net.

;; ADDITIONAL SECTION:
a.root-servers.net. 3600000 IN A 198.41.0.4
a.root-servers.net. 3600000 IN AAAA 2001:503:ba3e::2:30
b.root-servers.net. 3600000 IN A 192.228.79.201
c.root-servers.net. 3600000 IN A 192.33.4.12
d.root-servers.net. 3600000 IN A 199.7.91.13
d.root-servers.net. 3600000 IN AAAA 2001:500:2d::d
e.root-servers.net. 3600000 IN A 192.203.230.10
f.root-servers.net. 3600000 IN A 192.5.5.241
f.root-servers.net. 3600000 IN AAAA 2001:500:2f::f
g.root-servers.net. 3600000 IN A 192.112.36.4
h.root-servers.net. 3600000 IN A 128.63.2.53
h.root-servers.net. 3600000 IN AAAA 2001:500:1::803f:235
i.root-servers.net. 3600000 IN A 192.36.148.17
i.root-servers.net. 3600000 IN AAAA 2001:7fe::53
j.root-servers.net. 3600000 IN A 192.58.128.30
j.root-servers.net. 3600000 IN AAAA 2001:503:c27::2:30
k.root-servers.net. 3600000 IN A 193.0.14.129
k.root-servers.net. 3600000 IN AAAA 2001:7fd::1
l.root-servers.net. 3600000 IN A 199.7.83.42
l.root-servers.net. 3600000 IN AAAA 2001:500:3::42
m.root-servers.net. 3600000 IN A 202.12.27.33
m.root-servers.net. 3600000 IN AAAA 2001:dc3::35

;; Query time: 78 msec
;; SERVER: 198.41.0.4#53(198.41.0.4)
;; WHEN: Mon Jan 28 15:33:31 2013
;; MSG SIZE rcvd: 699

```

[qcloud]

@lenovo 谢兄弟

[qcloud]

@lenovo 运行 localdns.cmd 怎么就闪一下就没了...

[lenovo]

r#10 @qcloud 用 nircmd 就是为了这，否则要常开 2 个 cmd 窗口
看看进程启动没，测试一下 53 和 9999 端口的解析是否正常

[qcloud]

@lenovo 看了一下进程运行了 DNSCrypt.exe 没有发现 Unbound 的进程

[qcloud]

@lenovo 只有 DNSCrypt.exe 启动，我手动启动了 Unbound.exe
看了下 53 和 9999 端口没有开启

[qcloud]

@lenovo 修改了一下全部启动了，看了一下似乎已经配置好了，试试解析哈

[qcloud]

@lenovo 兄弟...有没有权威 DNS 的搭建方案.....

[yhehior]

@lenovo 感谢您的回答，我一开始是用源码安装的总是出各种问题，现在用 yum 安装了，已经可以稳定运行了，谢谢！