<?xml version="1.0" encoding="UTF-8" ?>
<rss version="2.0">
<channel>
<title><![CDATA[运维进行时]]></title> 
<link>https://blog.liuts.com/index.php</link> 
<description><![CDATA[互联网运维与架构]]></description> 
<language>zh-cn</language> 
<copyright><![CDATA[运维进行时]]></copyright>
<item>
<link>https://blog.liuts.com/post/168/</link>
<title><![CDATA[解决：DNS服务器不能提供服务(＂quota reached＂)]]></title> 
<author>root &lt;admin@yourname.com&gt;</author>
<category><![CDATA[DNS]]></category>
<pubDate>Wed, 07 Oct 2009 16:17:28 +0000</pubDate> 
<guid>https://blog.liuts.com/post/168/</guid> 
<description>
<![CDATA[ 
	<strong>原因</strong><br/>服务器提供的递归查询的最大数量，导致不能提供DNS解析服务。<br/><strong>解决方法</strong><br/>在/etc/named.conf文件中的“options”中加入下面一行信息：<br/>recursive-clients 1000000;<br/>然后重新启动named即可<br/>DNS and Bind的相关的内容<br/><div class="quote"><div class="quote-title">引用</div><div class="quote-content"><br/>Limiting the number of clientsBIND 9 gives you the ability to restrict the number of clients your name server will serve concurrently. You can apply a limit to the number of recursive clients (resolvers plus name servers using your name server as a forwarder) with the recursive-clients substatement:<br/>options &#123;<br/>recursive-clients 10;<br/>&#125;;<br/>The default limit is 1000. If you find your name server refusing recursive queries and logging, as shown by an error message like this one:<br/>Sep 22 02:26:11 terminator named[13979]: client 192.249.249.151#1677: no more <br/>recursive clients: quota reached<br/>you may want to increase the limit. Conversely, if you find your name server struggling to keep up with the deluge of recursive queries it receives, you could lower the limit.<br/>You can also apply a limit to the number of concurrent TCP connections your name server will process (for zone transfers and TCP-based queries) with the tcp-clients substatement. TCP connections consume considerably more resources than UDP because the host needs to track the state of the TCP connection. The default limit is 100.<br/></div></div><br/>Tags - <a href="https://blog.liuts.com/tags/quota/" rel="tag">quota</a> , <a href="https://blog.liuts.com/tags/reached/" rel="tag">reached</a>
]]>
</description>
</item><item>
<link>https://blog.liuts.com/post/167/</link>
<title><![CDATA[解决：dns has no NS records]]></title> 
<author>root &lt;admin@yourname.com&gt;</author>
<category><![CDATA[DNS]]></category>
<pubDate>Mon, 21 Sep 2009 16:15:20 +0000</pubDate> 
<guid>https://blog.liuts.com/post/167/</guid> 
<description>
<![CDATA[ 
	<strong>参加文章</strong><br/><a href="http://blog.tianya.cn/blogger/post_show.asp?idWriter=571320&Key=834795970&BlogID=311462&PostID=14425741" target="_blank">http://blog.tianya.cn/blogger/post_show.asp?idWriter=571320&Key=834795970&BlogID=311462&PostID=14425741</a><br/>配置完毕运行：<br/>/usr/sbin/named -u named -gc /etc/named.conf<br/><br/><strong>提示</strong><br/><div class="quote"><div class="quote-title">引用</div><div class="quote-content"><br/>...................<br/>Nov 27 13:17:58 dns named[1966]: zone localhost.zone/IN: has no NS records<br/>Nov 27 13:17:58 dns named[1966]: zone named.local/IN: has no NS records<br/>Nov 27 13:17:58 dns named[1966]: zone hk.hn/IN: has no NS records<br/>...................<br/></div></div><br/><div class="quote"><div class="quote-title">引用</div><div class="quote-content"><br/>解决方法：<br/>原因为直接copy web上的配置文件，配置文件中的NS行没有空格或tab，添加上一个tab就可以了。<br/>如"IN NS localhost".换成" IN NS localhost."即可。 <br/></div></div><br/>Tags - <a href="https://blog.liuts.com/tags/no/" rel="tag">no</a> , <a href="https://blog.liuts.com/tags/ns/" rel="tag">ns</a>
]]>
</description>
</item><item>
<link>https://blog.liuts.com/post/131/</link>
<title><![CDATA[mx记录理解]]></title> 
<author>root &lt;admin@yourname.com&gt;</author>
<category><![CDATA[DNS]]></category>
<pubDate>Thu, 22 May 2008 13:42:08 +0000</pubDate> 
<guid>https://blog.liuts.com/post/131/</guid> 
<description>
<![CDATA[ 
	<strong>DNS中MX记录设置</strong><br/><div class="quote"><div class="quote-title">引用</div><div class="quote-content"><br/>*********************************************************************************<br/>xxx.com. IN MX 10 mx01.xxx.com.<br/>xxx.com. IN MX 20 mx02.xxx.com.<br/>xxx.com. IN TXT "v=spf1 ip4:61.211.120.156 a:xxx.com mx:xxx.com -all"<br/>mx01.xxx.com. IN A 61.211.120.156<br/>mx02.xxx.com. IN A 61.211.120.157<br/>sysmail.xxx.com. IN MX 10 mx03.xxx.com<br/>mx03.xxx.com. IN A 61.211.120.158<br/>sysmail.xxx.com. IN TXT "v=spf1 ip4:61.211.120.158 a:sysmail.xxx.com mx:sysmail.xxx.com -all"<br/>*********************************************************************************<br/></div></div><br/><br/><strong>详细说明</strong><br/>如果发邮件到leo.man@xxx.com,dns首先查询MX记录,(xxx.com. IN MX 10 mx01.xxx.com.)<br/>再通过mx01.xxx.com.查询到A记录(mx01.xxx.com. IN A 61.211.120.156)<br/>然后通过SMTP协议发送邮件到61.211.120.156<br/><br/>如果发邮件到leo.man@sysmail.xxx.com,dns首先查询MX记录,(sysmail.xxx.com. IN MX 10 mx03.xxx.com.)<br/>再通过mx03.xxx.com.查询到A记录(mx03.xxx.com. IN A 61.211.120.15<br/>然后通过SMTP协议发送邮件到61.211.120.158<br/><br/>检查mx记录<br/><div class="quote"><div class="quote-title">引用</div><div class="quote-content"><br/>1、dig -t mx sysmail.dianping.com<br/>2、 nslookup<br/>set q=mx<br/>sysmail.xxx.com<br/></div></div><br/><br/>每个域名配置一个spf记录.<br/>什么是SPF<br/>就是Sender Policy Framework。SPF可以防止别人伪造你来发邮件，是一个反伪造性邮件的解决方案。当你定义了你的domain name的SPF记录之后，接收邮件方会根据你的SPF记录来确定连接过来的IP地址是否被包含在SPF记录里面，如果在，则认为是一封正确的邮件，否则则认为是一封伪造的邮件.<br/><br/>a 你域名的A记录 <br/>mx MX服务器 <br/>ptr ptr记录可以直接联系IDC来做,一般7个工作日完成.<br/>all 意思是除了上面的，其他的都不认可。<br/>ip4 你还有没有其他的ip发信？可能你的smtp服务器是独立出来的，那么就填入你的IP地址或者网段。<br/><br/>检查spf记录<br/><div class="quote"><div class="quote-title">引用</div><div class="quote-content"><br/>1:dig -t txt sysmail.xxx.com <br/>2: nslookup<br/>set q=txt<br/>sysmail.xxx.com<br/></div></div><br/><br/>结论：MX记录不是必须的，当多台MailServer时必须指定由哪台来收，这时候才会用MX记录，如多台收需指定优先级。<br/>根据以上的理解，现在想实现以下功能：<br/>有两台Mail Server<br/>IP分别是：<br/><div class="quote"><div class="quote-title">引用</div><div class="quote-content"><br/>192.168.100.1<br/>192.168.100.2<br/></div></div><br/>域名：abc.com<br/>想实现两台Mail Server都能够发邮件，但只限制192.168.100.1收邮件。<br/>abc.com的DNS解析方式如下：<br/><div class="quote"><div class="quote-title">引用</div><div class="quote-content"><br/>abc.com. IN MX 10 mx01.abc.com.<br/>abc.com. IN TXT "v=spf1 ip4:192.168.100.1 a:abc.com mx:abc.com -all"<br/>mx01.abc.com. IN A 192.168.100.1<br/>pop3.abc.com. IN A 192.168.100.1<br/>smtp.abc.com. IN A 192.168.100.1<br/>smtp.abc.com. IN A 192.168.100.2<br/></div></div><br/>说明：当别人给test@abc.com发邮件时，MX告诉它我的邮件系统在mx01.abc.com上面，即由mx01.abc.com来收，发送的时候，直接用smtp.abc.com来做轮循。客户端当然也是用pop3.abc.com来接收邮件了。<br/>Tags - <a href="https://blog.liuts.com/tags/dns/" rel="tag">dns</a>
]]>
</description>
</item><item>
<link>https://blog.liuts.com/post/113/</link>
<title><![CDATA[用bind-9.2.4配制内网DNS服务器[原创]]]></title> 
<author>root &lt;admin@yourname.com&gt;</author>
<category><![CDATA[DNS]]></category>
<pubDate>Thu, 22 May 2008 13:01:46 +0000</pubDate> 
<guid>https://blog.liuts.com/post/113/</guid> 
<description>
<![CDATA[ 
	<strong>一、安装</strong><br/>yum -y install bind<br/>yum -y install bind-chroot<br/><br/><strong>二、生成key</strong><br/>/usr/sbin/dnssec-keygen -a hmac-md5 -b 128 -n user rndc<br/>cat Krndc.+157+13538.*<br/>将生成串更新/etc/rndc.key中secret的值。<br/><br/><strong>三、配制</strong><br/>#/var/named/chroot/etc/named.conf<br/><div class="quote"><div class="quote-title">引用</div><div class="quote-content"><br/>// Default named.conf generated by install of bind-9.2.4-28.el4<br/>options &#123;<br/>&nbsp;&nbsp;&nbsp;&nbsp;directory "/var/named";<br/>&nbsp;&nbsp;&nbsp;&nbsp;pid-file "/var/run/named/named.pid";<br/>&nbsp;&nbsp;&nbsp;&nbsp;dump-file "/var/named/data/cache_dump.db";<br/>&nbsp;&nbsp;&nbsp;&nbsp;statistics-file "/var/named/data/named_stats.txt";<br/>&nbsp;&nbsp;&nbsp;&nbsp;Allow-transfer &#123;tran;&#125;;<br/>&#125;;<br/><br/>acl tran &#123;192.168.0.174;&#125;;<br/><br/>zone "localhost" IN &#123;<br/>&nbsp;&nbsp;&nbsp;&nbsp;type master;<br/>&nbsp;&nbsp;&nbsp;&nbsp;file "localhost.zone";<br/>&nbsp;&nbsp;&nbsp;&nbsp;allow-update &#123; none; &#125;;<br/>&#125;;<br/><br/>zone "0.0.127.in-addr.arpa" IN &#123;<br/>&nbsp;&nbsp;&nbsp;&nbsp;type master;<br/>&nbsp;&nbsp;&nbsp;&nbsp;file "named.local";<br/>&nbsp;&nbsp;&nbsp;&nbsp;allow-update &#123; none; &#125;;<br/>&#125;;<br/><br/>zone"hk.hn"&#123;<br/>&nbsp;&nbsp;&nbsp;&nbsp;type master;<br/>&nbsp;&nbsp;&nbsp;&nbsp;file "hk.hn";<br/>&nbsp;&nbsp;&nbsp;&nbsp;allow-transfer &#123;192.168.100.174;&#125;;<br/>&#125;;<br/><br/>include "/etc/rndc.key";<br/></div></div><br/>#cd /etc<br/>#ln -s /var/named/chroot/etc/named.conf named.conf<br/><br/><br/>#cd /var/named/chroot/var/named/<br/><br/><strong>[localhost.zone]</strong><br/>#vi localhost.zone<br/><div class="quote"><div class="quote-title">引用</div><div class="quote-content"><br/>$TTL 86400<br/>$ORIGIN localhost.<br/>@ 1D IN SOA @ root (<br/>&nbsp;&nbsp;&nbsp;&nbsp;42 ; serial (d. adams)<br/>&nbsp;&nbsp;&nbsp;&nbsp;3H ; refresh<br/>&nbsp;&nbsp;&nbsp;&nbsp;15M ; retry<br/>&nbsp;&nbsp;&nbsp;&nbsp;1W ; expiry<br/>1D ) ; minimum<br/>1D IN NS @<br/>1D IN A 127.0.0.1<br/></div></div><br/>[named.local]<br/>#vi named.local<br/><div class="quote"><div class="quote-title">引用</div><div class="quote-content"><br/>$TTL 86400<br/>@ IN SOA localhost. root.localhost. (<br/>&nbsp;&nbsp;&nbsp;&nbsp;2008063017 ; Serial<br/>&nbsp;&nbsp;&nbsp;&nbsp;28800 ; Refresh<br/>&nbsp;&nbsp;&nbsp;&nbsp;14400 ; Retry<br/>&nbsp;&nbsp;&nbsp;&nbsp;3600000 ; Expire<br/>&nbsp;&nbsp;&nbsp;&nbsp;86400 ) ; Minimum<br/>IN NS localhost.<br/>1 IN PTR localhost.<br/></div></div><br/><br/><strong>[hk.hn]</strong><br/>#vi /var/named/hk.hn<br/><div class="quote"><div class="quote-title">引用</div><div class="quote-content"><br/>$TTL 1m<br/>@ IN SOA ns1.localhost.cn root.ns1.localhost.cn. (<br/>&nbsp;&nbsp;&nbsp;&nbsp;2008063017 ; Serial<br/>&nbsp;&nbsp;&nbsp;&nbsp;108 ; Refresh<br/>&nbsp;&nbsp;&nbsp;&nbsp;360 ; Retry<br/>&nbsp;&nbsp;&nbsp;&nbsp;3600 ; Expire<br/>&nbsp;&nbsp;&nbsp;&nbsp;360 ) ; Minimum<br/>IN NS localhost.<br/>IN NS ns1<br/>MX 5 mx<br/><br/>test1 IN A 192.168.100.1<br/>test2 IN A 192.168.100.2<br/></div></div><br/><br/><br/><strong>四、测试运行</strong><br/>#cd /var/named<br/>#ln -s /var/named/chroot/var/named/localhost.zone localhost.zone<br/>#ln -s /var/named/chroot/var/named/named.local named.local<br/>#/usr/sbin/named -u named -gc /etc/named.conf<br/>#/usr/sbin/named -u named -c /etc/named.conf<br/>或<br/>#service named start<br/>#rndc reload<br/>:)搞定<br/><br/>五、从服务器需做以下修改：<br/>#vi /etc/selinux/config<br/>SELINUX=disabled<br/>#setenforce 0<br/><br/>#vi /etc/sysconfig/named<br/>ENABLE_ZONE_WRITE=yes<br/><br/>参考：<a href="http://dns-learning.twnic.net.tw/bind/toc.html" target="_blank">http://dns-learning.twnic.net.tw/bind/toc.html</a><br/>Tags - <a href="https://blog.liuts.com/tags/dns/" rel="tag">dns</a> , <a href="https://blog.liuts.com/tags/bind/" rel="tag">bind</a>
]]>
</description>
</item><item>
<link>https://blog.liuts.com/post/97/</link>
<title><![CDATA[Online nslookup site]]></title> 
<author>root &lt;admin@yourname.com&gt;</author>
<category><![CDATA[DNS]]></category>
<pubDate>Thu, 22 May 2008 08:28:48 +0000</pubDate> 
<guid>https://blog.liuts.com/post/97/</guid> 
<description>
<![CDATA[ 
	所有提供online nslookup 服务的国外站点集合,不分先后。<br/><div class="quote"><div class="quote-title">引用</div><div class="quote-content"><br/>http://www.webreference.com/cgi-bin/nslookup.cgi<br/>http://www.bankes.com/nslookup.htm<br/>http://network-tools.com/nslook/<br/>http://www.kloth.net/services/nslookup.php<br/>http://dns411.com/<br/>http://www.zoneedit.com/lookup.html<br/>http://centralops.net/co/NsLookup.vbs.asp<br/>http://www.channel1.com/cgi-bin/nslookup.cgi<br/>http://www.subnetonline.com/cgi-bin/webtools/nslookup.pl<br/>http://networking.ringofsaturn.com/Tools/nslookup.php<br/>http://www.webmaster-toolkit.com/ns-lookup.shtml<br/>http://www.simplelogic.com/net_utils/NsLookup.asp<br/>http://helpy.com.ar/NSLookup.php<br/>http://helios.ccunix.ccu.edu.tw/cgi-bin/nslookup.cgi<br/>http://www.tellurian.com/scripts/tools/nslookup.asp<br/>http://www.tti.co.jp/nslookup/i/<br/>http://www.nsg.northwestern.edu/cgi-bin/nslookup.cgi<br/>http://www.his.com/cgi-bin/nslookup<br/>http://www.enc.com.au/itools/nslookup.php<br/></div></div><br/>Tags - <a href="https://blog.liuts.com/tags/nslookup/" rel="tag">nslookup</a>
]]>
</description>
</item><item>
<link>https://blog.liuts.com/post/48/</link>
<title><![CDATA[我是如何实现南北互通的[原创]]]></title> 
<author>root &lt;admin@yourname.com&gt;</author>
<category><![CDATA[DNS]]></category>
<pubDate>Tue, 21 Aug 2007 13:37:53 +0000</pubDate> 
<guid>https://blog.liuts.com/post/48/</guid> 
<description>
<![CDATA[ 
	通过shell获取最新的网通、电信、铁通......最新IP段分部文件。<br/>shell参考：<a href="http://www.chinaunix.net/jh/4/577601.html" target="_blank">http://www.chinaunix.net/jh/4/577601.html</a><br/>修改/etc/named.conf<br/>添加：include "/var/named/CNCGROUP";//网通IP段<br/>vi /var/named/CNCGROUP<br/><div class="quote"><div class="quote-title">引用</div><div class="quote-content"><br/>acl CNCGROUP &#123;<br/>58.16.0.0/16;<br/>58.17.0.0/17;<br/>58.17.128.0/17;<br/>58.18.0.0/16;<br/>58.19.0.0/16;<br/>............................<br/>58.20.0.0/16;<br/>58.21.0.0/16;<br/>58.22.0.0/15;<br/>58.144.0.0/16;<br/>222.163.64.0/18;<br/>222.163.128.0/17;<br/>&#125;;<br/>view "CNCGROUP" &#123;//定义网通域文件<br/>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;match-clients&#123;CNCGROUP;&#125;;<br/>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;recursion yes;<br/>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;zone "sian.com.cn"&#123;<br/>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; type master;<br/>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; file "CNC_sian.com.cn";<br/>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&#125;;<br/>&#125;;<br/><br/>view "external" &#123;//定义非网通域文件<br/>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;match-clients &#123; any; &#125;;<br/>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;recursion no;<br/>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;zone "sian.com.cn"&#123;<br/>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; type master;<br/>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; file "sian.com.cn";<br/>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&#125;;<br/>&#125;;<br/></div></div><br/>注：在Centos4.4自带的BIND版本中有一个要求，所有的zone都得放到view中。<br/>Tags - <a href="https://blog.liuts.com/tags/%25E5%258D%2597%25E5%258C%2597%25E4%25BA%2592%25E9%2580%259A/" rel="tag">南北互通</a>
]]>
</description>
</item>
</channel>
</rss>