Ubuntu 20上BIND9本地解析正常但跨主机查询自定义域返回NXDOMAIN问题求助
2026-4-21
Ubuntu 20上BIND9本地解析正常但跨主机查询自定义域返回NXDOMAIN问题求助
各位大佬好，我在Ubuntu 20上安装配置了BIND9，设置了正向wisam.rph和反向70.168.192.in-addr.arpa两个域。现在遇到一个奇怪的问题：本地服务器上解析自定义域名完全正常，但其他Ubuntu 20桌面主机查询同一个自定义域时返回NXDOMAIN，不过跨主机ping服务器IP正常，查询公域（比如google.com）也能正常返回结果，麻烦帮忙看看哪里出问题了？
我的BIND配置文件
Options配置文件
localhost; localnets; 192.168.70.0/24; 10.200.157.0/24; }; options { directory "/var/cache/bind"; forwarders { 9.9.9.9; }; dnssec-validation no; //auth-nxdomain no; listen-on { 127.0.0.1; 192.168.70.66; }; listen-on-v6 { ::1; }; allow-recursion { any; }; allow-query-cache { any; }; allow-query { any; }; };
Local配置文件
// include "/etc/bind/zones.rfc1918"; zone "wisam.rph" { type master; file "/etc/bind/forward.wisam.rph"; allow-query { any; }; }; zone "70.168.192.in-addr.arpa" { type master; file "/etc/bind/reverse.wisam.rph"; allow-query { any; }; }; logging { channel query.log { file "/var/log/named/query.log"; severity dynamic; }; };
正向区域文件（forward.wisam.rph）
$TTL 604800 @ IN SOA vmubuntuauthserver.wisam.rph. root.vmubuntuauthserver.wisam.rph. ( 4 ; Serial 604800 ; Refresh 86400 ; Retry 2419200 ; Expire 604800 ) ; Negative Cache TTL vmubuntuauthserver IN A 192.168.70.66 @ IN NS vmubuntuauthserver.wisam.rph. nameserver IN A 192.168.70.66 www IN A 192.168.70.66 @ IN AAAA ::1
反向区域文件（reverse.wisam.rph）
$TTL 604800 @ IN SOA nameserver.wisam.rph. root.nameserver.wisam.rph. ( 2 ; Serial 604800 ; Refresh 86400 ; Retry 2419200 ; Expire 604800 ) ; Negative Cache TTL @ IN NS nameserver.wisam.rph. 66 IN PTR nameserver.wisam.rph.
resolv.conf配置（服务器端）
我已经禁用了systemd-resolved，删除原resolv.conf后重新创建：
search wisam.rph
测试结果
本地服务器测试（完全正常）
- 正向解析：
dig nameserver.wisam.rph
;; global options: +cmd ;; Got answer: ;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 61584 ;; flags: qr aa rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 1 ;; OPT PSEUDOSECTION: ; EDNS: version: 0, flags:; udp: 4096 ; COOKIE: 32e45ecf7d5069f601000000653a9e7e43d963d1c233e471 (good) ;; QUESTION SECTION: ;nameserver.wisam.rph. IN A ;; ANSWER SECTION: nameserver.wisam.rph. 604800 IN A 192.168.70.66 ;; Query time: 0 msec ;; SERVER: 192.168.70.66#53(192.168.70.66) ;; WHEN: Thu Oct 26 17:14:38 UTC 2023 ;; MSG SIZE rcvd: 93
- 反向解析：
dig -x 192.168.70.66
;; global options: +cmd ;; Got answer: ;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 45455 ;; flags: qr aa rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 1 ;; OPT PSEUDOSECTION: ; EDNS: version: 0, flags:; udp: 4096 ; COOKIE: add17d7373cfe21c01000000653a9ed0d83ec9b4b4f3cfb0 (good) ;; QUESTION SECTION: ;66.70.168.192.in-addr.arpa. IN PTR ;; ANSWER SECTION: 66.70.168.192.in-addr.arpa. 604800 IN PTR nameserver.wisam.rph. ;; Query time: 0 msec ;; SERVER: 192.168.70.66#53(192.168.70.66) ;; WHEN: Thu Oct 26 17:16:00 UTC 2023 ;; MSG SIZE rcvd: 117
跨主机测试（异常部分）
服务器IP是192.168.70.66，我在另一台Ubuntu 20桌面主机上设置DNS为这个IP后：
- 查询自定义域：
dig nameserver.wisam.rph @192.168.70.66返回NXDOMAIN
;; global options: +cmd ;; Got answer: ;; ->>HEADER<<- opcode: QUERY, status: NXDOMAIN, id: 46698 ;; flags: qr rd ra; QUERY: 1, ANSWER: 0, AUTHORITY: 0, ADDITIONAL: 1 ;; OPT PSEUDOSECTION: ; EDNS: version: 0, flags:; udp: 4096 ;; QUESTION SECTION: ;nameserver.wisam.rph. IN A ;; Query time: 4 msec ;; SERVER: 192.168.70.66#53(192.168.70.66) (UDP) ;; WHEN: Thu Oct 26 13:19:36 EDT 2023 ;; MSG SIZE rcvd: 49
- Ping服务器IP：正常连通
64 bytes from 192.168.70.66: icmp_seq=1 ttl=64 time=0.937 ms 64 bytes from 192.168.70.66: icmp_seq=2 ttl=64 time=0.644 ms 64 bytes from 192.168.70.66: icmp_seq=3 ttl=64 time=0.803 ms ...（省略后续正常ping结果）
- 查询公域：
dig google.com @192.168.70.66正常返回
;; global options: +cmd ;; Got answer: ;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 57387 ;; flags: qr rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 1 ;; OPT PSEUDOSECTION: ; EDNS: version: 0, flags:; udp: 1232 ;; QUESTION SECTION: ;google.com. IN A ;; ANSWER SECTION: google.com. 33 IN A 142.250.176.206 ;; Query time: 12 msec ;; SERVER: 192.168.70.66#53(192.168.70.66) (UDP) ;; WHEN: Thu Oct 26 13:21:55 EDT 2023 ;; MSG SIZE rcvd: 55
其他排查信息
- 端口监听情况：
netstat -lnptu | grep 53，确认BIND在192.168.70.66:53监听
will not be shown, you would have to be root to see it all.) tcp 0 0 192.168.70.66:53 0.0.0.0:* LISTEN - tcp 0 0 127.0.0.1:53 0.0.0.0:* LISTEN - tcp 0 0 127.0.0.1:953 0.0.0.0:* LISTEN - tcp6 0 0 ::1:53 :::* LISTEN - tcp6 0 0 ::1:953 :::* LISTEN - udp 0 0 192.168.70.66:53 0.0.0.0:* - udp 0 0 192.168.70.66:53 0.0.0.0:* - udp 0 0 192.168.70.66:53 0.0.0.0:* - udp 0 0 192.168.70.66:53 0.0.0.0:* - udp 0 0 127.0.0.1:53 0.0.0.0:* - udp 0 0 127.0.0.1:53 0.0.0.0:* - udp 0 0 127.0.0.1:53 0.0.0.0:* - udp 0 0 127.0.0.1:53 0.0.0.0:* - udp 0 0 0.0.0.0:5353 0.0.0.0:* - udp6 0 0 ::1:53 :::* - udp6 0 0 ::1:53 :::* - udp6 0 0 ::1:53 :::* - udp6 0 0 ::1:53 :::* - udp6 0 0 :::5353 :::* -
- Wireshark抓包结果：跨主机查询自定义域时，服务器返回“ No such name”，并且权威服务器指向根域
Transaction ID: 0x56ba Flags: 0x8183 Standard query response, No such name 1... .... .... .... = Response: Message is a response .000 0... .... .... = Opcode: Standard query (0) .... .0.. .... .... = Authoritative: Server is not an authority for domain .... ..0. .... .... = Truncated: Message is not truncated .... ...1 .... .... = Recursion desired: Do query recursively .... .... 1... .... = Recursion available: Server can do recursive queries .... .... .0.. .... = Z: reserved (0) .... .... ..0. .... = Answer authenticated: Answer/authority portion was not authenticated by the server .... .... ...0 .... = Non-authenticated data: Unacceptable .... .... .... 0011 = Reply code: No such name (3) Questions: 1 Answer RRs: 0 Authority RRs: 1 Additional RRs: 0 Queries namespace.wisam.rph: type A, class IN Authoritative nameservers <Root>: type SOA, class IN, mname a.root-servers.net [Request In: 187889] [Time: 0.016853000 seconds]
- BIND服务状态：
sudo systemctl status named，确认所有域都加载成功
Loaded: loaded (/lib/systemd/system/named.service; enabled; vendor preset: enabled) Active: active (running) since Sun 2023-10-29 23:25:46 UTC; 1s ago Docs: man:named(8) Main PID: 51693 (named) Tasks: 14 (limit: 19082) Memory: 26.6M CGroup: /system.slice/named.service └─51693 /usr/sbin/named -f -u bind Oct 29 23:25:46 vmubuntuauthserver named[51693]: command channel listening on ::1#953 Oct 29 23:25:46 vmubuntuauthserver named[51693]: managed-keys-zone: loaded serial 6 Oct 29 23:25:46 vmubuntuauthserver named[51693]: zone 0.in-addr.arpa/IN: loaded serial 1 Oct 29 23:25:46 vmubuntuauthserver named[51693]: zone localhost/IN: loaded serial 2 Oct 29 23:25:46 vmubuntuauthserver named[51693]: zone 70.168.192.in-addr.arpa/IN: loaded serial 2 Oct 29 23:25:46 vmubuntuauthserver named[51693]: zone wisam.rph/IN: loaded serial 4 Oct 29 23:25:46 vmubuntuauthserver named[51693]: zone 127.in-addr.arpa/IN: loaded serial 1 Oct 29 23:25:46 vmubuntuauthserver named[51693]: zone 255.in-addr.arpa/IN: loaded serial 1 Oct 29 23:25:46 vmubuntuauthserver named[51693]: all zones loaded Oct 29 23:25:46 vmubuntuauthserver named[51693]: running
我已经尝试过注释/启用listen-on、forwarders等相关配置，但结果都一样。现在实在找不到问题出在哪里了，有没有大佬能指点一下？
备注：内容来源于stack exchange，提问作者Wism Esmel
相关产品推荐
相关产品推荐
