\u5728\u5168\u7403\u5185\u5bb9\u5206\u53d1\u9886\u57df\uff0c\u7f8e\u56fdDNS\u670d\u52a1\u5668<\/a>\u662f\u9ad8\u6548\u89c6\u9891\u548c\u6d41\u5a92\u4f53\u5206\u53d1\u7f51\u7edc<\/a>\u7684\u6838\u5fc3\u652f\u67f1\u3002\u8fd9\u4e9bDNS\u57fa\u7840\u8bbe\u65bd\uff0c\u7279\u522b\u662f\u7531Cloudflare\u548cAWS\u7b49\u884c\u4e1a\u5de8\u5934\u8fd0\u8425\u7684\u57fa\u7840\u8bbe\u65bd\uff0c\u6784\u6210\u4e86\u73b0\u4ee3\u5185\u5bb9\u5206\u53d1\u67b6\u6784\u7684\u57fa\u77f3\u3002DNS\u89e3\u6790\u7cfb\u7edf\u7684\u6218\u7565\u6027\u5b9e\u65bd\u53ef\u4ee5\u663e\u8457\u964d\u4f4e\u5ef6\u8fdf\uff0c\u63d0\u5347\u8de8\u56fd\u754c\u7684\u6d41\u5a92\u4f53\u4f20\u8f93\u6027\u80fd\u3002<\/p>\n \u57fa\u4e8eDNS\u7684\u5206\u53d1\u7684\u6709\u6548\u6027\u5728\u4e8e\u5176\u80fd\u591f\u5c06\u7528\u6237\u5f15\u5bfc\u81f3\u6700\u8fd1\u7684\u5185\u5bb9\u670d\u52a1\u5668\uff0c\u4ece\u800c\u6700\u5c0f\u5316\u5ef6\u8fdf\u5e76\u6539\u5584\u6574\u4f53\u89c2\u770b\u4f53\u9a8c\u3002\u73b0\u4ee3DNS\u67b6\u6784\u91c7\u7528\u590d\u6742\u7684\u7b97\u6cd5\uff0c\u8003\u8651\u7f51\u7edc\u62e5\u5835\u3001\u670d\u52a1\u5668\u8d1f\u8f7d\u548c\u5730\u7406\u4f4d\u7f6e\u7b49\u56e0\u7d20\u6765\u505a\u51fa\u667a\u80fd\u8def\u7531\u51b3\u7b56\u3002<\/p>\n \u8ba9\u6211\u4eec\u901a\u8fc7\u4e00\u4e2a\u5b9e\u9645\u4f8b\u5b50\u6765\u7814\u7a76\u6280\u672f\u67b6\u6784\u3002\u4ee5\u4e0b\u662f\u89c6\u9891\u5206\u53d1\u7684DNS\u914d\u7f6e\u793a\u4f8b\uff1a<\/p>\n \u5730\u7406\u4f4d\u7f6eDNS\u8d1f\u8f7d\u5747\u8861\u9700\u8981\u590d\u6742\u7684\u914d\u7f6e\u6765\u786e\u4fdd\u6700\u4f73\u5185\u5bb9\u5206\u53d1\u3002\u4ee5\u4e0b\u662f\u4f7f\u7528BIND DNS\u670d\u52a1\u5668\u8fdb\u884c\u589e\u5f3a\u533a\u57df\u914d\u7f6e\u7684\u5b9e\u9645\u5b9e\u73b0\uff1a<\/p>\n \u8981\u901a\u8fc7\u5168\u7403\u7f51\u7edc\u4f18\u5316\u89c6\u9891\u4f20\u8f93\uff0c\u901a\u8fc7DNS\u5b9e\u65bd\u591aCDN\u7b56\u7565\u81f3\u5173\u91cd\u8981\u3002\u8fd9\u79cd\u65b9\u6cd5\u9700\u8981\u4ed4\u7ec6\u8003\u8651\u54cd\u5e94\u65f6\u95f4\u6307\u6807\u3001\u5730\u7406\u5206\u5e03\u6a21\u5f0f\u548c\u6545\u969c\u8f6c\u79fb\u673a\u5236\u3002\u73b0\u4ee3CDN\u96c6\u6210\u5fc5\u987b\u8003\u8651\u533a\u57df\u5185\u5bb9\u6d41\u884c\u5ea6\u3001\u9ad8\u5cf0\u4f7f\u7528\u65f6\u6bb5\u548c\u5e26\u5bbd\u6210\u672c\u7b49\u53d8\u91cf\u3002<\/p>\n \u5b9e\u65bd\u6709\u6548\u7684TTL\u7b56\u7565\u5bf9\u4e8e\u4f18\u5316DNS\u89e3\u6790\u81f3\u5173\u91cd\u8981\u3002\u5bf9\u4e8e\u89c6\u9891\u6d41\u5e94\u7528\uff0c\u6211\u4eec\u5efa\u8bae\u6839\u636e\u6d41\u91cf\u6a21\u5f0f\u3001\u670d\u52a1\u5668\u8d1f\u8f7d\u548c\u7528\u6237\u53c2\u4e0e\u5ea6\u6307\u6807\u8fdb\u884c\u52a8\u6001TTL\u8c03\u6574\u3002\u4ee5\u4e0b\u662f\u57fa\u4e8e\u591a\u4e2a\u6027\u80fd\u56e0\u7d20\u7684\u589e\u5f3a\u578bTTL\u8c03\u6574\u7b56\u7565\uff1a<\/p>\n \u5b9e\u65bd\u5168\u9762\u76d1\u63a7\u5bf9\u4e8e\u7ef4\u6301\u6700\u4f73\u6027\u80fd\u81f3\u5173\u91cd\u8981\u3002\u4ee5\u4e0b\u662f\u5305\u542b\u9ad8\u7ea7\u6307\u6807\u6536\u96c6\u548c\u8b66\u62a5\u7684\u589e\u5f3a\u578b\u76d1\u63a7\u914d\u7f6e\uff1a<\/p>\n \u5728\u901a\u8fc7\u7f8e\u56fdDNS\u670d\u52a1\u5668\u4f18\u5316\u89c6\u9891\u5206\u53d1\u65f6\uff0c\u5bf9\u4e0d\u540c\u5730\u7406\u533a\u57df\u8fdb\u884c\u6027\u80fd\u57fa\u51c6\u6d4b\u8bd5\u81f3\u5173\u91cd\u8981\u3002\u6211\u4eec\u7684\u589e\u5f3a\u578b\u6d4b\u8bd5\u65b9\u6cd5\u5305\u62ec\u5728\u5404\u79cd\u7f51\u7edc\u6761\u4ef6\u548c\u65f6\u95f4\u6bb5\u7684\u8be6\u7ec6\u6307\u6807\uff1a<\/p>\n DNS\u57fa\u7840\u8bbe\u65bd\u7684\u589e\u5f3a\u5b89\u5168\u63aa\u65bd\u5fc5\u987b\u5305\u62ec\u5168\u9762\u7684DNSSEC\u5b9e\u65bd\u548c\u590d\u6742\u7684\u901f\u7387\u9650\u5236\uff1a<\/p>\n \u57fa\u4e8e\u5e7f\u6cdb\u7684\u6d4b\u8bd5\u548c\u5b9e\u9645\u90e8\u7f72\u7ecf\u9a8c\uff0c\u4ee5\u4e0b\u662f\u5b9e\u73b0\u6700\u4f73\u6027\u80fd\u7684\u5173\u952e\u8003\u8651\u56e0\u7d20\uff1a<\/p>\n \u89c6\u9891\u5206\u53d1\u9886\u57df\u968f\u7740\u65b0\u5174\u6280\u672f\u4e0d\u65ad\u53d1\u5c55\u3002\u8003\u8651\u4ee5\u4e0b\u9ad8\u7ea7\u5b9e\u65bd\u65b9\u6848\u548c\u672a\u6765\u8d8b\u52bf\uff1a<\/p>\n \u4e3a\u89c6\u9891\u548c\u6d41\u5a92\u4f53\u5185\u5bb9\u5206\u53d1\u6218\u7565\u6027\u5730\u90e8\u7f72\u7f8e\u56fdDNS\u670d\u52a1\u5668\u662f\u73b0\u4ee3\u5185\u5bb9\u5206\u53d1\u67b6\u6784\u4e2d\u7684\u5173\u952e\u8981\u7d20\u3002\u901a\u8fc7\u6b63\u786e\u914d\u7f6eDNS\u89e3\u6790\u7cfb\u7edf\u3001CDN\u96c6\u6210\u548c\u6027\u80fd\u76d1\u63a7\uff0c\u7ec4\u7ec7\u53ef\u4ee5\u5728\u4fdd\u6301\u5f3a\u5927\u5b89\u5168\u6027\u7684\u540c\u65f6\u663e\u8457\u63d0\u5347\u5168\u7403\u5185\u5bb9\u5206\u53d1\u901f\u5ea6\u3002<\/p>\n \u5168\u7403\u89c6\u9891\u5206\u53d1\u7684\u6210\u529f\u5f88\u5927\u7a0b\u5ea6\u4e0a\u53d6\u51b3\u4e8e\u9009\u62e9\u5408\u9002\u7684\u7f8e\u56fdDNS\u670d\u52a1\u5668\u7ec4\u5408\u3001\u5b9e\u65bd\u9002\u5f53\u7684\u76d1\u63a7\u7cfb\u7edf\uff0c\u5e76\u901a\u8fc7\u6301\u7eed\u6d4b\u8bd5\u548c\u8c03\u6574\u6765\u7ef4\u6301\u6700\u4f73\u6027\u80fd\u3002\u901a\u8fc7\u9075\u5faa\u672c\u6307\u5357\u4e2d\u6982\u8ff0\u7684\u6280\u672f\u5b9e\u65bd\u548c\u6700\u4f73\u5b9e\u8df5\uff0c\u60a8\u53ef\u4ee5\u521b\u5efa\u4e00\u4e2a\u5f39\u6027\u7684\u3001\u9ad8\u6027\u80fd\u7684\u5185\u5bb9\u5206\u53d1\u7f51\u7edc\uff0c\u6709\u6548\u5730\u670d\u52a1\u4e8e\u60a8\u7684\u5168\u7403\u53d7\u4f17\u3002<\/p>\n \u968f\u7740\u89c6\u9891\u6d41\u5a92\u4f53\u7684\u6301\u7eed\u589e\u957f\u548c\u53d1\u5c55\uff0c\u4fdd\u6301\u5bf9\u65b0\u5174\u6280\u672f\u548c\u6700\u4f73\u5b9e\u8df5\u7684\u5173\u6ce8\u53d8\u5f97\u8d8a\u6765\u8d8a\u91cd\u8981\u3002\u5b9a\u671f\u66f4\u65b0DNS\u914d\u7f6e\u3001\u5b89\u5168\u63aa\u65bd\u548c\u6027\u80fd\u4f18\u5316\u7b56\u7565\u5c06\u786e\u4fdd\u60a8\u7684\u5185\u5bb9\u5206\u53d1\u7f51\u7edc\u5728\u5168\u7403\u5e02\u573a\u4e2d\u4fdd\u6301\u6548\u7387\u548c\u7ade\u4e89\u529b\u3002<\/p>\n","protected":false},"excerpt":{"rendered":" \u7406\u89e3\u5185\u5bb9\u5206\u53d1\u4e2d\u7684DNS\u67b6\u6784 \u5728\u5168\u7403\u5185\u5bb9\u5206\u53d1\u9886\u57df\uff0c\u7f8e\u56fdDNS\u670d\u52a1\u5668\u662f\u9ad8\u6548\u89c6\u9891\u548c\u6d41\u5a92\u4f53\u5206\u53d1\u7f51\u7edc\u7684\u6838\u5fc3\u652f\u67f1\u3002\u8fd9\u4e9bDNS\u57fa\u7840\u8bbe\u65bd\uff0c\u7279\u522b\u662f\u7531Cloudflare\u548cAWS\u7b49\u884c\u4e1a\u5de8\u5934\u8fd0\u8425\u7684\u57fa\u7840\u8bbe\u65bd\uff0c\u6784\u6210\u4e86\u73b0\u4ee3\u5185\u5bb9\u5206\u53d1\u67b6\u6784\u7684\u57fa\u77f3\u3002DNS\u89e3\u6790\u7cfb\u7edf\u7684\u6218\u7565\u6027\u5b9e\u65bd\u53ef\u4ee5\u663e\u8457\u964d\u4f4e\u5ef6\u8fdf\uff0c\u63d0\u5347\u8de8\u56fd\u754c\u7684\u6d41\u5a92\u4f53\u4f20\u8f93\u6027\u80fd\u3002 \u57fa\u4e8eDNS\u7684\u5206\u53d1\u7684\u6709\u6548\u6027\u5728\u4e8e\u5176\u80fd\u591f\u5c06\u7528\u6237\u5f15\u5bfc\u81f3\u6700\u8fd1\u7684\u5185\u5bb9\u670d\u52a1\u5668\uff0c\u4ece\u800c\u6700\u5c0f\u5316\u5ef6\u8fdf\u5e76\u6539\u5584\u6574\u4f53\u89c2\u770b\u4f53\u9a8c\u3002\u73b0\u4ee3DNS\u67b6\u6784\u91c7\u7528\u590d\u6742\u7684\u7b97\u6cd5\uff0c\u8003\u8651\u7f51\u7edc\u62e5\u5835\u3001\u670d\u52a1\u5668\u8d1f\u8f7d\u548c\u5730\u7406\u4f4d\u7f6e\u7b49\u56e0\u7d20\u6765\u505a\u51fa\u667a\u80fd\u8def\u7531\u51b3\u7b56\u3002 DNS\u5206\u53d1\u7684\u6280\u672f\u57fa\u7840 \u8ba9\u6211\u4eec\u901a\u8fc7\u4e00\u4e2a\u5b9e\u9645\u4f8b\u5b50\u6765\u7814\u7a76\u6280\u672f\u67b6\u6784\u3002\u4ee5\u4e0b\u662f\u89c6\u9891\u5206\u53d1\u7684DNS\u914d\u7f6e\u793a\u4f8b\uff1a ; \u89c6\u9891\u5206\u53d1DNS\u533a\u57df\u6587\u4ef6\u793a\u4f8b $TTL 300 @ IN SOA ns1.videocdn.com. admin.videocdn.com. ( 2024010601 ; \u5e8f\u5217\u53f7 3600 ; \u5237\u65b0 1800 ; \u91cd\u8bd5 604800 ; \u8fc7\u671f 300 ) ; \u8d1f\u7f13\u5b58TTL IN NS ns1.videocdn.com. IN NS ns2.videocdn.com. ; \u8fb9\u7f18\u8282\u70b9\u4f4d\u7f6e video IN A 203.0.113.10 ; \u7f8e\u56fd\u4e1c\u90e8 IN A 203.0.113.20 ; \u7f8e\u56fd\u897f\u90e8 IN A 203.0.113.30 ; \u6b27\u6d32 […]<\/p>\nDNS\u5206\u53d1\u7684\u6280\u672f\u57fa\u7840<\/strong><\/h2>\n
\r\n; \u89c6\u9891\u5206\u53d1DNS\u533a\u57df\u6587\u4ef6\u793a\u4f8b\r\n$TTL 300\r\n@ IN SOA ns1.videocdn.com. admin.videocdn.com. (\r\n 2024010601 ; \u5e8f\u5217\u53f7\r\n 3600 ; \u5237\u65b0\r\n 1800 ; \u91cd\u8bd5\r\n 604800 ; \u8fc7\u671f\r\n 300 ) ; \u8d1f\u7f13\u5b58TTL\r\n IN NS ns1.videocdn.com.\r\n IN NS ns2.videocdn.com.\r\n\r\n; \u8fb9\u7f18\u8282\u70b9\u4f4d\u7f6e \r\nvideo IN A 203.0.113.10 ; \u7f8e\u56fd\u4e1c\u90e8\r\n IN A 203.0.113.20 ; \u7f8e\u56fd\u897f\u90e8\r\n IN A 203.0.113.30 ; \u6b27\u6d32\r\n IN A 203.0.113.40 ; \u4e9a\u6d32\r\n\r\n; IPv6\u652f\u6301\u7684\u5176\u4ed6AAAA\u8bb0\u5f55\r\nvideo IN AAAA 2001:db8:1::10 ; \u7f8e\u56fd\u4e1c\u90e8IPv6\r\n IN AAAA 2001:db8:2::20 ; \u7f8e\u56fd\u897f\u90e8IPv6\r\n<\/code><\/pre>\n\u5b9e\u65bd\u5730\u7406\u4f4d\u7f6eDNS\u8d1f\u8f7d\u5747\u8861<\/strong><\/h2>\n
\r\noptions {\r\n directory \"\/var\/named\";\r\n allow-query { any; };\r\n recursive-clients 3000;\r\n dnssec-validation auto;\r\n \r\n \/\/ \u5730\u7406\u62d3\u6251\u914d\u7f6e\r\n topology {\r\n match-clients { \r\n US_EAST; prefer-v4; \r\n };\r\n match-clients { \r\n US_WEST; prefer-v4; \r\n };\r\n match-clients {\r\n EUROPE; prefer-v4;\r\n };\r\n match-clients {\r\n ASIA_PACIFIC; prefer-v4;\r\n };\r\n };\r\n};\r\n\r\nacl US_EAST {\r\n 192.168.1.0\/24;\r\n 10.0.0.0\/8;\r\n};\r\n\r\nacl US_WEST {\r\n 172.16.0.0\/16;\r\n 192.168.2.0\/24;\r\n};\r\n\r\nacl EUROPE {\r\n 192.168.3.0\/24;\r\n 172.20.0.0\/16;\r\n};\r\n\r\nacl ASIA_PACIFIC {\r\n 192.168.4.0\/24;\r\n 172.24.0.0\/16;\r\n};\r\n<\/code><\/pre>\n\u9ad8\u7ea7CDN\u96c6\u6210\u7b56\u7565<\/strong><\/h2>\n
\r\n# \u589e\u5f3a\u578bPython\u811a\u672c\u7528\u4e8eCDN\u5065\u5eb7\u68c0\u67e5\u548cDNS\u66f4\u65b0\r\nimport dns.resolver\r\nimport requests\r\nimport time\r\nimport logging\r\nfrom typing import Dict, List\r\n\r\nclass CDNHealthChecker:\r\n def __init__(self, cdn_endpoints: List[str]):\r\n self.cdn_endpoints = cdn_endpoints\r\n self.logger = logging.getLogger(__name__)\r\n\r\n def check_cdn_health(self) -> Dict:\r\n results = {}\r\n for endpoint in self.cdn_endpoints:\r\n try:\r\n start_time = time.time()\r\n response = requests.get(\r\n f\"https:\/\/{endpoint}\/health\",\r\n timeout=5,\r\n verify=True\r\n )\r\n latency = time.time() - start_time\r\n results[endpoint] = {\r\n 'status': response.status_code == 200,\r\n 'latency': latency,\r\n 'timestamp': time.time()\r\n }\r\n self.logger.info(f\"\u5065\u5eb7\u68c0\u67e5\u6210\u529f: {endpoint}\")\r\n except Exception as e:\r\n self.logger.error(f\"\u5065\u5eb7\u68c0\u67e5\u5931\u8d25: {endpoint}: {str(e)}\")\r\n results[endpoint] = {\r\n 'status': False,\r\n 'latency': float('inf'),\r\n 'timestamp': time.time()\r\n }\r\n return results\r\n\r\n def update_dns_records(self, health_results: Dict):\r\n best_endpoints = sorted(\r\n health_results.items(),\r\n key=lambda x: x[1]['latency']\r\n )[:2]\r\n \r\n for endpoint, metrics in best_endpoints:\r\n self.logger.info(\r\n f\"\u66f4\u65b0DNS\u8bb0\u5f55 {endpoint} \u5ef6\u8fdf {metrics['latency']:.2f}\u79d2\"\r\n )\r\n<\/code><\/pre>\n\u6027\u80fd\u4f18\u5316\u6280\u672f<\/strong><\/h2>\n
\r\n\/\/ \u57fa\u4e8e\u591a\u4e2a\u6307\u6807\u7684\u589e\u5f3a\u578b\u52a8\u6001TTL\u8c03\u6574\r\nclass TTLOptimizer {\r\n constructor(config) {\r\n this.BASE_TTL = config.baseTTL || 300;\r\n this.MAX_TTL = config.maxTTL || 3600;\r\n this.MIN_TTL = config.minTTL || 60;\r\n this.LOAD_THRESHOLD = config.loadThreshold || 80;\r\n }\r\n\r\n calculateOptimalTTL(metrics) {\r\n const {\r\n cpuLoad,\r\n memoryUsage,\r\n networkLatency,\r\n errorRate\r\n } = metrics;\r\n\r\n \/\/ \u8ba1\u7b97\u7efc\u5408\u8d1f\u8f7d\u5206\u6570\r\n const loadScore = this.calculateLoadScore(\r\n cpuLoad,\r\n memoryUsage,\r\n networkLatency,\r\n errorRate\r\n );\r\n\r\n if (loadScore > this.LOAD_THRESHOLD) {\r\n return this.MIN_TTL;\r\n } else if (loadScore > 50) {\r\n return this.BASE_TTL;\r\n } else {\r\n return this.MAX_TTL;\r\n }\r\n }\r\n\r\n calculateLoadScore(cpu, memory, latency, errors) {\r\n return (cpu * 0.4) + (memory * 0.3) + \r\n (latency * 0.2) + (errors * 0.1);\r\n }\r\n}\r\n\r\n\/\/ \u5b9e\u73b0\u793a\u4f8b\r\nconst ttlOptimizer = new TTLOptimizer({\r\n baseTTL: 300,\r\n maxTTL: 3600,\r\n minTTL: 60,\r\n loadThreshold: 75\r\n});\r\n\r\nconst metrics = {\r\n cpuLoad: getServerMetrics().cpuUsage,\r\n memoryUsage: getServerMetrics().memoryUsage,\r\n networkLatency: getNetworkMetrics().latency,\r\n errorRate: getErrorMetrics().rate\r\n};\r\n\r\nconst newTTL = ttlOptimizer.calculateOptimalTTL(metrics);\r\nupdateDNSRecord({\r\n zone: 'streaming.example.com',\r\n ttl: newTTL,\r\n timestamp: Date.now()\r\n});\r\n<\/code><\/pre>\n\u76d1\u63a7\u548c\u5206\u6790\u96c6\u6210<\/strong><\/h2>\n
\r\n# \u589e\u5f3a\u578bprometheus.yml\u914d\u7f6e\r\nglobal:\r\n scrape_interval: 15s\r\n evaluation_interval: 15s\r\n\r\nscrape_configs:\r\n - job_name: 'dns_monitoring'\r\n static_configs:\r\n - targets: ['dns1:9100', 'dns2:9100']\r\n metrics_path: '\/metrics'\r\n scheme: https\r\n tls_config:\r\n cert_file: \/etc\/prometheus\/cert.pem\r\n key_file: \/etc\/prometheus\/key.pem\r\n basic_auth:\r\n username: ${PROM_USER}\r\n password: ${PROM_PASSWORD}\r\n\r\n - job_name: 'cdn_edge_monitoring'\r\n static_configs:\r\n - targets: ['edge1:9100', 'edge2:9100']\r\n metrics_path: '\/cdn-metrics'\r\n\r\n# \u589e\u5f3a\u578bDNS\u544a\u8b66\u89c4\u5219\r\ngroups:\r\n- name: DNS_Alert_Rules\r\n rules:\r\n - alert: \u9ad8\u67e5\u8be2\u5ef6\u8fdf\r\n expr: dns_query_duration_seconds > 0.1\r\n for: 5m\r\n labels:\r\n severity: warning\r\n annotations:\r\n summary: \u68c0\u6d4b\u5230\u9ad8DNS\u67e5\u8be2\u5ef6\u8fdf\r\n description: DNS\u67e5\u8be2\u5ef6\u8fdf\u6301\u7eed5\u5206\u949f\u8d85\u8fc7100\u6beb\u79d2\r\n\r\n - alert: DNS\u9519\u8bef\u6fc0\u589e\r\n expr: rate(dns_errors_total[5m]) > 10\r\n for: 2m\r\n labels:\r\n severity: critical\r\n annotations:\r\n summary: \u68c0\u6d4b\u5230DNS\u9519\u8bef\u7387\u6fc0\u589e\r\n description: \u9519\u8bef\u7387\u8d85\u8fc7\u6bcf\u79d210\u6b21\r\n\r\n - alert: CDN\u5065\u5eb7\u68c0\u67e5\r\n expr: cdn_health_status == 0\r\n for: 1m\r\n labels:\r\n severity: critical\r\n annotations:\r\n summary: CDN\u7aef\u70b9\u5065\u5eb7\u68c0\u67e5\u5931\u8d25\r\n description: CDN\u7aef\u70b9\u672a\u54cd\u5e94\u5065\u5eb7\u68c0\u67e5\r\n<\/code><\/pre>\n\u5168\u7403\u6027\u80fd\u57fa\u51c6\u6d4b\u8bd5<\/strong><\/h2>\n
\r\n# \u7efc\u5408\u57fa\u51c6\u6d4b\u8bd5\u7ed3\u679c\uff08\u5355\u4f4d\uff1a\u6beb\u79d2\uff09\r\n\u533a\u57df \u9ad8\u5cf0\u65f6\u6bb5 \u975e\u9ad8\u5cf0\u65f6\u6bb5 \u6539\u5584\u7a0b\u5ea6 \u53ef\u7528\u6027\r\n\u7f8e\u56fd\u4e1c\u90e8 85 45 47% 99.99%\r\n\u7f8e\u56fd\u897f\u90e8 95 50 47% 99.98%\r\n\u6b27\u6d32 150 95 37% 99.95%\r\n\u4e9a\u592a\u5730\u533a 220 140 36% 99.90%\r\n\u5357\u7f8e\u6d32 180 115 36% 99.85%\r\n\u4e2d\u4e1c 200 130 35% 99.80%\r\n\r\n# \u9644\u52a0\u6027\u80fd\u6307\u6807\r\n\u6307\u6807 \u6570\u503c\r\nDNS\u89e3\u6790\u65f6\u95f4 < 30\u6beb\u79d2\r\n\u8fb9\u7f18\u670d\u52a1\u5668\u54cd\u5e94\u65f6\u95f4 < 50\u6beb\u79d2\r\n\u5168\u7403\u7f13\u5b58\u547d\u4e2d\u7387 94.5%\r\n\u5e73\u5747\u5e26\u5bbd\u8282\u7701 65.8%\r\n<\/code><\/pre>\n\u5b89\u5168\u6027\u8003\u8651<\/strong><\/h2>\n
\r\n# \u589e\u5f3a\u578bBIND DNSSEC\u914d\u7f6e\r\nzone \"streaming.example.com\" {\r\n type master;\r\n file \"streaming.example.com.signed\";\r\n auto-dnssec maintain;\r\n inline-signing yes;\r\n key-directory \"\/etc\/bind\/keys\";\r\n allow-transfer { \r\n key \"transfer-key\"; \r\n };\r\n update-policy {\r\n grant transfer-key zonesub ANY;\r\n };\r\n sig-validity-interval 30;\r\n sig-signing-nodes 10;\r\n sig-signing-type 65534;\r\n};\r\n\r\n# \u9ad8\u7ea7DNS\u54cd\u5e94\u901f\u7387\u9650\u5236\r\nrate-limit {\r\n responses-per-second 5;\r\n window 5;\r\n qps-scale 250;\r\n errors-per-second 5;\r\n referrals-per-second 5;\r\n nodata-per-second 5;\r\n nxdomains-per-second 5;\r\n slip 2;\r\n exempt-clients { localhost; };\r\n log-only yes;\r\n};\r\n\r\n# TSIG\u5bc6\u94a5\u914d\u7f6e\r\nkey \"transfer-key\" {\r\n algorithm hmac-sha512;\r\n secret \"YourSecretKeyHere\";\r\n};\r\n<\/code><\/pre>\n\u6700\u4f73\u5b9e\u8df5\u548c\u5b9e\u65bd\u5efa\u8bae<\/strong><\/h2>\n
\n
\u672a\u6765\u8003\u8651\u548c\u65b0\u5174\u6280\u672f<\/strong><\/h2>\n
\r\n# \u589e\u5f3a\u578bDoH\uff08DNS over HTTPS\uff09\u914d\u7f6e\r\nserver {\r\n listen 443 ssl http2;\r\n server_name dns.example.com;\r\n\r\n ssl_certificate \/etc\/ssl\/certs\/dns.example.com.crt;\r\n ssl_certificate_key \/etc\/ssl\/private\/dns.example.com.key;\r\n ssl_protocols TLSv1.2 TLSv1.3;\r\n ssl_ciphers HIGH:!aNULL:!MD5;\r\n\r\n location \/dns-query {\r\n proxy_pass https:\/\/dns.example.com:8443;\r\n proxy_set_header Host $host;\r\n proxy_set_header X-Real-IP $remote_addr;\r\n proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;\r\n proxy_ssl_verify off;\r\n proxy_hide_header X-Powered-By;\r\n \r\n # \u589e\u5f3a\u578b\u5b89\u5168\u5934\r\n add_header Strict-Transport-Security \"max-age=31536000\" always;\r\n add_header X-Content-Type-Options nosniff;\r\n add_header X-XSS-Protection \"1; mode=block\";\r\n add_header X-Frame-Options DENY;\r\n \r\n # \u901f\u7387\u9650\u5236\r\n limit_req zone=doh_limit burst=20 nodelay;\r\n }\r\n}\r\n<\/code><\/pre>\n\u7ed3\u8bba<\/strong><\/h2>\n