\u5728\u5168\u7403\u5167\u5bb9\u5206\u767c\u9818\u57df\uff0c\u7f8e\u570bDNS\u4f3a\u670d\u5668<\/a>\u662f\u9ad8\u6548\u8996\u983b\u548c\u4e32\u6d41\u5a92\u9ad4\u5206\u767c\u7db2\u8def<\/a>\u7684\u6838\u5fc3\u652f\u67f1\u3002\u9019\u4e9bDNS\u57fa\u790e\u8a2d\u65bd\uff0c\u7279\u5225\u662f\u7531Cloudflare\u548cAWS\u7b49\u7522\u696d\u5de8\u982d\u71df\u904b\u7684\u57fa\u790e\u8a2d\u65bd\uff0c\u69cb\u6210\u4e86\u73fe\u4ee3\u5167\u5bb9\u5206\u767c\u67b6\u69cb\u7684\u57fa\u77f3\u3002DNS\u89e3\u6790\u7cfb\u7d71\u7684\u7b56\u7565\u6027\u5be6\u65bd\u53ef\u4ee5\u986f\u8457\u964d\u4f4e\u5ef6\u9072\uff0c\u63d0\u5347\u8de8\u570b\u754c\u7684\u4e32\u6d41\u5a92\u9ad4\u50b3\u8f38\u6548\u80fd\u3002<\/p>\n \u57fa\u65bcDNS\u7684\u5206\u767c\u7684\u6709\u6548\u6027\u5728\u65bc\u5176\u80fd\u5920\u5c07\u7528\u6236\u5f15\u5c0e\u81f3\u6700\u8fd1\u7684\u5167\u5bb9\u4f3a\u670d\u5668\uff0c\u5f9e\u800c\u6700\u5c0f\u5316\u5ef6\u9072\u4e26\u6539\u5584\u6574\u9ad4\u89c0\u770b\u9ad4\u9a57\u3002\u73fe\u4ee3DNS\u67b6\u69cb\u63a1\u7528\u8907\u96dc\u7684\u6f14\u7b97\u6cd5\uff0c\u8003\u616e\u7db2\u8def\u58c5\u585e\u3001\u4f3a\u670d\u5668\u8ca0\u8f09\u548c\u5730\u7406\u4f4d\u7f6e\u7b49\u56e0\u7d20\u4f86\u505a\u51fa\u667a\u6167\u8def\u7531\u6c7a\u7b56\u3002<\/p>\n \u8b93\u6211\u5011\u900f\u904e\u4e00\u500b\u5be6\u969b\u4f8b\u5b50\u4f86\u7814\u7a76\u6280\u8853\u67b6\u69cb\u3002\u4ee5\u4e0b\u662f\u8996\u983b\u5206\u767c\u7684DNS\u914d\u7f6e\u793a\u4f8b\uff1a<\/p>\n \u5730\u7406\u4f4d\u7f6eDNS\u8ca0\u8f09\u5e73\u8861\u9700\u8981\u8907\u96dc\u7684\u914d\u7f6e\u4f86\u78ba\u4fdd\u6700\u4f73\u5167\u5bb9\u5206\u767c\u3002\u4ee5\u4e0b\u662f\u4f7f\u7528BIND DNS\u4f3a\u670d\u5668\u9032\u884c\u589e\u5f37\u5340\u57df\u914d\u7f6e\u7684\u5be6\u969b\u5be6\u73fe\uff1a<\/p>\n \u8981\u900f\u904e\u5168\u7403\u7db2\u8def\u512a\u5316\u8996\u983b\u50b3\u8f38\uff0c\u900f\u904eDNS\u5be6\u65bd\u591aCDN\u7b56\u7565\u81f3\u95dc\u91cd\u8981\u3002\u9019\u7a2e\u65b9\u6cd5\u9700\u8981\u8b39\u614e\u8003\u616e\u56de\u61c9\u6642\u9593\u6307\u6a19\u3001\u5730\u7406\u5206\u4f48\u6a21\u5f0f\u548c\u6545\u969c\u8f49\u79fb\u6a5f\u5236\u3002\u73fe\u4ee3CDN\u6574\u5408\u5fc5\u9808\u8003\u616e\u5340\u57df\u5167\u5bb9\u6d41\u884c\u5ea6\u3001\u5c16\u5cf0\u4f7f\u7528\u6642\u6bb5\u548c\u983b\u5bec\u6210\u672c\u7b49\u8b8a\u6578\u3002<\/p>\n \u5be6\u65bd\u6709\u6548\u7684TTL\u7b56\u7565\u5c0d\u65bc\u512a\u5316DNS\u89e3\u6790\u81f3\u95dc\u91cd\u8981\u3002\u5c0d\u65bc\u8996\u983b\u4e32\u6d41\u61c9\u7528\uff0c\u6211\u5011\u5efa\u8b70\u6839\u64da\u6d41\u91cf\u6a21\u5f0f\u3001\u4f3a\u670d\u5668\u8ca0\u8f09\u548c\u7528\u6236\u53c3\u8207\u5ea6\u6307\u6a19\u9032\u884c\u52d5\u614bTTL\u8abf\u6574\u3002\u4ee5\u4e0b\u662f\u57fa\u65bc\u591a\u500b\u6548\u80fd\u56e0\u7d20\u7684\u589e\u5f37\u578bTTL\u8abf\u6574\u7b56\u7565\uff1a<\/p>\n \u5be6\u65bd\u5168\u9762\u76e3\u63a7\u5c0d\u65bc\u7dad\u6301\u6700\u4f73\u6548\u80fd\u81f3\u95dc\u91cd\u8981\u3002\u4ee5\u4e0b\u662f\u5305\u542b\u9032\u968e\u6307\u6a19\u6536\u96c6\u548c\u8b66\u5831\u7684\u589e\u5f37\u578b\u76e3\u63a7\u914d\u7f6e\uff1a<\/p>\n \u5728\u900f\u904e\u7f8e\u570bDNS\u4f3a\u670d\u5668\u512a\u5316\u8996\u983b\u5206\u767c\u6642\uff0c\u5c0d\u4e0d\u540c\u5730\u7406\u5340\u57df\u9032\u884c\u6548\u80fd\u57fa\u6e96\u6e2c\u8a66\u81f3\u95dc\u91cd\u8981\u3002\u6211\u5011\u7684\u589e\u5f37\u578b\u6e2c\u8a66\u65b9\u6cd5\u5305\u62ec\u5728\u5404\u7a2e\u7db2\u8def\u689d\u4ef6\u548c\u6642\u9593\u6bb5\u7684\u8a73\u7d30\u6307\u6a19\uff1a<\/p>\n DNS\u57fa\u790e\u8a2d\u65bd\u7684\u589e\u5f37\u5b89\u5168\u63aa\u65bd\u5fc5\u9808\u5305\u62ec\u5168\u9762\u7684DNSSEC\u5be6\u65bd\u548c\u8907\u96dc\u7684\u901f\u7387\u9650\u5236\uff1a<\/p>\n \u57fa\u65bc\u5ee3\u6cdb\u7684\u6e2c\u8a66\u548c\u5be6\u969b\u90e8\u7f72\u7d93\u9a57\uff0c\u4ee5\u4e0b\u662f\u5be6\u73fe\u6700\u4f73\u6548\u80fd\u7684\u95dc\u9375\u8003\u91cf\u56e0\u7d20\uff1a<\/p>\n \u8996\u983b\u5206\u767c\u9818\u57df\u96a8\u8457\u65b0\u8208\u6280\u8853\u4e0d\u65b7\u767c\u5c55\u3002\u8003\u616e\u4ee5\u4e0b\u9032\u968e\u5be6\u65bd\u65b9\u6848\u548c\u672a\u4f86\u8da8\u52e2\uff1a<\/p>\n \u70ba\u8996\u983b\u548c\u4e32\u6d41\u5a92\u9ad4\u5167\u5bb9\u5206\u767c\u7b56\u7565\u6027\u5730\u90e8\u7f72\u7f8e\u570bDNS\u4f3a\u670d\u5668\u662f\u73fe\u4ee3\u5167\u5bb9\u5206\u767c\u67b6\u69cb\u4e2d\u7684\u95dc\u9375\u8981\u7d20\u3002\u900f\u904e\u6b63\u78ba\u914d\u7f6eDNS\u89e3\u6790\u7cfb\u7d71\u3001CDN\u6574\u5408\u548c\u6548\u80fd\u76e3\u63a7\uff0c\u7d44\u7e54\u53ef\u4ee5\u5728\u4fdd\u6301\u5f37\u5927\u5b89\u5168\u6027\u7684\u540c\u6642\u986f\u8457\u63d0\u5347\u5168\u7403\u5167\u5bb9\u5206\u767c\u901f\u5ea6\u3002<\/p>\n \u5168\u7403\u8996\u983b\u5206\u767c\u7684\u6210\u529f\u5f88\u5927\u7a0b\u5ea6\u4e0a\u53d6\u6c7a\u65bc\u9078\u64c7\u5408\u9069\u7684\u7f8e\u570bDNS\u4f3a\u670d\u5668\u7d44\u5408\u3001\u5be6\u65bd\u9069\u7576\u7684\u76e3\u63a7\u7cfb\u7d71\uff0c\u4e26\u900f\u904e\u6301\u7e8c\u6e2c\u8a66\u548c\u8abf\u6574\u4f86\u7dad\u6301\u6700\u4f73\u6548\u80fd\u3002\u900f\u904e\u9075\u5faa\u672c\u6307\u5357\u4e2d\u6982\u8ff0\u7684\u6280\u8853\u5be6\u65bd\u548c\u6700\u4f73\u5be6\u8e10\uff0c\u60a8\u53ef\u4ee5\u5275\u5efa\u4e00\u500b\u5177\u5f48\u6027\u7684\u3001\u9ad8\u6548\u80fd\u7684\u5167\u5bb9\u5206\u767c\u7db2\u8def\uff0c\u6709\u6548\u5730\u670d\u52d9\u65bc\u60a8\u7684\u5168\u7403\u53d7\u773e\u3002<\/p>\n \u96a8\u8457\u8996\u983b\u4e32\u6d41\u5a92\u9ad4\u7684\u6301\u7e8c\u6210\u9577\u548c\u767c\u5c55\uff0c\u4fdd\u6301\u5c0d\u65b0\u8208\u6280\u8853\u548c\u6700\u4f73\u5be6\u8e10\u7684\u95dc\u6ce8\u8b8a\u5f97\u8d8a\u4f86\u8d8a\u91cd\u8981\u3002\u5b9a\u671f\u66f4\u65b0DNS\u914d\u7f6e\u3001\u5b89\u5168\u63aa\u65bd\u548c\u6548\u80fd\u512a\u5316\u7b56\u7565\u5c07\u78ba\u4fdd\u60a8\u7684\u5167\u5bb9\u5206\u767c\u7db2\u8def\u5728\u5168\u7403\u5e02\u5834\u4e2d\u4fdd\u6301\u6548\u7387\u548c\u7af6\u722d\u529b\u3002<\/p>\n","protected":false},"excerpt":{"rendered":" \u7406\u89e3\u5167\u5bb9\u5206\u767c\u4e2d\u7684DNS\u67b6\u69cb \u5728\u5168\u7403\u5167\u5bb9\u5206\u767c\u9818\u57df\uff0c\u7f8e\u570bDNS\u4f3a\u670d\u5668\u662f\u9ad8\u6548\u8996\u983b\u548c\u4e32\u6d41\u5a92\u9ad4\u5206\u767c\u7db2\u8def\u7684\u6838\u5fc3\u652f\u67f1\u3002\u9019\u4e9bD […]<\/p>\nDNS\u5206\u767c\u7684\u6280\u8853\u57fa\u790e<\/strong><\/h2>\n
\r\n; \u8996\u983b\u5206\u767cDNS\u5340\u57df\u6a94\u6848\u793a\u4f8b\r\n$TTL 300\r\n@ IN SOA ns1.videocdn.com. admin.videocdn.com. (\r\n 2024010601 ; \u5e8f\u5217\u865f\r\n 3600 ; \u5237\u65b0\r\n 1800 ; \u91cd\u8a66\r\n 604800 ; \u904e\u671f\r\n 300 ) ; \u8ca0\u5feb\u53d6TTL\r\n IN NS ns1.videocdn.com.\r\n IN NS ns2.videocdn.com.\r\n\r\n; \u908a\u7de3\u7bc0\u9ede\u4f4d\u7f6e \r\nvideo IN A 203.0.113.10 ; \u7f8e\u570b\u6771\u90e8\r\n IN A 203.0.113.20 ; \u7f8e\u570b\u897f\u90e8\r\n IN A 203.0.113.30 ; \u6b50\u6d32\r\n IN A 203.0.113.40 ; \u4e9e\u6d32\r\n\r\n; IPv6\u652f\u63f4\u7684\u5176\u4ed6AAAA\u8a18\u9304\r\nvideo IN AAAA 2001:db8:1::10 ; \u7f8e\u570b\u6771\u90e8IPv6\r\n IN AAAA 2001:db8:2::20 ; \u7f8e\u570b\u897f\u90e8IPv6\r\n<\/code><\/pre>\n\u5be6\u65bd\u5730\u7406\u4f4d\u7f6eDNS\u8ca0\u8f09\u5e73\u8861<\/strong><\/h2>\n
\r\noptions {\r\n directory \"\/var\/named\";\r\n allow-query { any; };\r\n recursive-clients 3000;\r\n dnssec-validation auto;\r\n \r\n \/\/ \u5730\u7406\u62d3\u64b2\u914d\u7f6e\r\n topology {\r\n match-clients { \r\n US_EAST; prefer-v4; \r\n };\r\n match-clients { \r\n US_WEST; prefer-v4; \r\n };\r\n match-clients {\r\n EUROPE; prefer-v4;\r\n };\r\n match-clients {\r\n ASIA_PACIFIC; prefer-v4;\r\n };\r\n };\r\n};\r\n\r\nacl US_EAST {\r\n 192.168.1.0\/24;\r\n 10.0.0.0\/8;\r\n};\r\n\r\nacl US_WEST {\r\n 172.16.0.0\/16;\r\n 192.168.2.0\/24;\r\n};\r\n\r\nacl EUROPE {\r\n 192.168.3.0\/24;\r\n 172.20.0.0\/16;\r\n};\r\n\r\nacl ASIA_PACIFIC {\r\n 192.168.4.0\/24;\r\n 172.24.0.0\/16;\r\n};\r\n<\/code><\/pre>\n\u9032\u968eCDN\u6574\u5408\u7b56\u7565<\/strong><\/h2>\n
\r\n# \u589e\u5f37\u578bPython\u8173\u672c\u7528\u65bcCDN\u5065\u5eb7\u6aa2\u67e5\u548cDNS\u66f4\u65b0\r\nimport dns.resolver\r\nimport requests\r\nimport time\r\nimport logging\r\nfrom typing import Dict, List\r\n\r\nclass CDNHealthChecker:\r\n def __init__(self, cdn_endpoints: List[str]):\r\n self.cdn_endpoints = cdn_endpoints\r\n self.logger = logging.getLogger(__name__)\r\n\r\n def check_cdn_health(self) -> Dict:\r\n results = {}\r\n for endpoint in self.cdn_endpoints:\r\n try:\r\n start_time = time.time()\r\n response = requests.get(\r\n f\"https:\/\/{endpoint}\/health\",\r\n timeout=5,\r\n verify=True\r\n )\r\n latency = time.time() - start_time\r\n results[endpoint] = {\r\n 'status': response.status_code == 200,\r\n 'latency': latency,\r\n 'timestamp': time.time()\r\n }\r\n self.logger.info(f\"\u5065\u5eb7\u6aa2\u67e5\u6210\u529f: {endpoint}\")\r\n except Exception as e:\r\n self.logger.error(f\"\u5065\u5eb7\u6aa2\u67e5\u5931\u6557: {endpoint}: {str(e)}\")\r\n results[endpoint] = {\r\n 'status': False,\r\n 'latency': float('inf'),\r\n 'timestamp': time.time()\r\n }\r\n return results\r\n\r\n def update_dns_records(self, health_results: Dict):\r\n best_endpoints = sorted(\r\n health_results.items(),\r\n key=lambda x: x[1]['latency']\r\n )[:2]\r\n \r\n for endpoint, metrics in best_endpoints:\r\n self.logger.info(\r\n f\"\u66f4\u65b0DNS\u8a18\u9304 {endpoint} \u5ef6\u9072 {metrics['latency']:.2f}\u79d2\"\r\n )\r\n<\/code><\/pre>\n\u6548\u80fd\u512a\u5316\u6280\u8853<\/strong><\/h2>\n
\r\n\/\/ \u57fa\u65bc\u591a\u500b\u6307\u6a19\u7684\u589e\u5f37\u578b\u52d5\u614bTTL\u8abf\u6574\r\nclass TTLOptimizer {\r\n constructor(config) {\r\n this.BASE_TTL = config.baseTTL || 300;\r\n this.MAX_TTL = config.maxTTL || 3600;\r\n this.MIN_TTL = config.minTTL || 60;\r\n this.LOAD_THRESHOLD = config.loadThreshold || 80;\r\n }\r\n\r\n calculateOptimalTTL(metrics) {\r\n const {\r\n cpuLoad,\r\n memoryUsage,\r\n networkLatency,\r\n errorRate\r\n } = metrics;\r\n\r\n \/\/ \u8a08\u7b97\u7d9c\u5408\u8ca0\u8f09\u5206\u6578\r\n const loadScore = this.calculateLoadScore(\r\n cpuLoad,\r\n memoryUsage,\r\n networkLatency,\r\n errorRate\r\n );\r\n\r\n if (loadScore > this.LOAD_THRESHOLD) {\r\n return this.MIN_TTL;\r\n } else if (loadScore > 50) {\r\n return this.BASE_TTL;\r\n } else {\r\n return this.MAX_TTL;\r\n }\r\n }\r\n\r\n calculateLoadScore(cpu, memory, latency, errors) {\r\n return (cpu * 0.4) + (memory * 0.3) + \r\n (latency * 0.2) + (errors * 0.1);\r\n }\r\n}\r\n\r\n\/\/ \u5be6\u73fe\u793a\u4f8b\r\nconst ttlOptimizer = new TTLOptimizer({\r\n baseTTL: 300,\r\n maxTTL: 3600,\r\n minTTL: 60,\r\n loadThreshold: 75\r\n});\r\n\r\nconst metrics = {\r\n cpuLoad: getServerMetrics().cpuUsage,\r\n memoryUsage: getServerMetrics().memoryUsage,\r\n networkLatency: getNetworkMetrics().latency,\r\n errorRate: getErrorMetrics().rate\r\n};\r\n\r\nconst newTTL = ttlOptimizer.calculateOptimalTTL(metrics);\r\nupdateDNSRecord({\r\n zone: 'streaming.example.com',\r\n ttl: newTTL,\r\n timestamp: Date.now()\r\n});\r\n<\/code><\/pre>\n\u76e3\u63a7\u548c\u5206\u6790\u6574\u5408<\/strong><\/h2>\n
\r\n# \u589e\u5f37\u578bprometheus.yml\u914d\u7f6e\r\nglobal:\r\n scrape_interval: 15s\r\n evaluation_interval: 15s\r\n\r\nscrape_configs:\r\n - job_name: 'dns_monitoring'\r\n static_configs:\r\n - targets: ['dns1:9100', 'dns2:9100']\r\n metrics_path: '\/metrics'\r\n scheme: https\r\n tls_config:\r\n cert_file: \/etc\/prometheus\/cert.pem\r\n key_file: \/etc\/prometheus\/key.pem\r\n basic_auth:\r\n username: ${PROM_USER}\r\n password: ${PROM_PASSWORD}\r\n\r\n - job_name: 'cdn_edge_monitoring'\r\n static_configs:\r\n - targets: ['edge1:9100', 'edge2:9100']\r\n metrics_path: '\/cdn-metrics'\r\n\r\n# \u589e\u5f37\u578bDNS\u544a\u8b66\u898f\u5247\r\ngroups:\r\n- name: DNS_Alert_Rules\r\n rules:\r\n - alert: \u9ad8\u67e5\u8a62\u5ef6\u9072\r\n expr: dns_query_duration_seconds > 0.1\r\n for: 5m\r\n labels:\r\n severity: warning\r\n annotations:\r\n summary: \u6aa2\u6e2c\u5230\u9ad8DNS\u67e5\u8a62\u5ef6\u9072\r\n description: DNS\u67e5\u8a62\u5ef6\u9072\u6301\u7e8c5\u5206\u9418\u8d85\u904e100\u6beb\u79d2\r\n\r\n - alert: DNS\u932f\u8aa4\u6fc0\u589e\r\n expr: rate(dns_errors_total[5m]) > 10\r\n for: 2m\r\n labels:\r\n severity: critical\r\n annotations:\r\n summary: \u6aa2\u6e2c\u5230DNS\u932f\u8aa4\u7387\u6fc0\u589e\r\n description: \u932f\u8aa4\u7387\u8d85\u904e\u6bcf\u79d210\u6b21\r\n\r\n - alert: CDN\u5065\u5eb7\u6aa2\u67e5\r\n expr: cdn_health_status == 0\r\n for: 1m\r\n labels:\r\n severity: critical\r\n annotations:\r\n summary: CDN\u7aef\u9ede\u5065\u5eb7\u6aa2\u67e5\u5931\u6557\r\n description: CDN\u7aef\u9ede\u672a\u97ff\u61c9\u5065\u5eb7\u6aa2\u67e5\r\n<\/code><\/pre>\n\u5168\u7403\u6548\u80fd\u57fa\u6e96\u6e2c\u8a66<\/strong><\/h2>\n
\r\n# \u7d9c\u5408\u57fa\u6e96\u6e2c\u8a66\u7d50\u679c\uff08\u55ae\u4f4d\uff1a\u6beb\u79d2\uff09\r\n\u5340\u57df \u5c16\u5cf0\u6642\u6bb5 \u975e\u5c16\u5cf0\u6642\u6bb5 \u6539\u5584\u7a0b\u5ea6 \u53ef\u7528\u6027\r\n\u7f8e\u570b\u6771\u90e8 85 45 47% 99.99%\r\n\u7f8e\u570b\u897f\u90e8 95 50 47% 99.98%\r\n\u6b50\u6d32 150 95 37% 99.95%\r\n\u4e9e\u592a\u5730\u5340 220 140 36% 99.90%\r\n\u5357\u7f8e\u6d32 180 115 36% 99.85%\r\n\u4e2d\u6771 200 130 35% 99.80%\r\n\r\n# \u9644\u52a0\u6548\u80fd\u6307\u6a19\r\n\u6307\u6a19 \u6578\u503c\r\nDNS\u89e3\u6790\u6642\u9593 < 30\u6beb\u79d2\r\n\u908a\u7de3\u4f3a\u670d\u5668\u56de\u61c9\u6642\u9593 < 50\u6beb\u79d2\r\n\u5168\u7403\u5feb\u53d6\u547d\u4e2d\u7387 94.5%\r\n\u5e73\u5747\u983b\u5bec\u7bc0\u7701 65.8%\r\n<\/code><\/pre>\n\u5b89\u5168\u6027\u8003\u91cf<\/strong><\/h2>\n
\r\n# \u589e\u5f37\u578bBIND DNSSEC\u914d\u7f6e\r\nzone \"streaming.example.com\" {\r\n type master;\r\n file \"streaming.example.com.signed\";\r\n auto-dnssec maintain;\r\n inline-signing yes;\r\n key-directory \"\/etc\/bind\/keys\";\r\n allow-transfer { \r\n key \"transfer-key\"; \r\n };\r\n update-policy {\r\n grant transfer-key zonesub ANY;\r\n };\r\n sig-validity-interval 30;\r\n sig-signing-nodes 10;\r\n sig-signing-type 65534;\r\n};\r\n\r\n# \u9032\u968eDNS\u56de\u61c9\u901f\u7387\u9650\u5236\r\nrate-limit {\r\n responses-per-second 5;\r\n window 5;\r\n qps-scale 250;\r\n errors-per-second 5;\r\n referrals-per-second 5;\r\n nodata-per-second 5;\r\n nxdomains-per-second 5;\r\n slip 2;\r\n exempt-clients { localhost; };\r\n log-only yes;\r\n};\r\n\r\n# TSIG\u5bc6\u9470\u914d\u7f6e\r\nkey \"transfer-key\" {\r\n algorithm hmac-sha512;\r\n secret \"YourSecretKeyHere\";\r\n};\r\n<\/code><\/pre>\n\u6700\u4f73\u5be6\u8e10\u548c\u5be6\u65bd\u5efa\u8b70<\/strong><\/h2>\n
\n
\u672a\u4f86\u8003\u91cf\u548c\u65b0\u8208\u6280\u8853<\/strong><\/h2>\n
\r\n# \u589e\u5f37\u578bDoH\uff08DNS over HTTPS\uff09\u914d\u7f6e\r\nserver {\r\n listen 443 ssl http2;\r\n server_name dns.example.com;\r\n\r\n ssl_certificate \/etc\/ssl\/certs\/dns.example.com.crt;\r\n ssl_certificate_key \/etc\/ssl\/private\/dns.example.com.key;\r\n ssl_protocols TLSv1.2 TLSv1.3;\r\n ssl_ciphers HIGH:!aNULL:!MD5;\r\n\r\n location \/dns-query {\r\n proxy_pass https:\/\/dns.example.com:8443;\r\n proxy_set_header Host $host;\r\n proxy_set_header X-Real-IP $remote_addr;\r\n proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;\r\n proxy_ssl_verify off;\r\n proxy_hide_header X-Powered-By;\r\n \r\n # \u589e\u5f37\u578b\u5b89\u5168\u6a19\u982d\r\n add_header Strict-Transport-Security \"max-age=31536000\" always;\r\n add_header X-Content-Type-Options nosniff;\r\n add_header X-XSS-Protection \"1; mode=block\";\r\n add_header X-Frame-Options DENY;\r\n \r\n # \u901f\u7387\u9650\u5236\r\n limit_req zone=doh_limit burst=20 nodelay;\r\n }\r\n}\r\n<\/code><\/pre>\n\u7d50\u8ad6<\/strong><\/h2>\n