\u8b93\u6211\u5011\u63a2\u7d22\u4e00\u500b\u4f7f\u7528 dig \u767c\u73fe\u6f5b\u5728\u4e0d\u4e00\u81f4\u7684\u5be6\u969b\u4f8b\u5b50\uff1a<\/p>\n

dig +short example.com @8.8.8.8\r\ndig +short example.com @1.1.1.1<\/code><\/pre>\n
\u8fd4\u56de\u7684 IP \u4f4d\u5740\u7684\u5dee\u7570\u53ef\u80fd\u4f5c\u70ba\u6f5b\u5728\u57df\u540d\u6c61\u67d3\u7684\u8b66\u544a\u4fe1\u865f\u3002\u5b9a\u671f\u4f7f\u7528\u9019\u4e9b\u5de5\u5177\u9032\u884c\u7a3d\u6838\u69cb\u6210\u4e86\u5c0d\u6297\u72e1\u733e\u6578\u4f4d\u653b\u64ca\u7684\u524d\u7dda\u9632\u79a6\u3002<\/p>\n
[\/vc_column_text][\/vc_column][\/vc_row][vc_row el_class=”blog-detail-section”][vc_column][vc_column_text]<\/p>\n
\u52a0\u56fa\u5821\u58d8\uff1a\u4f3a\u670d\u5668\u7aef\u89e3\u6c7a\u65b9\u6848<\/strong><\/h2>\n
1. \u63a1\u7528 HTTPS \u4e0a\u7684 DNS\uff08DoH\uff09<\/h3>\n
DoH \u7528 HTTPS \u52a0\u5bc6\u5305\u88f9\u4f60\u7684 DNS \u67e5\u8a62\uff0c\u4f7f\u5176\u514d\u53d7\u7aba\u63a2\u3002\u4f7f\u7528 cloudflared \u5728\u4f60\u7684 Linux \u4f3a\u670d\u5668\u4e0a\u5be6\u65bd DoH\uff1a<\/p>\n
sudo apt-get update && sudo apt-get install cloudflared\r\nsudo cloudflared proxy-dns --port 53 --upstream https:\/\/1.1.1.1\/dns-query --upstream https:\/\/1.0.0.1\/dns-query<\/code><\/pre>\n
2. \u52a0\u5bc6\u57df\u540d\u89e3\u6790\uff1a\u5b89\u5168\u66ff\u4ee3\u65b9\u6848<\/h3>\n
\u96d6\u7136 DoH \u63d0\u4f9b\u4e86\u5f37\u5927\u7684\u4fdd\u8b77\uff0c\u4f46\u50b3\u8f38\u5c64\u5b89\u5168\u6027\uff08TLS\uff09\u70ba\u67e5\u8a62\u52a0\u5bc6\u63d0\u4f9b\u4e86\u4e00\u7a2e\u7c21\u5316\u7684\u65b9\u6cd5\u3002\u4ee5\u4e0b\u662f\u5982\u4f55\u4f7f\u7528\u9019\u7a2e\u5b89\u5168\u65b9\u6cd5\u8a2d\u7f6e Unbound\uff1a<\/p>\n
sudo apt-get install unbound\r\nsudo nano \/etc\/unbound\/unbound.conf<\/code><\/pre>\n
\u5c07\u4ee5\u4e0b\u5167\u5bb9\u6dfb\u52a0\u5230\u4f60\u7684\u914d\u7f6e\u4e2d\uff1a<\/p>\n
server:\r\n  tls-cert-bundle: \/etc\/ssl\/certs\/ca-certificates.crt\r\nforward-zone:\r\n  name: \".\"\r\n  forward-tls-upstream: yes\r\n  forward-addr: 1.1.1.1@853#cloudflare-dns.com\r\n  forward-addr: 1.0.0.1@853#cloudflare-dns.com<\/code><\/pre>\n
\u91cd\u65b0\u555f\u52d5 Unbound \u4ee5\u61c9\u7528\u66f4\u6539\uff1a<\/p>\n
sudo systemctl restart unbound<\/code><\/pre>\n
\u9019\u7a2e\u8a2d\u7f6e\u78ba\u4fdd\u4f60\u7684\u57df\u540d\u67e5\u8a62\u88ab\u52a0\u5bc6\uff0c\u589e\u5f37\u4e86\u7db2\u8def\u901a\u8a0a\u7684\u96b1\u79c1\u548c\u5b89\u5168\u6027\u3002<\/p>\n
3. \u8a8d\u8b49\u52a0\u5bc6\uff1a\u589e\u5f37\u67e5\u8a62\u5b89\u5168\u6027<\/h3>\n
\u70ba\u60a8\u7684\u57df\u540d\u89e3\u6790\u901a\u8a0a\u6dfb\u52a0\u8a8d\u8b49\u63d0\u4f9b\u4e86\u984d\u5916\u7684\u5b89\u5168\u5c64\u3002\u5728 Ubuntu \u4e0a\u90e8\u7f72\u9019\u7a2e\u589e\u5f37\u7684\u5354\u8b70\uff1a<\/p>\n
sudo apt-get install dnscrypt-proxy\r\nsudo systemctl start dnscrypt-proxy\r\nsudo systemctl enable dnscrypt-proxy<\/code><\/pre>\n
\u9019\u7a2e\u8a2d\u7f6e\u5c07\u52a0\u5bc6\u8207\u8a8d\u8b49\u76f8\u7d50\u5408\uff0c\u70ba\u6f5b\u5728\u7684\u7be1\u6539\u6216\u7db2\u8def\u67e5\u8a62\u6514\u622a\u63d0\u4f9b\u4e86\u5f37\u5927\u7684\u9632\u79a6\u3002\u5b83\u78ba\u4fdd\u56de\u61c9\u4f86\u81ea\u5408\u6cd5\u4f86\u6e90\uff0c\u9032\u4e00\u6b65\u589e\u5f37\u4e86\u60a8\u7684\u6578\u4f4d\u57fa\u790e\u8a2d\u65bd\u7684\u5b8c\u6574\u6027\u3002<\/p>\n
[\/vc_column_text][\/vc_column][\/vc_row][vc_row el_class=”blog-detail-section”][vc_column][vc_column_text]<\/p>\n
\u7db2\u8def\u7d1a\u9632\u79a6\uff1a\u6578\u4f4d\u8b77\u57ce\u6cb3<\/strong><\/h2>\n
1. CDN \u6574\u5408\uff1a\u901f\u5ea6\u8207\u5b89\u5168\u4e26\u91cd<\/h3>\n
\u5167\u5bb9\u5206\u767c\u7db2\u8def\u5145\u7576\u5206\u6563\u5f0f\u5c4f\u969c\uff0c\u5728\u60e1\u610f\u6d41\u91cf\u5230\u9054\u60a8\u7684\u4f3a\u670d\u5668\u4e4b\u524d\u5438\u6536\u548c\u904e\u6ffe\u5b83\u3002\u50cf Cloudflare\u3001Akamai \u548c Amazon CloudFront \u7b49\u6d41\u884c\u9078\u9805\u63d0\u4f9b\u5f37\u5927\u7684 DNS \u5b89\u5168\u529f\u80fd\uff0c\u540c\u6642\u5e36\u4f86\u6548\u80fd\u512a\u52e2\u3002<\/p>\n
2. Anycast DNS\uff1a\u5206\u6563\u5f0f\u5f48\u6027<\/h3>\n
\u5be6\u65bd Anycast DNS\uff0c\u5c07\u60a8\u7684 DNS \u57fa\u790e\u8a2d\u65bd\u5206\u5e03\u5728\u591a\u500b\u5730\u7406\u4f4d\u7f6e\uff0c\u5275\u5efa\u4e00\u500b\u66f4\u96e3\u88ab\u653b\u7834\u7684\u5f48\u6027\u7db2\u8def\uff1a<\/p>\n
; Example Anycast DNS configuration for BIND\r\noptions {\r\n  listen-on port 53 { any; };\r\n  allow-query { any; };\r\n  recursion no;\r\n};\r\n\r\nzone \"example.com\" {\r\n  type master;\r\n  file \"\/etc\/bind\/zones\/example.com.zone\";\r\n};\r\n<\/code><\/pre>\n
[\/vc_column_text][\/vc_column][\/vc_row][vc_row el_class=”blog-detail-section”][vc_column][vc_column_text]<\/p>\n
DNSSEC\uff1a\u5bc6\u78bc\u5b78\u76fe\u724c<\/strong><\/h2>\n
DNSSEC \u70ba DNS \u8a18\u9304\u6dfb\u52a0\u52a0\u5bc6\u7c3d\u540d\uff0c\u78ba\u4fdd\u5176\u771f\u5be6\u6027\u3002\u5728\u60a8\u7684\u6b0a\u5a01 DNS \u4f3a\u670d\u5668\u4e0a\u5be6\u65bd DNSSEC\uff1a<\/p>\n
dnssec-keygen -a RSASHA256 -b 2048 -n ZONE example.com\r\ndnssec-keygen -f KSK -a RSASHA256 -b 4096 -n ZONE example.com\r\ndnssec-signzone -A -3 $(head -c 1000 \/dev\/random | sha1sum | cut -b 1-16) -N INCREMENT -o example.com -t example.com.zone<\/code><\/pre>\n
[\/vc_column_text][\/vc_column][\/vc_row][vc_row el_class=”blog-detail-section”][vc_column][vc_column_text]<\/p>\n
\u81ea\u52d5\u5316 DNS \u5b89\u5168\uff1a\u8b66\u89ba\u7684\u54e8\u5175<\/strong><\/h2>\n
\u5229\u7528\u81ea\u52d5\u5316\u4f86\u4fdd\u6301\u5c0d DNS \u57fa\u790e\u8a2d\u65bd\u7684\u6301\u7e8c\u8b66\u60d5\u3002\u9019\u88e1\u6709\u4e00\u500b\u7c21\u55ae\u7684 Python \u8173\u672c\u4f86\u76e3\u63a7 DNS \u89e3\u6790\u4e26\u5728\u8b8a\u5316\u6642\u767c\u51fa\u8b66\u5831\uff1a<\/p>\n
import dns.resolver\r\nimport smtplib\r\nfrom email.mime.text import MIMEText\r\n\r\ndef check_dns(domain, expected_ip):\r\n    try:\r\n        answers = dns.resolver.resolve(domain, 'A')\r\n        for rdata in answers:\r\n            if str(rdata) != expected_ip:\r\n                send_alert(domain, expected_ip, str(rdata))\r\n    except Exception as e:\r\n        send_alert(domain, expected_ip, str(e))\r\n\r\ndef send_alert(domain, expected_ip, actual_ip):\r\n    msg = MIMEText(f\"DNS change detected for {domain}. Expected: {expected_ip}, Actual: {actual_ip}\")\r\n    msg['Subject'] = f\"DNS Alert: {domain}\"\r\n    msg['From'] = \"alert@yourdomain.com\"\r\n    msg['To'] = \"admin@yourdomain.com\"\r\n\r\n    s = smtplib.SMTP('localhost')\r\n    s.send_message(msg)\r\n    s.quit()\r\n\r\ncheck_dns('example.com', '192.0.2.1')\r\n<\/code><\/pre>\n
\u4f7f\u7528 cron \u6216\u985e\u4f3c\u7684\u4f5c\u696d\u6392\u7a0b\u5668\u5b9a\u671f\u904b\u884c\u6b64\u8173\u672c\u3002<\/p>\n
[\/vc_column_text][\/vc_column][\/vc_row][vc_row el_class=”blog-detail-section”][vc_column][vc_column_text]<\/p>\n
\u672a\u4f86\u4e4b\u8def\uff1a\u6578\u4f4d\u57df\u540d\u5b89\u5168\u7684\u65b0\u8208\u8da8\u52e2<\/strong><\/h2>\n
\u96a8\u8457\u7db2\u8def\u74b0\u5883\u7684\u6f14\u8b8a\uff0c\u6211\u5011\u7684\u9632\u79a6\u7b56\u7565\u5fc5\u9808\u540c\u6b65\u9069\u61c9\u3002\u5bc6\u5207\u95dc\u6ce8\u9019\u4e9b\u57df\u540d\u7cfb\u7d71\u4fdd\u8b77\u7684\u65b0\u8208\u8da8\u52e2\uff1a<\/p>\n
\n
\u4eba\u5de5\u667a\u6167\u9a45\u52d5\u7684\u7db2\u8def\u5206\u6790\uff0c\u7528\u65bc\u5373\u6642\u5a01\u8105\u6aa2\u6e2c<\/li>\n
\u57fa\u65bc\u5340\u584a\u93c8\u7684\u89e3\u6790\u7cfb\u7d71\uff0c\u589e\u5f37\u5b8c\u6574\u6027\u548c\u5f48\u6027<\/li>\n
\u6297\u91cf\u5b50\u5bc6\u78bc\u6f14\u7b97\u6cd5\uff0c\u7528\u65bc\u672a\u4f86\u9632\u8b77\u7684\u6578\u4f4d\u57fa\u790e\u8a2d\u65bd\u5b89\u5168<\/li>\n<\/ul>\n
[\/vc_column_text][\/vc_column][\/vc_row][vc_row el_class=”blog-detail-section”][vc_column][vc_column_text]<\/p>\n
\u7d50\u8ad6\uff1a\u6578\u4f4d\u6642\u4ee3\u7684\u8b66\u60d5<\/strong><\/h2>\n
\u5728\u4e0d\u65b7\u8b8a\u5316\u7684\u7db2\u969b\u7db2\u8def\u6c99\u5730\u4e0a\uff0cDNS \u6c61\u67d3\u4ecd\u7136\u662f\u4e00\u500b\u6301\u7e8c\u7684\u5a01\u8105\u3002\u901a\u904e\u5be6\u65bd\u9019\u4e9b\u5148\u9032\u6280\u8853\u4e26\u4fdd\u6301\u5805\u5b9a\u7684\u8b66\u60d5\uff0c\u4f3a\u670d\u5668\u79df\u7528\u63d0\u4f9b\u5546\u53ef\u4ee5\u5275\u5efa\u4e00\u500b\u91dd\u5c0d DNS \u653b\u64ca\u7684\u5f37\u5927\u9632\u79a6\u3002\u8acb\u8a18\u4f4f\uff0c\u5728\u7db2\u8def\u5b89\u5168\u9818\u57df\uff0c\u504f\u57f7\u4e0d\u50c5\u662f\u8b39\u614e\u7684\u2014\u2014\u5b83\u662f\u5fc5\u8981\u7684\u3002<\/p>\n
\u4fdd\u6301\u597d\u5947\uff0c\u4e0d\u65b7\u5b78\u7fd2\uff0c\u9858\u60a8\u7684 DNS \u89e3\u6790\u6c38\u9060\u4fdd\u6301\u771f\u5be6\u3002\u70ba\u4e0d\u5b89\u5168\u4e16\u754c\u4e2d\u7684\u5b89\u5168\u4f3a\u670d\u5668\u79df\u7528\u4e7e\u676f\uff01<\/p>\n
[\/vc_column_text][\/vc_column][\/vc_row]<\/p>\n<\/div>","protected":false},"excerpt":{"rendered":"
[vc_row el_class=”blog-detail-section”][vc_ […]<\/p>\n
Read More…<\/a><\/p>\n","protected":false},"author":2,"featured_media":15451,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"footnotes":""},"categories":[61],"tags":[3394,3017,2706,1892,1016,852],"class_list":["post-15470","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-hong-kong-dedicated-server-tc","tag-doh-tc","tag-dnssec-tc","tag-hosting-tc","tag-server-hosting-tc","tag-dns-pollution-tc","tag-server-security-tc"],"acf":[],"yoast_head":"\n