\r\n#!\/bin\/bash\r\n# DNS \u4ea4\u53c9\u9a57\u8b49\u8173\u672c\r\nPRIMARY_DNS=\"8.8.8.8\"\r\nSECONDARY_DNS=\"1.1.1.1\"\r\nTARGET_DOMAIN=\"yourdomain.com\"\r\n\r\n# \u6bd4\u8f03\u89e3\u6790\u7d50\u679c\r\nprimary_ip=$(dig @$PRIMARY_DNS $TARGET_DOMAIN +short)\r\nsecondary_ip=$(dig @$SECONDARY_DNS $TARGET_DOMAIN +short)\r\n\r\nif [ \"$primary_ip\" != \"$secondary_ip\" ]; then\r\n    echo \"\u8b66\u544a\uff1a\u6aa2\u6e2c\u5230 DNS \u89e3\u6790\u4e0d\u5339\u914d\"\r\n    echo \"\u4e3b DNS\uff1a$primary_ip\"\r\n    echo \"\u5099\u7528 DNS\uff1a$secondary_ip\"\r\nfi\r\n        <\/code><\/pre>\n
\u9032\u968e\u6aa2\u6e2c\u6280\u8853<\/strong><\/h2>\n
\u5c0d\u65bc\u9999\u6e2f\u4f3a\u670d\u5668\u79df\u7528\u74b0\u5883\uff0c\u5be6\u65bd\u9019\u4e9b\u9032\u968e\u6aa2\u6e2c\u65b9\u6cd5\u53ef\u4ee5\u63d0\u4f9b DNS \u52ab\u6301\u5617\u8a66\u7684\u65e9\u671f\u8b66\u544a\uff1a<\/p>\n
DNSSEC \u9a57\u8b49\u6aa2\u67e5<\/h3>\n
\r\n# \u6aa2\u67e5 DNSSEC \u9a57\u8b49\r\ndig +dnssec yourdomain.com\r\n# \u5728\u61c9\u7b54\u90e8\u5206\u67e5\u627e RRSIG \u8a18\u9304\r\n        <\/code><\/pre>\n
\u95dc\u9375\u9a57\u8b49\u9ede\uff1a<\/p>\n
\n
RRSIG \u5b58\u5728\u6027\u548c\u6709\u6548\u6027<\/li>\n
\u4fe1\u4efb\u93c8\u9a57\u8b49<\/li>\n
TTL \u4e00\u81f4\u6027\u6aa2\u67e5<\/li>\n<\/ul>\n
\u5373\u6642\u76e3\u63a7\u8a2d\u5b9a<\/h3>\n
\r\n# Python \u6301\u7e8c DNS \u76e3\u63a7\u7a0b\u5f0f\u78bc\u7247\u6bb5\r\nimport dns.resolver\r\nimport time\r\n\r\ndef monitor_dns(domain, interval=300):\r\n    resolver = dns.resolver.Resolver()\r\n    resolver.nameservers = ['8.8.8.8']\r\n    \r\n    while True:\r\n        try:\r\n            answer = resolver.resolve(domain, 'A')\r\n            print(f\"\u89e3\u6790\u7d50\u679c: {[str(rdata) for rdata in answer]}\")\r\n            time.sleep(interval)\r\n        except Exception as e:\r\n            print(f\"\u932f\u8aa4: {e}\")\r\n        <\/code><\/pre>\n
\u81ea\u52d5\u6e2c\u8a66\u5be6\u73fe<\/strong><\/h2>\n
\u4f7f\u7528\u9019\u500b\u7d44\u5408\u591a\u7a2e\u6aa2\u6e2c\u65b9\u6cd5\u7684 shell \u8173\u672c\u5be6\u73fe\u81ea\u52d5 DNS \u5065\u5eb7\u6aa2\u67e5\uff1a<\/p>\n
\r\n#!\/bin\/bash\r\n# \u7d9c\u5408 DNS \u5065\u5eb7\u6aa2\u67e5\r\ncheck_dns() {\r\n    local domain=$1\r\n    local expected_ip=$2\r\n    \r\n    # \u591a DNS \u4f3a\u670d\u5668\u6aa2\u67e5\r\n    servers=(\"8.8.8.8\" \"1.1.1.1\" \"208.67.222.222\")\r\n    \r\n    for server in \"${servers[@]}\"; do\r\n        result=$(dig @$server +short $domain)\r\n        if [ \"$result\" != \"$expected_ip\" ]; then\r\n            echo \"\u8b66\u544a\uff1a\u5728 $server \u4e0a\u767c\u73fe\u7591\u4f3c DNS \u52ab\u6301\"\r\n            echo \"\u9810\u671f: $expected_ip\"\r\n            echo \"\u7372\u5f97: $result\"\r\n        fi\r\n    done\r\n}\r\n        <\/code><\/pre>\n
\u9810\u9632\u63aa\u65bd\u548c\u6700\u4f73\u5be6\u8e10<\/strong><\/h2>\n
\u5c0d\u65bc\u9999\u6e2f\u4f3a\u670d\u5668\u79df\u7528\u63d0\u4f9b\u5546\u548c\u4f3a\u670d\u5668\u8a17\u7ba1\u8a2d\u65bd\uff0c\u5be6\u65bd\u5f37\u5927\u7684 DNS \u5b89\u5168\u63aa\u65bd\u81f3\u95dc\u91cd\u8981\u3002\u4ee5\u4e0b\u662f\u52a0\u5f37 DNS \u57fa\u790e\u67b6\u69cb\u7684\u7cfb\u7d71\u65b9\u6cd5\uff1a<\/p>\n
DNS \u4f3a\u670d\u5668\u914d\u7f6e<\/h3>\n
\r\n# BIND \u589e\u5f37\u5b89\u5168\u6027\u914d\u7f6e\u7247\u6bb5\r\noptions {\r\n    version \"not available\";\r\n    allow-transfer {\"none\";};\r\n    recursion no;\r\n    dnssec-validation auto;\r\n    rate-limit {\r\n        responses-per-second 10;\r\n        window 5;\r\n    };\r\n};\r\n        <\/code><\/pre>\n
\u76e3\u63a7\u8a2d\u5b9a<\/h3>\n
\r\n# Prometheus \u76e3\u63a7\u914d\u7f6e\r\nscrape_configs:\r\n  - job_name: 'dns_monitor'\r\n    metrics_path: '\/metrics'\r\n    static_configs:\r\n      - targets: ['dns1:9153', 'dns2:9153']\r\n    relabel_configs:\r\n      - source_labels: [__address__]\r\n        target_label: instance\r\n        <\/code><\/pre>\n
\u57fa\u672c\u5b89\u5168\u63aa\u65bd\u5305\u62ec\uff1a<\/p>\n
\n
\u5b9a\u671f DNSSEC \u91d1\u9470\u8f2a\u63db<\/li>\n
DNS \u67e5\u8a62\u65e5\u8a8c\u8a18\u9304\u548c\u5206\u6790<\/li>\n
\u56de\u61c9\u901f\u7387\u9650\u5236\uff08RRL\uff09<\/li>\n
\u5b58\u53d6\u63a7\u5236\u6e05\u55ae\uff08ACLs\uff09<\/li>\n<\/ul>\n
\u5e38\u898b\u554f\u984c\u6545\u969c\u6392\u9664<\/strong><\/h2>\n
\u8655\u7406\u7591\u4f3c DNS \u52ab\u6301\u6642\uff0c\u8acb\u9075\u5faa\u6b64\u8a3a\u65b7\u6d41\u7a0b\u5716\uff1a<\/p>\n
\r\n1. \u9a57\u8b49 DNS \u89e3\u6790\r\n   \u2514\u2500\u2500 \u6aa2\u67e5\u591a\u500b\u6b0a\u5a01\u4f3a\u670d\u5668\r\n       \u251c\u2500\u2500 \u5339\u914d\uff1a\u7e7c\u7e8c\u76e3\u63a7\r\n       \u2514\u2500\u2500 \u4e0d\u5339\u914d\uff1a\r\n           \u251c\u2500\u2500 \u6aa2\u67e5 DNSSEC\r\n           \u2502   \u251c\u2500\u2500 \u6709\u6548\uff1a\u7db2\u8def\u554f\u984c\r\n           \u2502   \u2514\u2500\u2500 \u7121\u6548\uff1a\u53ef\u80fd\u5b58\u5728\u52ab\u6301\r\n           \u2514\u2500\u2500 \u5be6\u65bd\u7de9\u89e3\u63aa\u65bd\r\n\r\n2. \u56de\u61c9\u9a57\u8b49\r\n   \u2514\u2500\u2500 \u6bd4\u8f03 TTL \u503c\r\n       \u251c\u2500\u2500 \u4e00\u81f4\uff1a\u6b63\u5e38\r\n       \u2514\u2500\u2500 \u4e0d\u4e00\u81f4\uff1a\u8abf\u67e5\u5feb\u53d6\r\n        <\/code><\/pre>\n
\u7d50\u8ad6\u548c\u672a\u4f86\u8003\u91cf<\/strong><\/h2>\n
DNS \u52ab\u6301\u6aa2\u6e2c\u9700\u8981\u591a\u5c64\u6b21\u65b9\u6cd5\uff0c\u7279\u5225\u662f\u5c0d\u65bc\u9762\u81e8\u7368\u7279\u6311\u6230\u7684\u9999\u6e2f\u4f3a\u670d\u5668\u74b0\u5883\u3002\u5b9a\u671f\u76e3\u63a7\u3001\u81ea\u52d5\u5316\u6e2c\u8a66\u548c\u9069\u7576\u7684\u914d\u7f6e\u7ba1\u7406\u69cb\u6210\u4e86\u6709\u6548 DNS \u5b89\u5168\u6027\u7684\u57fa\u790e\u3002<\/p>\n
\u8acb\u8a18\u4f4f\u5b9a\u671f\u66f4\u65b0\u60a8\u7684 DNS \u5b89\u5168\u5354\u5b9a\uff0c\u4e26\u6301\u7e8c\u95dc\u6ce8\u4f3a\u670d\u5668\u79df\u7528\u548c DNS \u5b89\u5168\u9818\u57df\u7684\u65b0\u8208\u5a01\u8105\u3002\u5c0d\u65bc\u9999\u6e2f\u4f3a\u670d\u5668\uff0c\u5be6\u65bd\u9019\u4e9b\u6aa2\u6e2c\u548c\u9810\u9632\u65b9\u6cd5\u53ef\u4ee5\u986f\u8457\u964d\u4f4e DNS \u52ab\u6301\u653b\u64ca\u7684\u98a8\u96aa\u3002<\/p>\n","protected":false},"excerpt":{"rendered":"
DNS \u52ab\u6301\u5df2\u6210\u70ba\u9999\u6e2f\u4f3a\u670d\u5668\u7ba1\u7406\u54e1\u7684\u4e00\u500b\u95dc\u9375\u554f\u984c\uff0c\u7279\u5225\u662f\u5c0d\u4f3a\u670d\u5668\u79df\u7528\u548c\u4f3a\u670d\u5668\u8a17\u7ba1\u670d\u52d9\u9020\u6210\u5f71\u97ff\u3002\u7576\u60a8\u7684 DNS  […]<\/p>\n
Read More…<\/a><\/p>\n","protected":false},"author":3,"featured_media":20467,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"footnotes":""},"categories":[61],"tags":[5310,5309,5311,2692,852],"class_list":["post-20472","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-hong-kong-dedicated-server-tc","tag-hong-kong-server-dns-tc","tag-dns-poisoning-detection-tc","tag-dns-monitoring-tc","tag-dns-troubleshooting-tc","tag-server-security-tc"],"acf":[],"yoast_head":"\n