\u5f02\u5e38\u957f\u7684TTL\u503c(\u4f8b\u598286400\u79d2)\u53ef\u80fd\u8868\u793a\u52ab\u6301\u3002\u4f7f\u7528dig\u547d\u4ee4:<\/p>\n

\r\ndig @[DNS_IP] example.com\r\n<\/code><\/pre>\n
\u5982\u679c\u8fd4\u56de\u7684\u4fe1\u606f\u5305\u542b86400,\u53ef\u80fd\u8868\u793a\u5b58\u5728\u5165\u4fb5\u3002<\/p>\n
3. \u68c0\u67e5NXDOMAIN\u54cd\u5e94<\/h3>\n
\u88ab\u52ab\u6301\u7684DNS\u670d\u52a1\u5668\u53ef\u80fd\u8fd4\u56de\u5e26\u6709\u9519\u8befSOA\u8bb0\u5f55\u7684NXDOMAIN\u3002\u4f7f\u7528\u4ee5\u4e0b\u547d\u4ee4\u6d4b\u8bd5:<\/p>\n
\r\ndig @[DNS_IP] test.ip.example.net\r\n<\/code><\/pre>\n
\u5982\u679c\u54cd\u5e94\u5305\u542bSOA\u8bb0\u5f55,\u53ef\u80fd\u8868\u793a\u8def\u7531\u5668\u88ab\u5165\u4fb5\u3002<\/p>\n
4. \u9a8c\u8bc1DNS\u670d\u52a1\u5668\u7248\u672c<\/h3>\n
\u4e00\u4e9b\u88ab\u52ab\u6301\u7684\u670d\u52a1\u5668\u663e\u793a\u7279\u5b9a\u7684\u7248\u672c\u4fe1\u606f:<\/p>\n
\r\ndig @[DNS_IP] version.bind chaos txt\r\n<\/code><\/pre>\n
\u5bfb\u627e\u5305\u542b”unbound 1.16.2″\u3001”sh-dsh-01″\u6216”hz-ds-z11-10″\u7684\u54cd\u5e94,\u8fd9\u53ef\u80fd\u8868\u793a\u5b58\u5728\u5165\u4fb5\u3002<\/p>\n
[\/vc_column_text][\/vc_column][\/vc_row][vc_row el_class=”blog-detail-section”][vc_column][vc_column_text]<\/p>\n
\u9ad8\u7ea7\u4fdd\u62a4\u7b56\u7565<\/strong><\/h2>\n
\u5bf9\u4e8e\u5bfb\u6c42\u9488\u5bf9\u52ab\u6301\u7684\u5f3a\u5927\u4fdd\u62a4\u7684\u670d\u52a1\u5668\u79df\u7528\u63d0\u4f9b\u5546,\u5b9e\u65bd\u4ee5\u4e0b\u5168\u9762\u6280\u672f\u6765\u52a0\u5f3a\u60a8\u7684DNS\u57fa\u7840\u8bbe\u65bd:<\/p>\n
1. DNSSEC\u5b9e\u65bd<\/h3>\n
DNSSEC\u4e3aDNS\u8bb0\u5f55\u6dfb\u52a0\u52a0\u5bc6\u7b7e\u540d,\u9632\u6b62\u672a\u7ecf\u6388\u6743\u7684\u66f4\u6539\u3002\u6309\u7167\u4ee5\u4e0b\u6b65\u9aa4\u64cd\u4f5c:<\/p>\n
\n
\u751f\u6210DNSSEC\u5bc6\u94a5:\n
dnssec-keygen -a RSASHA256 -b 2048 -n ZONE example.com<\/code><\/pre>\n<\/li>\n
\u7b7e\u540d\u60a8\u7684\u533a\u57df\u6587\u4ef6:\n
dnssec-signzone -A -3 $(head -c 1000 \/dev\/random | sha1sum | cut -b 1-16) -N INCREMENT -o example.com -t example.com.zone<\/code><\/pre>\n<\/li>\n
\u66f4\u65b0\u60a8\u7684\u540d\u79f0\u670d\u52a1\u5668\u914d\u7f6e\u4ee5\u4f7f\u7528\u5df2\u7b7e\u540d\u7684\u533a\u57df\u6587\u4ef6\u3002<\/li>\n
\u5c06DS\u8bb0\u5f55\u6dfb\u52a0\u5230\u60a8\u7684\u7236\u533a\u57df\u3002<\/li>\n<\/ol>\n
2. \u5b89\u5168DNS\u89e3\u6790\u5668<\/h3>\n
\u5b9e\u65bdDNS-over-HTTPS (DoH)\u6216DNS-over-TLS (DoT)\u4ee5\u52a0\u5bc6DNS\u67e5\u8be2\u3002\u5bf9\u4e8eDoH,\u4f7f\u7528\u6b64Nginx\u914d\u7f6e:<\/p>\n
\r\nserver {\r\n    listen 443 ssl http2;\r\n    server_name dns.example.com;\r\n\r\n    ssl_certificate \/path\/to\/cert.pem;\r\n    ssl_certificate_key \/path\/to\/key.pem;\r\n\r\n    location \/ {\r\n        proxy_pass https:\/\/1.1.1.1;\r\n        proxy_set_header Host $host;\r\n        proxy_set_header X-Real-IP $remote_addr;\r\n    }\r\n}\r\n<\/code><\/pre>\n
3. DNS\u67e5\u8be2\u76d1\u63a7<\/h3>\n
\u8bbe\u7f6e\u76d1\u63a7\u7cfb\u7edf\u4ee5\u68c0\u6d4bDNS\u67e5\u8be2\u4e2d\u7684\u5f02\u5e38\u6a21\u5f0f\u3002\u4f7f\u7528\u8bf8\u5982dnstap\u7b49\u5de5\u5177\u548c\u81ea\u5b9a\u4e49\u811a\u672c\u6765\u5206\u6790\u67e5\u8be2\u65e5\u5fd7:<\/p>\n
\r\n#!\/bin\/bash\r\ndnstap-read \/var\/log\/named\/dnstap.log | \\\r\nawk '{print $8}' | \\\r\nsort | uniq -c | sort -rn | \\\r\nhead -n 10 > \/var\/log\/dns_query_summary.txt\r\n<\/code><\/pre>\n
4. DNS\u9632\u706b\u5899<\/h3>\n
\u5b9e\u65bd\u4e25\u683c\u7684\u9632\u706b\u5899\u89c4\u5219\u4ee5\u63a7\u5236\u6d41\u91cf\u3002\u4ee5\u4e0b\u662f\u4f7f\u7528iptables\u7684\u793a\u4f8b:<\/p>\n
\r\n# \u4ec5\u5141\u8bb8\u5bf9\u53ef\u4fe1\u670d\u52a1\u5668\u8fdb\u884cDNS\u67e5\u8be2\r\niptables -A OUTPUT -p udp --dport 53 -d 8.8.8.8 -j ACCEPT\r\niptables -A OUTPUT -p udp --dport 53 -d 1.1.1.1 -j ACCEPT\r\n\r\n# \u963b\u6b62\u6240\u6709\u5176\u4ed6\u51fa\u7ad9DNS\u67e5\u8be2\r\niptables -A OUTPUT -p udp --dport 53 -j DROP\r\n<\/code><\/pre>\n
5. \u5b9a\u671f\u5b89\u5168\u5ba1\u8ba1<\/h3>\n
\u4f7f\u7528\u811a\u672c\u5b9e\u65bd\u81ea\u52a8\u6bcf\u65e5\u68c0\u67e5:<\/p>\n
\r\n#!\/bin\/bash\r\n# \u68c0\u67e5\u54cd\u5e94\r\ndig @your_dns_server example.com | grep -q \"ANSWER: 0\" && echo \"\u7591\u4f3cDNS\u52ab\u6301!\" || echo \"DNS\u4f3c\u4e4e\u6b63\u5e38\u3002\"\r\n\r\n# \u68c0\u67e5TTL\u503c\r\ndig @your_dns_server example.com | grep -q \"86400\" && echo \"\u68c0\u6d4b\u5230\u53ef\u7591TTL!\" || echo \"TTL\u4f3c\u4e4e\u6b63\u5e38\u3002\"\r\n\r\n# \u68c0\u67e5DNS\u7248\u672c\r\ndig @your_dns_server version.bind chaos txt | grep -q \"unbound 1.16.2\" && echo \"\u68c0\u6d4b\u5230\u53ef\u7591DNS\u7248\u672c!\" || echo \"DNS\u7248\u672c\u4f3c\u4e4e\u6b63\u5e38\u3002\"\r\n<\/code><\/pre>\n
6. \u5ba2\u6237\u6559\u80b2\u8ba1\u5212<\/h3>\n
\u5236\u5b9a\u5168\u9762\u7684\u5ba2\u6237\u6559\u80b2\u8ba1\u5212:<\/p>\n
\n
\u521b\u5efa\u5173\u4e8e\u4fdd\u62a4\u5bb6\u7528\u8def\u7531\u5668\u7684\u89c6\u9891\u6559\u7a0b<\/li>\n
\u63d0\u4f9b\u8bc6\u522bDNS\u52ab\u6301\u8ff9\u8c61\u7684\u6e05\u5355<\/li>\n
\u5b9a\u671f\u4e3e\u529e\u7f51\u7edc\u5b89\u5168\u6700\u4f73\u5b9e\u8df5\u7f51\u7edc\u7814\u8ba8\u4f1a<\/li>\n
\u5b9e\u65bd\u5b89\u5168\u66f4\u65b0\u548c\u8b66\u62a5\u7684\u901a\u77e5\u7cfb\u7edf<\/li>\n<\/ul>\n
\u901a\u8fc7\u5b9e\u65bd\u8fd9\u4e9b\u9ad8\u7ea7\u7b56\u7565,\u670d\u52a1\u5668\u79df\u7528\u63d0\u4f9b\u5546\u53ef\u4ee5\u663e\u8457\u589e\u5f3a\u5bf9DNS\u52ab\u6301\u5c1d\u8bd5\u7684\u4fdd\u62a4,\u5e76\u786e\u4fdd\u5176DNS\u57fa\u7840\u8bbe\u65bd\u7684\u5b8c\u6574\u6027\u3002<\/p>\n
[\/vc_column_text][\/vc_column][\/vc_row]<\/p>\n<\/div>","protected":false},"excerpt":{"rendered":"
[vc_row el_class=”blog-detail-section”][vc_column][vc_column_text] \u5728\u590d\u6742\u7684\u7f51\u7edc\u5b89\u5168\u73af\u5883\u4e2d,DNS\u52ab\u6301\u4f5c\u4e3a\u4e00\u79cd\u5173\u952e\u5a01\u80c1,\u5bf9\u670d\u52a1\u5668\u79df\u7528\u63d0\u4f9b\u5546\u53ca\u5176\u5ba2\u6237\u6784\u6210\u4e25\u91cd\u6311\u6218\u3002\u672c\u6587\u63a2\u8ba8\u4e86DNS\u52ab\u6301\u7684\u591a\u65b9\u9762\u5f71\u54cd,\u63d0\u4f9b\u4e86\u8be6\u7ec6\u7684\u68c0\u6d4b\u65b9\u6cd5,\u5e76\u6982\u8ff0\u4e86\u5168\u9762\u7684\u9884\u9632\u7b56\u7565,\u4ee5\u4fdd\u62a4\u60a8\u7684\u6570\u5b57\u8d44\u4ea7\u3002 [\/vc_column_text][\/vc_column][\/vc_row][vc_row el_class=”blog-detail-section”][vc_column][vc_column_text] \u7406\u89e3\u57df\u540d\u7cfb\u7edf\u52ab\u6301 DNS\u52ab\u6301\u53d1\u751f\u5728\u6076\u610f\u884c\u4e3a\u8005\u64cd\u7eb5\u57df\u540d\u7cfb\u7edf(DNS)\u4ee5\u5c06\u7528\u6237\u91cd\u5b9a\u5411\u5230\u6b3a\u8bc8\u7f51\u7ad9\u65f6\u3002\u8fd9\u79cd\u653b\u51fb\u53ef\u80fd\u4f1a\u635f\u5bb3\u6570\u636e\u5b8c\u6574\u6027,\u5bfc\u81f4\u8d22\u52a1\u635f\u5931,\u5e76\u635f\u5bb3\u58f0\u8a89\u3002\u4f5c\u4e3a\u670d\u52a1\u5668\u79df\u7528\u63d0\u4f9b\u5546,\u4e86\u89e3\u5e76\u7f13\u89e3\u8fd9\u4e9b\u98ce\u9669\u81f3\u5173\u91cd\u8981\u3002 \u7f51\u7edc\u52ab\u6301\u7684\u6df1\u8fdc\u5f71\u54cd DNS\u52ab\u6301\u53ef\u80fd\u5bf9\u670d\u52a1\u5668\u79df\u7528\u63d0\u4f9b\u5546\u53ca\u5176\u5ba2\u6237\u4ea7\u751f\u4e25\u91cd\u540e\u679c: \u6570\u636e\u6cc4\u9732: \u5c06\u7528\u6237\u91cd\u5b9a\u5411\u5230\u6076\u610f\u7f51\u7ad9\u53ef\u80fd\u5bfc\u81f4\u654f\u611f\u4fe1\u606f\u88ab\u76d7,\u5305\u62ec\u767b\u5f55\u51ed\u8bc1\u548c\u8d22\u52a1\u6570\u636e\u3002 \u8d22\u52a1\u635f\u5931: \u53d7\u5bb3\u8005\u53ef\u80fd\u901a\u8fc7\u6b3a\u8bc8\u4ea4\u6613\u906d\u53d7\u76f4\u63a5\u8d22\u52a1\u635f\u5931,\u6216\u56e0\u7cfb\u7edf\u505c\u673a\u548c\u6062\u590d\u6210\u672c\u800c\u906d\u53d7\u95f4\u63a5\u635f\u5931\u3002 \u58f0\u8a89\u635f\u5bb3: \u670d\u52a1\u5668\u79df\u7528\u63d0\u4f9b\u5546\u53ef\u80fd\u9762\u4e34\u91cd\u5927\u58f0\u8a89\u635f\u5bb3,\u5bfc\u81f4\u5ba2\u6237\u4fe1\u4efb\u4e27\u5931\u548c\u6f5c\u5728\u7684\u6cd5\u5f8b\u540e\u679c\u3002 SEO\u60e9\u7f5a: \u88ab\u52ab\u6301\u7684\u57df\u540d\u53ef\u80fd\u88ab\u641c\u7d22\u5f15\u64ce\u6807\u8bb0,\u5bfc\u81f4\u53ef\u89c1\u5ea6\u548c\u6d41\u91cf\u4e0b\u964d\u3002 \u6076\u610f\u8f6f\u4ef6\u4f20\u64ad: \u653b\u51fb\u8005\u53ef\u4ee5\u4f7f\u7528\u88ab\u52ab\u6301\u7684DNS\u5206\u53d1\u6076\u610f\u8f6f\u4ef6,\u53ef\u80fd\u611f\u67d3\u6574\u4e2a\u7f51\u7edc\u3002 [\/vc_column_text][\/vc_column][\/vc_row][vc_row el_class=”blog-detail-section”][vc_column][vc_column_text] \u5e38\u89c1\u52ab\u6301\u6280\u672f 1. \u57fa\u4e8e\u8def\u7531\u5668\u7684\u52ab\u6301: \u653b\u51fb\u8005\u5229\u7528\u5bb6\u7528\u8def\u7531\u5668\u7684\u6f0f\u6d1e\u6765\u66f4\u6539\u8bbe\u7f6e\u3002 2. \u4e2d\u95f4\u4eba(MITM)\u653b\u51fb: \u62e6\u622a\u67e5\u8be2\u4ee5\u63d0\u4f9b\u865a\u5047IP\u5730\u5740\u3002 3. \u6076\u610f\u8f6f\u4ef6: \u611f\u67d3\u8bbe\u5907\u4ee5\u4fee\u6539\u672c\u5730\u8bbe\u7f6e\u3002 4. \u6076\u610fDNS\u670d\u52a1\u5668: \u8bbe\u7f6e\u6076\u610f\u670d\u52a1\u5668\u4ee5\u9519\u8bef\u89e3\u6790\u67e5\u8be2\u3002 2024\u5e74\u52ab\u6301\u4e8b\u4ef6 \u6700\u8fd1\u53d1\u751f\u7684\u4e00\u8d77\u5927\u89c4\u6a21\u57df\u540d\u7cfb\u7edf\u52ab\u6301\u4e8b\u4ef6,\u6700\u521d\u4e8e2024\u5e745\u6708\u88ab\u89c2\u5bdf\u5230,\u5e76\u57288\u67085\u65e5\u8fbe\u5230\u9ad8\u5cf0,\u5f71\u54cd\u4e86\u4f17\u591a\u5bb6\u7528\u8def\u7531\u5668\u3002\u653b\u51fb\u8005\u5229\u7528\u9ed8\u8ba4\u5bc6\u7801\u548c\u56fa\u4ef6\u6f0f\u6d1e\u83b7\u5f97\u8def\u7531\u5668\u63a7\u5236\u6743\u5e76\u4fee\u6539\u5176\u8bbe\u7f6e\u3002 \u5168\u9762\u68c0\u6d4b\u6280\u672f \u4e3a\u68c0\u6d4b\u6f5c\u5728\u7684\u52ab\u6301,\u670d\u52a1\u5668\u79df\u7528\u63d0\u4f9b\u5546\u53ef\u4ee5\u5b9e\u65bd\u4ee5\u4e0b\u9ad8\u7ea7\u68c0\u67e5: 1. \u68c0\u67e5DNS\u670d\u52a1\u5668IP\u5730\u5740 \u5c06\u60a8\u7684DNS\u670d\u52a1\u5668IP\u4e0e\u5df2\u77e5\u7684\u6076\u610f\u5730\u5740\u8fdb\u884c\u6bd4\u5bf9\u3002DNSPOD\u8bc6\u522b\u4e86\u4ee5\u4e0b\u53ef\u7591IP: 122.9.187.125 8.140.21.95 101.37.71.80 47.102.126.197 118.31.55.110 47.109.22.11 47.113.115.236 47.109.47.151 47.108.228.50 39.106.3.116 47.103.220.247 139.196.219.223 121.43.166.60 106.15.3.137 […]<\/p>\n
Read More…<\/a><\/p>\n","protected":false},"author":2,"featured_media":14986,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"footnotes":""},"categories":[62],"tags":[3172,3171,583,353],"class_list":["post-14991","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-hong-kong-dedicated-server-sc","tag-3172","tag-dns-hijacking-sc","tag-network-security-sc","tag-server-rental-sc"],"acf":[],"yoast_head":"\n