DNS-WIKI - 用户贡献 [zh-cn]

RFC 6724 Default Address Selection for Internet Protocol Version 6 (IPv6)

2025-03-08T02:26:14Z

Admin：

RFC 6724是"Default Address Selection for Internet Protocol Version 6 (IPv6)"（IPv6的默认地址选择）的规范文档，它取代了之前的RFC 3484。这个文档主要描述了在IPv6和双栈（IPv4/IPv6）环境中如何选择源地址和目标地址的算法。

## RFC 6724的主要内容

### 1. 目的和范围
- 定义了主机如何选择默认地址用于通信
- 适用于IPv6和双栈(IPv4/IPv6)环境
- 解决了多地址接口和多宿主主机的地址选择问题

### 2. 基本原则
- 提供了源地址选择和目标地址选择的算法
- 确保通信的一致性和可预测性
- 提高IPv6过渡期间的网络性能和兼容性

### 3. 主要规则
RFC 6724定义了一组规则，按优先级排序：

1. **优先匹配范围**：优先选择与目标地址范围相匹配的源地址
2. **优先本地地址**：通常情况下，本地地址优先于临时地址
3. **优先地址类型**：包含策略表，决定不同地址类型的优先级
4. **优先相同协议**：IPv6优先与IPv6通信，IPv4优先与IPv4通信
5. **避免弃用地址**：避免使用已被标记为弃用的地址
6. **优先首选地址**：优先使用已配置为首选的地址

### 4. 策略表
RFC 6724包含一个默认的策略表，定义了不同类型地址的优先级：
- IPv4地址通常比较特殊类型的IPv6地址（如6to4、Teredo）有更高优先级
- 原生IPv6地址优先于其他类型的地址
- 本地IPv4地址和IPv6地址具有较高优先级

### 5. 实际应用意义
- 解决了多宿主环境中的地址选择问题
- 提高了IPv4/IPv6双栈环境的通信效率
- 为IPv6过渡期提供了稳定的地址选择机制
- 允许网络管理员通过配置策略表来优化地址选择

### 6. 对之前版本的改进
相比RFC 3484，RFC 6724主要做了以下改进：
- 更新了对当前IPv6部署环境的支持
- 改进了临时地址的处理方式
- 调整了策略表优先级以更好地处理当前网络环境
- 添加了一个额外的地址选择组件，用于IPTV等应用场景

这个RFC文档对于理解现代网络环境中地址选择机制非常重要，特别是在IPv6部署和IPv4/IPv6共存的过渡期中。它确保了通信的一致性和可预测性，同时也提供了一个可配置的框架，允许网络管理员根据具体需求进行调整。

RFC 6724 Default Address Selection for Internet Protocol Version 6 (IPv6)

2025-03-08T01:52:32Z

Admin：创建空白页面

IPv6

2025-03-08T01:51:46Z

Admin：创建页面，内容为“RFC 6724 Default Address Selection for Internet Protocol Version 6 (IPv6)”

[[RFC 6724 Default Address Selection for Internet Protocol Version 6 (IPv6)]]

首页

2025-03-08T01:50:17Z

Admin：/* LINUX相关 */

== [[DNS技术]] ==
* [[DNS是什么？]]

* [[DNS-RFC]]
* [[顶级域名（TLD）]]
* [[NAT64与DNS64基本原理概述]]
* [[DNSSEC]]
* [[EDNS]]
* [[名词解释]]

== DNS软件 ==

* [[BIND]]
* PowerDNS
* Unbond
* 其他

== DNS安全 ==

* [[DNSSEC]]
* [[DNS-CVEs]]

* [[网络安全/系统安全/业务安全]]

== [[DNS资讯]] ==
[[新闻-News]]

[[常用公共DNS]]

== [[LINUX]]相关 ==
shell

* [[超细节！十年码农讲述eBPF和XDP技术！]]

* [[XDP技术 — Linux网络处理的高速公路]]

* [[IPv6]]

== 其他技术 ==
cdn

sdn

[[OSI七层模型、TCP/IP四层模型]]

[[安全，加密，TLS]]

== [[帮助信息]] ==

[[MediaWiki 设置配置]]

[[MediaWiki 使用帮助]]

已安装MediaWiki。

请查阅[https://www.mediawiki.org/wiki/Special:MyLanguage/Help:Contents 用户指导]以获取使用本wiki软件的信息。

SSL/TLS握手原理&加密套件简述

2024-08-14T08:01:19Z

Admin：

'''概述'''

SSL/TLS握手时，客户端与服务端协商加密套件是很重要的一个步骤，协商出加密套件后才能继续完成后续的握手和加密通信。而现在SSL/TLS协议通信的实现，基本都是通过OpenSSL开源库，本文章就主要介绍下加密套件的含义以及如何在OpenSSL中指定加密套件。

''' 加密套件介绍'''

SSL/TLS协议的加密套件是定义了在一次连接中所使用的各种加密算法的组合。它包括以下几个主要部分

* 密钥交换算法：用于协商会话密钥，如RSA、DH、ECDH等。
* 对称加密算法：用于实际数据传输的加解密，例如AES、3DES等。
* 消息认证码(MAC)或伪随机函数(PRF)：用于验证数据完整性及防止篡改，如SHA256等。

'''如何指定加密套件'''

使用OpenSSL或者Nginx实现SSL/TLS协议时，都需要指定加密套件。

一般如下指定就可以，表示指定加密套件为任意算法，但身份认证算法和加密算法不能为空。这样客户端和服务端就会自动协商一个加密套件进行通信。

ssl_ciphers ALL:!aNULL; #Nginx配置加密套件

SSL_CTX_set_cipher_list(ServerCTX, "ALL:!aNULL"); #openssl接口配置加密套件

但如果想自己指定加密套件，就可以使用以下列表中的一种。

序号加密套件(完整名称) 加密套件(openssl接口指定名称) 版本密钥协商算法身份验证算法加密算法 MAC

1 TLS_AES_256_GCM_SHA384 TLS_AES_256_GCM_SHA384 TLSv1.3 any any AESGCM(256) AEAD

2 TLS_CHACHA20_POLY1305_SHA256 TLS_CHACHA20_POLY1305_SHA256 TLSv1.3 any any CHACHA20/POLY1305(256) AEAD

3 TLS_AES_128_GCM_SHA256 TLS_AES_128_GCM_SHA256 TLSv1.3 any any AESGCM(128) AEAD

4 TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384 ECDHE-ECDSA-AES256-GCM-SHA384 TLSv1.2 ECDH ECDSA AESGCM(256) AEAD

5 TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 ECDHE-RSA-AES256-GCM-SHA384 TLSv1.2 ECDH RSA AESGCM(256) AEAD

6 TLS_DHE_RSA_WITH_AES_256_GCM_SHA384 DHE-RSA-AES256-GCM-SHA384 TLSv1.2 DH RSA AESGCM(256) AEAD

7 TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256 ECDHE-ECDSA-CHACHA20-POLY1305 TLSv1.2 ECDH ECDSA CHACHA20/POLY1305(256) AEAD

8 TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256 ECDHE-RSA-CHACHA20-POLY1305 TLSv1.2 ECDH RSA CHACHA20/POLY1305(256) AEAD

9 TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256 DHE-RSA-CHACHA20-POLY1305 TLSv1.2 DH RSA CHACHA20/POLY1305(256) AEAD

10 TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256 ECDHE-ECDSA-AES128-GCM-SHA256 TLSv1.2 ECDH ECDSA AESGCM(128) AEAD

11 TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 ECDHE-RSA-AES128-GCM-SHA256 TLSv1.2 ECDH RSA AESGCM(128) AEAD

12 TLS_DHE_RSA_WITH_AES_128_GCM_SHA256 DHE-RSA-AES128-GCM-SHA256 TLSv1.2 DH RSA AESGCM(128) AEAD

13 TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384 ECDHE-ECDSA-AES256-SHA384 TLSv1.2 ECDH ECDSA AES(256) SHA384

14 TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384 ECDHE-RSA-AES256-SHA384 TLSv1.2 ECDH RSA AES(256) SHA384

15 TLS_DHE_RSA_WITH_AES_256_CBC_SHA256 DHE-RSA-AES256-SHA256 TLSv1.2 DH RSA AES(256) SHA256

16 TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256 ECDHE-ECDSA-AES128-SHA256 TLSv1.2 ECDH ECDSA AES(128) SHA256

17 TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256 ECDHE-RSA-AES128-SHA256 TLSv1.2 ECDH RSA AES(128) SHA256

18 TLS_DHE_RSA_WITH_AES_128_CBC_SHA256 DHE-RSA-AES128-SHA256 TLSv1.2 DH RSA AES(128) SHA256

19 TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA ECDHE-ECDSA-AES256-SHA TLSv1 ECDH ECDSA AES(256) SHA1

20 TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA ECDHE-RSA-AES256-SHA TLSv1 ECDH RSA AES(256) SHA1

21 TLS_DHE_RSA_WITH_AES_256_CBC_SHA DHE-RSA-AES256-SHA SSLv3 DH RSA AES(256) SHA1

22 TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA ECDHE-ECDSA-AES128-SHA TLSv1 ECDH ECDSA AES(128) SHA1

23 TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA ECDHE-RSA-AES128-SHA TLSv1 ECDH RSA AES(128) SHA1

24 TLS_DHE_RSA_WITH_AES_128_CBC_SHA DHE-RSA-AES128-SHA SSLv3 DH RSA AES(128) SHA1

25 RSA_PSK_WITH_AES_256_GCM_SHA384 RSA-PSK-AES256-GCM-SHA384 TLSv1.2 RSAPSK RSA AESGCM(256) AEAD

26 DHE_PSK_WITH_AES_256_GCM_SHA384 DHE-PSK-AES256-GCM-SHA384 TLSv1.2 DHEPSK PSK AESGCM(256) AEAD

27 TLS_RSA_PSK_WITH_CHACHA20_POLY1305_SHA256 RSA-PSK-CHACHA20-POLY1305 TLSv1.2 RSAPSK RSA CHACHA20/POLY1305(256) AEAD

28 TLS_DHE_PSK_WITH_CHACHA20_POLY1305_SHA256 DHE-PSK-CHACHA20-POLY1305 TLSv1.2 DHEPSK PSK CHACHA20/POLY1305(256) AEAD

29 TLS_ECDHE_PSK_WITH_CHACHA20_POLY1305_SHA256 ECDHE-PSK-CHACHA20-POLY1305 TLSv1.2 ECDHEPSK PSK CHACHA20/POLY1305(256) AEAD

30 TLS_RSA_WITH_AES_256_GCM_SHA384 AES256-GCM-SHA384 TLSv1.2 RSA RSA AESGCM(256) AEAD

31 PSK_WITH_AES_256_GCM_SHA384 PSK-AES256-GCM-SHA384 TLSv1.2 PSK PSK AESGCM(256) AEAD

32 TLS_PSK_WITH_CHACHA20_POLY1305_SHA256 PSK-CHACHA20-POLY1305 TLSv1.2 PSK PSK CHACHA20/POLY1305(256) AEAD

33 RSA_PSK_WITH_AES_128_GCM_SHA256 RSA-PSK-AES128-GCM-SHA256 TLSv1.2 RSAPSK RSA AESGCM(128) AEAD

34 DHE_PSK_WITH_AES_128_GCM_SHA256 DHE-PSK-AES128-GCM-SHA256 TLSv1.2 DHEPSK PSK AESGCM(128) AEAD

35 TLS_RSA_WITH_AES_128_GCM_SHA256 AES128-GCM-SHA256 TLSv1.2 RSA RSA AESGCM(128) AEAD

36 PSK_WITH_AES_128_GCM_SHA256 PSK-AES128-GCM-SHA256 TLSv1.2 PSK PSK AESGCM(128) AEAD

37 TLS_RSA_WITH_AES_256_CBC_SHA256 AES256-SHA256 TLSv1.2 RSA RSA AES(256) SHA256

38 TLS_RSA_WITH_AES_128_CBC_SHA256 AES128-SHA256 TLSv1.2 RSA RSA AES(128) SHA256

39 ECDHE_PSK_WITH_AES_256_CBC_SHA384 ECDHE-PSK-AES256-CBC-SHA384 TLSv1 ECDHEPSK PSK AES(256) SHA384

40 ECDHE_PSK_WITH_AES_256_CBC_SHA ECDHE-PSK-AES256-CBC-SHA TLSv1 ECDHEPSK PSK AES(256) SHA1

41 RSA_PSK_WITH_AES_256_CBC_SHA384 RSA-PSK-AES256-CBC-SHA384 TLSv1 RSAPSK RSA AES(256) SHA384

42 DHE_PSK_WITH_AES_256_CBC_SHA384 DHE-PSK-AES256-CBC-SHA384 TLSv1 DHEPSK PSK AES(256) SHA384

43 RSA_PSK_WITH_AES_256_CBC_SHA RSA-PSK-AES256-CBC-SHA SSLv3 RSAPSK RSA AES(256) SHA1

44 DHE_PSK_WITH_AES_256_CBC_SHA DHE-PSK-AES256-CBC-SHA SSLv3 DHEPSK PSK AES(256) SHA1

45 TLS_RSA_WITH_AES_256_CBC_SHA AES256-SHA SSLv3 RSA RSA AES(256) SHA1

46 PSK_WITH_AES_256_CBC_SHA384 PSK-AES256-CBC-SHA384 TLSv1 PSK PSK AES(256) SHA384

47 PSK_WITH_AES_256_CBC_SHA PSK-AES256-CBC-SHA SSLv3 PSK PSK AES(256) SHA1

48 ECDHE_PSK_WITH_AES_128_CBC_SHA256 ECDHE-PSK-AES128-CBC-SHA256 TLSv1 ECDHEPSK PSK AES(128) SHA256

49 ECDHE_PSK_WITH_AES_128_CBC_SHA ECDHE-PSK-AES128-CBC-SHA TLSv1 ECDHEPSK PSK AES(128) SHA1

50 RSA_PSK_WITH_AES_128_CBC_SHA256 RSA-PSK-AES128-CBC-SHA256 TLSv1 RSAPSK RSA AES(128) SHA256

51 DHE_PSK_WITH_AES_128_CBC_SHA256 DHE-PSK-AES128-CBC-SHA256 TLSv1 DHEPSK PSK AES(128) SHA256

52 RSA_PSK_WITH_AES_128_CBC_SHA RSA-PSK-AES128-CBC-SHA SSLv3 RSAPSK RSA AES(128) SHA1

53 DHE_PSK_WITH_AES_128_CBC_SHA DHE-PSK-AES128-CBC-SHA SSLv3 DHEPSK PSK AES(128) SHA1

54 TLS_RSA_WITH_AES_128_CBC_SHA AES128-SHA SSLv3 RSA RSA AES(128) SHA1

55 PSK_WITH_AES_128_CBC_SHA256 PSK-AES128-CBC-SHA256 TLSv1 PSK PSK AES(128) SHA256

56 PSK_WITH_AES_128_CBC_SHA PSK-AES128-CBC-SHA SSLv3 PSK PSK AES(128) SHA1

当然也不能任意指定，指定时要看客户端是否支持。比如

'''什么是加密套件？'''

　　加密套件是用于在SSL / TLS握手期间协商安全设置的算法的组合。在ClientHello和ServerHello消息交换之后，客户端发送优先级列表的密码支持套件。然后，服务器使用从列表中选择的密码套件进行响应。

'''TLS算法组合：'''

在TLS中，5类算法组合在一起，称为一个CipherSuite：

认证算法

加密算法

消息认证码算法简称MAC

密钥交换算法

密钥衍生算法

比较常见的算法组合是 TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA 和 TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256，都是ECDHE 做密钥交换，使用RSA做认证，SHA256做PRF算法。

一个使用AES128-CBC做加密算法，用HMAC做MAC。

一个使用AES128-GCM做加密算法，MAC由于GCM作为一种AEAD模式并不需要。

这里是一个加密套件的例子：

TLS _ECDHE_ RSA _ WITH_AES_128_GCM _ SHA256

　　TLS是协议。从ECDHE开始，在握手期间，密钥将通过临时ECDHE进行交换。RSA是认证算法。AES_128_GCM是批量加密算法。SHA-256是散列算法。

　　大多数浏览器和服务器都有各自支持的密码套件列表，两者将在握手过程中进行优先顺序比较，以确定使用的安全设置。

　　最后作为TLS 1.3最终版本，这一切都会改变。虽然以前SSL / TLS通过TLS 1.2版本是使用上诉描述的加密套件模板，但1.3版本的加密套件将会有所改变，因为它们仅用于协商加密和HMAC算法。

　　因为1.3加密套件的结构与之前的版本不同，所以它们与旧的TLS版本不能进行互换。

　　密码是算法，用于加密和解密。它们可以是对称的或不对称的，这取决于它们支持的加密类型。

　　加密套件是用于在SSL / TLS握手期间协商安全设置的密码的命名组合。在握手期间，客户端和服务器交换密码套件的优先级列表，并决定两者最佳支持的套件。

　　在TLS 1.3中，加密套件的结构将改变。

'''SSL协议的握手过程'''

第一步，爱丽丝给出协议版本号、一个客户端生成的随机数（Client random），以及客户端支持的加密方法。

第二步，鲍勃确认双方使用的加密方法，并给出数字证书、以及一个服务器生成的随机数（Server random）。

第三步，爱丽丝确认数字证书(对证书信息进行md5或者hash后的编号==用证书机构的公钥对加密的证书编号解密后的证书编号)有效，然后生成一个新的随机数（Premaster secret），并使用数字证书中的公钥(鲍勃的公钥)，加密这个随机数，发给鲍勃。

第四步，鲍勃使用自己的私钥，获取爱丽丝发来的随机数（即Premaster secret）。

第五步，爱丽丝和鲍勃根据约定的加密方法，使用前面的三个随机数，生成"对话密钥"（session key），用来加密接下来的整个对话过程。

https要使客户端与服务器端的通信过程得到安全保证，必须使用对称加密算法并且每个客户端的算法都不一样，需要一个协商过程，但是协商对称加密算法的过程，需要使用非对称加密算法来保证安全，直接使用非对称加密的过程本身也不安全，会有中间人篡改公钥的可能性，所以客户端与服务器不直接使用公钥，而是使用数字证书签发机构颁发的证书来保证非对称加密过程本身的安全。这样通过这些机制协商出一个对称加密算法，就此双方使用该算法进行加密解密。从而解决了客户端与服务器端之间的通信安全问题。

SSL/TLS握手原理&加密套件简述

2024-08-14T07:57:13Z

Admin：创建页面，内容为“概述 SSL/TLS握手时，客户端与服务端协商加密套件是很重要的一个步骤，协商出加密套件后才能继续完成后续的握手和加密通信。而现在SSL/TLS协议通信的实现，基本都是通过OpenSSL开源库，本文章就主要介绍下加密套件的含义以及如何在OpenSSL中指定加密套件。加密套件介绍 SSL/TLS协议的加密套件是定义了在一次连接中所使用的各种加密算法的组合。…”

概述

SSL/TLS握手时，客户端与服务端协商加密套件是很重要的一个步骤，协商出加密套件后才能继续完成后续的握手和加密通信。而现在SSL/TLS协议通信的实现，基本都是通过OpenSSL开源库，本文章就主要介绍下加密套件的含义以及如何在OpenSSL中指定加密套件。

加密套件介绍

SSL/TLS协议的加密套件是定义了在一次连接中所使用的各种加密算法的组合。它包括以下几个主要部分

密钥交换算法：用于协商会话密钥，如RSA、DH、ECDH等。

对称加密算法：用于实际数据传输的加解密，例如AES、3DES等。

消息认证码(MAC)或伪随机函数(PRF)：用于验证数据完整性及防止篡改，如SHA256等。

如何指定加密套件

使用OpenSSL或者Nginx实现SSL/TLS协议时，都需要指定加密套件。

一般如下指定就可以，表示指定加密套件为任意算法，但身份认证算法和加密算法不能为空。这样客户端和服务端就会自动协商一个加密套件进行通信。

ssl_ciphers ALL:!aNULL; #Nginx配置加密套件

SSL_CTX_set_cipher_list(ServerCTX, "ALL:!aNULL"); #openssl接口配置加密套件

'''什么是加密套件？'''

　　加密套件是用于在SSL / TLS握手期间协商安全设置的算法的组合。在ClientHello和ServerHello消息交换之后，客户端发送优先级列表的密码支持套件。然后，服务器使用从列表中选择的密码套件进行响应。

'''TLS算法组合：'''

在TLS中，5类算法组合在一起，称为一个CipherSuite：

认证算法

加密算法

消息认证码算法简称MAC

密钥交换算法

密钥衍生算法

比较常见的算法组合是 TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA 和 TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256，都是ECDHE 做密钥交换，使用RSA做认证，SHA256做PRF算法。

一个使用AES128-CBC做加密算法，用HMAC做MAC。

一个使用AES128-GCM做加密算法，MAC由于GCM作为一种AEAD模式并不需要。

这里是一个加密套件的例子：

TLS _ECDHE_ RSA _ WITH_AES_128_GCM _ SHA256

　　TLS是协议。从ECDHE开始，在握手期间，密钥将通过临时ECDHE进行交换。RSA是认证算法。AES_128_GCM是批量加密算法。SHA-256是散列算法。

　　大多数浏览器和服务器都有各自支持的密码套件列表，两者将在握手过程中进行优先顺序比较，以确定使用的安全设置。

　　最后作为TLS 1.3最终版本，这一切都会改变。虽然以前SSL / TLS通过TLS 1.2版本是使用上诉描述的加密套件模板，但1.3版本的加密套件将会有所改变，因为它们仅用于协商加密和HMAC算法。

　　因为1.3加密套件的结构与之前的版本不同，所以它们与旧的TLS版本不能进行互换。

　　密码是算法，用于加密和解密。它们可以是对称的或不对称的，这取决于它们支持的加密类型。

　　加密套件是用于在SSL / TLS握手期间协商安全设置的密码的命名组合。在握手期间，客户端和服务器交换密码套件的优先级列表，并决定两者最佳支持的套件。

　　在TLS 1.3中，加密套件的结构将改变。

'''SSL协议的握手过程'''

第一步，爱丽丝给出协议版本号、一个客户端生成的随机数（Client random），以及客户端支持的加密方法。

第二步，鲍勃确认双方使用的加密方法，并给出数字证书、以及一个服务器生成的随机数（Server random）。

第三步，爱丽丝确认数字证书(对证书信息进行md5或者hash后的编号==用证书机构的公钥对加密的证书编号解密后的证书编号)有效，然后生成一个新的随机数（Premaster secret），并使用数字证书中的公钥(鲍勃的公钥)，加密这个随机数，发给鲍勃。

第四步，鲍勃使用自己的私钥，获取爱丽丝发来的随机数（即Premaster secret）。

第五步，爱丽丝和鲍勃根据约定的加密方法，使用前面的三个随机数，生成"对话密钥"（session key），用来加密接下来的整个对话过程。

https要使客户端与服务器端的通信过程得到安全保证，必须使用对称加密算法并且每个客户端的算法都不一样，需要一个协商过程，但是协商对称加密算法的过程，需要使用非对称加密算法来保证安全，直接使用非对称加密的过程本身也不安全，会有中间人篡改公钥的可能性，所以客户端与服务器不直接使用公钥，而是使用数字证书签发机构颁发的证书来保证非对称加密过程本身的安全。这样通过这些机制协商出一个对称加密算法，就此双方使用该算法进行加密解密。从而解决了客户端与服务器端之间的通信安全问题。

安全，加密，TLS

2024-08-14T07:54:25Z

Admin：创建页面，内容为“SSL/TLS握手原理&加密套件简述”

[[SSL/TLS握手原理&加密套件简述]]

首页

2024-08-14T07:53:43Z

Admin：/* 其他技术 */

== [[DNS技术]] ==
* [[DNS是什么？]]

* [[DNS-RFC]]
* [[顶级域名（TLD）]]
* [[NAT64与DNS64基本原理概述]]
* [[DNSSEC]]
* [[EDNS]]
* [[名词解释]]

== DNS软件 ==

* [[BIND]]
* PowerDNS
* Unbond
* 其他

== DNS安全 ==

* [[DNSSEC]]
* [[DNS-CVEs]]

* [[网络安全/系统安全/业务安全]]

== [[DNS资讯]] ==
[[新闻-News]]

[[常用公共DNS]]

== [[LINUX]]相关 ==
shell

[[超细节！十年码农讲述eBPF和XDP技术！]]

[[XDP技术 — Linux网络处理的高速公路]]

== 其他技术 ==
cdn

sdn

[[OSI七层模型、TCP/IP四层模型]]

[[安全，加密，TLS]]

== [[帮助信息]] ==

[[MediaWiki 设置配置]]

[[MediaWiki 使用帮助]]

已安装MediaWiki。

请查阅[https://www.mediawiki.org/wiki/Special:MyLanguage/Help:Contents 用户指导]以获取使用本wiki软件的信息。

DoH, DoT, DoQ 的区别

2024-08-14T07:51:47Z

Admin：

== DNS 基础概念 ==
DNS (Domain Name System) 是互联网的电话簿。它负责将用户可读的网站名称（如 <code>www.example.com</code>）转换为机器可以理解的IP地址（如 <code>192.0.2.1</code>）。DNS查询和响应在传统的DNS协议中是明文传输的，这意味着它们可能受到中间人攻击，如监听、拦截和篡改。

随着网络安全意识的提升，现代的DNS查询正逐渐向加密过渡，以增强用户隐私和数据安全。下面是几种加密DNS的技术：

'''DoH (DNS over HTTPS)：'''

DoH是一种通过HTTPS协议传输DNS查询的方法。它利用了HTTPS协议天然的加密特性来保障数据传输的隐私性和安全性。DoH的引入使DNS查询与普通的WEB流量混合，从而更难被封锁或监控。

'''DoT (DNS over TLS)：'''

DoT利用传输层安全性协议（TLS）来加密DNS查询，确保数据在传输过程中不被监听或篡改。DoT通常在853端口上运行，并提供了一种端到端加密的解决方案。

'''DoQ (DNS over QUIC)：'''

DoQ是一种新兴的技术，它结合了DNS查询和QUIC协议的优势。QUIC是一个基于UDP的多路复用传输协议，它减少了连接建立时间，并提供了更好的性能和加密支持。DoQ旨在进一步提升DNS查询的效率和隐私性。

== 优缺点 ==

* DNS
** 优点：原生支持，广泛部署，无需额外配置。
** 缺点：明文传输，容易受到篡改和监听。
* DoH
** 优点：与HTTPS流量不可区分，难以被审查，易于绕过某些网络限制。
** 缺点：可能与现有的网络基础设施（如中间件、缓存）存在兼容性问题。
* DoT
** 优点：设计简洁，易于实现，提供端到端加密。
** 缺点：可被ISP或网络防火墙识别并阻止，因为使用了专用端口。
* DoQ
** 优点：减少连接延迟，提高传输效率，支持并发请求。
** 缺点：目前支持度不广，需要进一步测试和部署。

== 公共DNS服务提供商 ==
{| class="wikitable"
!Public DNS
!DNS IPv4
!DNS IPv6
!DoH
!DoT
!DoQ
|-
|Google Public DNS
|8.8.8.8 和 8.8.4.4
|2001:4860:4860::8888 和 2001:4860:4860::8844
|<nowiki>https://dns.google/dns-query</nowiki>
|tls://dns.google
|
|-
|Cloudflare DNS
|1.1.1.1 和 1.0.0.1
|2606:4700:4700::1111 和 2606:4700:4700::1001
|<nowiki>https://cloudflare-dns.com/dns-query</nowiki>
|tls://1dot1dot1dot1.cloudflare-dns.com
|
|-
|Quad9
|9.9.9.9 和 149.112.112.112
|2620:fe::fe 和 2620:fe::fe:9
|<nowiki>https://dns.quad9.net/dns-query</nowiki>
|tls://dns.quad9.net
|
|-
|AdGuard DNS
|94.140.14.14 和 94.140.15.15
|2a10:50c0::ad1
和 2a10:50c0::ad2
|<nowiki>https://dns.adguard-dns.com/dns-query</nowiki>
|tls://dns.adguard-dns.com
|quic://dns.adguard-dns.com
|-
|Cisico OpenDNS
|208.67.222.222 和 208.67.220.220
|2620:119:35::35 和 2620:119:53::53
|<nowiki>https://doh.opendns.com/dns-query</nowiki>
|
|
|-
|Ali DNS
|223.5.5.5 和 223.6.6.6
|2400:3200::1 和 2400:3200:baba::1
|<nowiki>https://dns.alidns.com/dns-query</nowiki>
|tłs://dns.alidns.com
|quic://dns.alidns.com
|-
|DNSPod DNS
|119.29.29.29
|2402:4e00:: 和 2402:4e00:1::
|<nowiki>https://doh.pub/dns-query</nowiki>
|tłs://dot.pub
|
|-
|TrafficRoute DNS
|180.184.1.1 和 180.184.2.2
|
|
|
|
|}

DoH, DoT, DoQ 的区别

2024-08-14T07:50:25Z

Admin：创建页面，内容为“ = 理解DNS、DoH、DoT和DoQ：比较加密DNS协议 = 24 年 4 月 19 日星期五 692 字 4 分钟 Network DNS , DoH , DoT , DoQ 这篇文章最后修改于 24 年 4 月 19 日星期五，部分内容可能已经不适用，如有疑问可联系作者。 == DNS 基础概念 == DNS (Domain Name System) 是互联网的电话簿。它负责将用户可读的网站名称（如 <code>www.example.com</code>）转换为机器可以理解的IP地址（如 <…”

= 理解DNS、DoH、DoT和DoQ：比较加密DNS协议 =
24 年 4 月 19 日星期五

692 字

4 分钟

Network

DNS , DoH , DoT , DoQ

这篇文章最后修改于 24 年 4 月 19 日星期五，部分内容可能已经不适用，如有疑问可联系作者。

== DNS 基础概念 ==
DNS (Domain Name System) 是互联网的电话簿。它负责将用户可读的网站名称（如 <code>www.example.com</code>）转换为机器可以理解的IP地址（如 <code>192.0.2.1</code>）。DNS查询和响应在传统的DNS协议中是明文传输的，这意味着它们可能受到中间人攻击，如监听、拦截和篡改。

随着网络安全意识的提升，现代的DNS查询正逐渐向加密过渡，以增强用户隐私和数据安全。下面是几种加密DNS的技术：

DoH (DNS over HTTPS)：DoH是一种通过HTTPS协议传输DNS查询的方法。它利用了HTTPS协议天然的加密特性来保障数据传输的隐私性和安全性。DoH的引入使DNS查询与普通的WEB流量混合，从而更难被封锁或监控。

DoT (DNS over TLS)：DoT利用传输层安全性协议（TLS）来加密DNS查询，确保数据在传输过程中不被监听或篡改。DoT通常在853端口上运行，并提供了一种端到端加密的解决方案。

DoQ (DNS over QUIC)：DoQ是一种新兴的技术，它结合了DNS查询和QUIC协议的优势。QUIC是一个基于UDP的多路复用传输协议，它减少了连接建立时间，并提供了更好的性能和加密支持。DoQ旨在进一步提升DNS查询的效率和隐私性。

== 优缺点 ==

* DNS
** 优点：原生支持，广泛部署，无需额外配置。
** 缺点：明文传输，容易受到篡改和监听。
* DoH
** 优点：与HTTPS流量不可区分，难以被审查，易于绕过某些网络限制。
** 缺点：可能与现有的网络基础设施（如中间件、缓存）存在兼容性问题。
* DoT
** 优点：设计简洁，易于实现，提供端到端加密。
** 缺点：可被ISP或网络防火墙识别并阻止，因为使用了专用端口。
* DoQ
** 优点：减少连接延迟，提高传输效率，支持并发请求。
** 缺点：目前支持度不广，需要进一步测试和部署。

== 公共DNS服务提供商 ==
{| class="wikitable"
!Public DNS
!DNS IPv4
!DNS IPv6
!DoH
!DoT
!DoQ
|-
|Google Public DNS
|8.8.8.8 和 8.8.4.4
|2001:4860:4860::8888 和 2001:4860:4860::8844
|<nowiki>https://dns.google/dns-query</nowiki>
|tls://dns.google
|
|-
|Cloudflare DNS
|1.1.1.1 和 1.0.0.1
|2606:4700:4700::1111 和 2606:4700:4700::1001
|<nowiki>https://cloudflare-dns.com/dns-query</nowiki>
|tls://1dot1dot1dot1.cloudflare-dns.com
|
|-
|Quad9
|9.9.9.9 和 149.112.112.112
|2620:fe::fe 和 2620:fe::fe:9
|<nowiki>https://dns.quad9.net/dns-query</nowiki>
|tls://dns.quad9.net
|
|-
|AdGuard DNS
|94.140.14.14 和 94.140.15.15
|2a10:50c0::ad1
和 2a10:50c0::ad2
|<nowiki>https://dns.adguard-dns.com/dns-query</nowiki>
|tls://dns.adguard-dns.com
|quic://dns.adguard-dns.com
|-
|Cisico OpenDNS
|208.67.222.222 和 208.67.220.220
|2620:119:35::35 和 2620:119:53::53
|<nowiki>https://doh.opendns.com/dns-query</nowiki>
|
|
|-
|Ali DNS
|223.5.5.5 和 223.6.6.6
|2400:3200::1 和 2400:3200:baba::1
|<nowiki>https://dns.alidns.com/dns-query</nowiki>
|tłs://dns.alidns.com
|quic://dns.alidns.com
|-
|DNSPod DNS
|119.29.29.29
|2402:4e00:: 和 2402:4e00:1::
|<nowiki>https://doh.pub/dns-query</nowiki>
|tłs://dot.pub
|
|-
|TrafficRoute DNS
|180.184.1.1 和 180.184.2.2
|
|
|
|
|}
需要注意，这些信息可能会随着时间而变化。此外，为了更好地保障服务的可靠性和响应速度，一些服务提供商可能会提供基于地理位置的不同IP地址。在此表格中列出的信息可能会随着服务提供商政策的变更而更新，因此建议用户在配置DNS服务时，参考最新的官方文档。

目录

* DNS 基础概念
* 优缺点
* 公共DNS服务提供商

----进度 100%

文章标题：理解DNS、DoH、DoT和DoQ：比较加密DNS协议

文章作者：Cedar

文章链接：<nowiki>https://some.fylsen.com/posts/understanding-dns-doh-dot-doq-encrypted-protocols-guide</nowiki> [复制]

最后修改时间：2024 年 04 月 19 日 08:00

DNS技术

2024-08-14T07:50:12Z

Admin：

[[NAT64与DNS64基本原理概述]]

[[递归服务器回复“refused”]]

[[DoH, DoT, DoQ 的区别]]

DNS技术

2024-08-14T07:49:54Z

Admin：

[[NAT64与DNS64基本原理概述]]

[[递归服务器回复“refused”]]

DoH, DoT, DoQ 的区别

DNS资讯

2024-08-13T11:15:33Z

Admin：创建页面，内容为“== DNS资讯 == 新闻-News 常用公共DNS”

== [[DNS资讯]] ==
[[新闻-News]]

[[常用公共DNS]]

递归服务器回复“refused”

2024-07-03T06:34:49Z

Admin：

'''递归服务器回复“refused”！'''

一般情况来说 refused 表示的是服务器对客户端的一种拒绝，这种事单方面的针对客户端，是不会因为迭代过程影响的.

就是说，即使迭代过程中被各种refused，那也只是表示我这个递归服务器单方面被权威服务器拒绝掉了，我们递归服务器是不应该把这个 refused 透传给客户端的，因为我们递归服务器被权威给refused，这种最终我们递归服务器没办法帮助客户端完成解析，我们递归服务器会回复给客户端 servfail，表示的是无法解析。

'''再说，递归服务器什么时候回复 refused给客户端，一般有以下几种情况，主要还是一种针对客户端的拒绝策略：'''

1. 未命中任何视图

2. 视图中 ACL 准入不允许

3. 区域/缓存查询 ACL 准入不允许

4. 放窥探

5. 隧道检测

递归服务器回复“refused”

2024-07-03T06:33:56Z

Admin：创建页面，内容为“递归服务器回复“refused”！一般情况来说 refused 表示的是服务器对客户端的一种拒绝，这种事单方面的针对客户端，是不会因为迭代过程影响的，就是说，即使迭代过程中被各种refused，那也只是表示我这个递归服务器单方面被权威服务器拒绝掉了，我们递归服务器是不应该把这个 refused 透传给客户端的，因为我们递归服务器被权威给refused，这种…”

递归服务器回复“refused”！

一般情况来说 refused 表示的是服务器对客户端的一种拒绝，这种事单方面的针对客户端，是不会因为迭代过程影响的，就是说，即使迭代过程中被各种refused，那也只是表示我这个递归服务器单方面被权威服务器拒绝掉了，我们递归服务器是不应该把这个 refused 透传给客户端的，因为我们递归服务器被权威给refused，这种最终我们递归服务器没办法帮助客户端完成解析，我们递归服务器会回复给客户端 servfail，表示的是无法解析。

再说，递归服务器什么时候回复 refused给客户端，一般有以下几种情况，主要还是一种针对客户端的拒绝策略：

1. 未命中任何视图

2. 视图中 ACL 准入不允许

3. 区域/缓存查询 ACL 准入不允许

4. 放窥探

5. 隧道检测

DNS技术

2024-07-03T06:33:47Z

Admin：

[[NAT64与DNS64基本原理概述]]

[[递归服务器回复“refused”]]

DNS技术

2024-07-03T06:33:36Z

Admin：

[[NAT64与DNS64基本原理概述]]
[[递归服务器回复“refused”]]

联系我 - Connect Me

2024-06-14T03:12:31Z

Admin：

有关内容涉及违法，违规等任何问题，请联系我：

'''QQ：778137'''

'''WX：778137 （同QQ）'''

'''Email：778137@qq.com'''

联系我 - Connect Me

2024-06-14T03:12:13Z

Admin：

有关内容涉及违法，违规等任何问题，请联系我：

QQ：778137

WX：778137 （同QQ）

Email：778137@qq.com

联系我 - Connect Me

2024-06-14T03:11:59Z

Admin：

有关内容涉及违法，违规等任何问题，请联系我：

QQ：778137
WX：778137 （同QQ）
Email：778137@qq.com

联系我 - Connect Me

2024-06-14T03:11:42Z

Admin：

有关内容涉及违法，违规等任何问题，请联系我：

**QQ：778137
**WX：778137 （同QQ）
**Email：778137@qq.com

MediaWiki:Sidebar

2024-06-02T14:04:29Z

Admin：

联系我 - Connect Me

2024-06-02T14:03:46Z

Admin：

有关内容涉及违法，违规等任何问题，请联系我：
**QQ：778137
**WX：778137 （同QQ）
**Email：778137@qq.com

联系我 - Connect Me

2024-06-02T14:03:29Z

Admin：创建页面，内容为“有关内容涉及违法，违规等任何问题，请联系我： **QQ：778137 **WX：778137 （同QQ） **Email：778137@qq.com”

有关内容涉及违法，违规等任何问题，请联系我：

**QQ：778137
**WX：778137 （同QQ）
**Email：778137@qq.com

MediaWiki:Sidebar

2024-06-02T14:01:47Z

Admin：

MediaWiki:Sidebar

2024-06-02T14:00:54Z

Admin：

DNS flag day 2020

2024-05-22T04:19:25Z

Admin：

= Contents =

* What’s next?
* DNS Flag Day 2020
** Action: Authoritative DNS Operators
** Action: DNS Resolver Operators
** Action: DNS software vendors
** How to test?
* Who’s behind DNS Flag Day?
* Get in touch
* Supporters
* FAQ
* Previous DNS Flag Days

= What’s next? =
The next DNS Flag Day is scheduled for 2020-10-01. It focuses on the operational and security problems in DNS caused by Internet Protocol packet fragmentation.

On this page you can find comprehensive description of the problem, technical changes planned for 2020-10-01, and ways to test your systems before the set date.

You can also subscribe to the dns-announce mailing list or follow @dnsflagday on Twitter to receive a notification about significant changes.

= DNS Flag Day 2020 =
The DNS community has been discussing persistent interoperability and performance issues with the DNS system on industry mailing lists and at conferences such as DNS-OARC 30 panel discussion (video, slides).

The proposed plan for DNS Flag Day 2020 was announced in October 2019 at RIPE78 by Petr Špaček, CZ.NIC and Ondřej Surý, ISC (video, slides). This year, we are focusing on problems with IP fragmentation of DNS packets.

IP fragmentation is unreliable on the Internet today, and can cause transmission failures when large DNS messages are sent via UDP. Even when fragmentation does work, it may not be secure; it is theoretically possible to spoof ''parts'' of a fragmented DNS message, without easy detection at the receiving end.

* Bonica R. et al, “IP Fragmentation Considered Fragile”, Work in Progress, July 2018
* Huston G., “IPv6, Large UDP Packets and the DNS”, August 2017
* Fujiwara K., “Measures against cache poisoning attacks using IP fragmentation in DNS”, May 2019
* Fujiwara K. et al, “Avoid IP fragmentation in DNS”, September 2019

Recently, there was an paper and presentation Defragmenting DNS - Determining the optimal maximum UDP response size for DNS by Axel Koolhaas, and Tjeerd Slokker in collaboration with NLnet Labs that explored the real world data using the RIPE Atlas probes and the researchers suggested different values for IPv4 and IPv6 and in different scenarios. This is practical for the server operators that know their environment, and the defaults in the DNS software should reflect the minimum safe size which is '''1232'''.

These issues can be addressed by a) configuring servers to limit DNS messages sent over UDP to a size that will not trigger fragmentation on typical network links, and b) ensuring that DNS servers can switch from UDP to TCP when a DNS response is too big to fit in this limited buffer size.

== Message Size Considerations ==
The optimum DNS message size to avoid IP fragmentation while minimizaing the use of TCP will depend on the Maximum Transmission Unit (MTU) of the physical network links connecting two network endpoints. Unfortunately, there is not yet a standard mechanism for DNS server implementors to access this information. Until such a standard exists, we recommend that the EDNS buffer size should, by ''default'', be set to a value small enough to avoid fragmentation on the majority of network links in use today.

An EDNS buffer size of 1232 bytes will avoid fragmentation on nearly all current networks. This is based on an MTU of 1280, which is required by the IPv6 specification, minus 48 bytes for the IPv6 and UDP headers and the aforementioned research.

Note that this recomendation is for a ''default'' value, to be used when better information is not available. Operators may still configure larger values if their networks support larger data frames and they are certain there is no risk of IP fragmentation. DNS server vendors may use higher (or lower) packet sizes if better information about the MTU is available from the kernel.

== Action: Authoritative DNS Operators ==
If you are an authoritative DNS server operator, what you should do to help with these issues is ensure that your DNS servers can answer DNS queries over TCP (port 53). ''Check your firewall(s) as well,'' as some of them block TCP/53.

You should also configure your servers to negotiate an EDNS buffer size that will not cause fragmentation. The value recommended here is 1232 bytes.

''Authoritative DNS servers '''MUST NOT''' send answers larger than the requested EDNS buffer size!''

You can now check your servers by entering your domain name below and pressing “Test!”. This tester uses ISC’s EDNS Compliance Tester and will check that its <code>edns512tcp</code> test is successful, among other tests for general standards compliance.

== Action: DNS Resolver Operators ==
Requrirements on the resolver side are more or less the same as for authoritative: ensure that your servers can answer DNS queries over TCP (port 53), and configure an EDNS buffer size of 1232 bytes to avoid fragmentation. Remember to check your firewall(s) for problems with DNS over TCP!

Most importantly: ''Resolvers '''MUST''' resend queries over TCP if they receive a truncated UDP response (with TC=1 set)!''

'''NEW!''' This checker will test your browser, system and ISP’s resolver by loading an image on a specific URL that can only be looked up if there is support for TCP at the last resolver querying the authority. For more information, go to Check My DNS which this checker uses.

== Action: DNS Software Vendors ==
It is important for DNS software vendors to '''comply with DNS standards''', and to use a default EDNS buffer size (1232 bytes) that will not cause fragmentation on typical network links.

Relevant standards include <nowiki>RFC 7766</nowiki>, <nowiki>RFC 6891</nowiki> section 6.2.3. and <nowiki>RFC 6891</nowiki> section 6.2.4..

The motivation for this effort is described in IETF draft intarea-frag-fragile section 6.1 and IETF draft iab-protocol-maintenance.

== How to test? ==
If you’re the owner of a domain or the operator of an authoritative DNS server, you can use our web-based testing tool to check your domains; you can find it above under Action: Authoritative DNS Operators.

Our web-based testing tool for clients and DNS resolver operators can be found above under Action: DNS Resolver Operators.

You can also test by using the following CLI commands:
<code>$ dig +tcp @auth_IP yourdomain.example.
$ dig +tcp @resolver_IP yourdomain.example.
$ dig @resolver_IP test.knot-resolver.cz. TXT</code>
All DNS queries must be successful, and commands should return the same results both with and without the <code>+tcp</code> option.

If you are a service provider, you can test your authoritative and recursive DNS services by configuring the default EDNS buffer size:

BIND

<code>
options {

edns-udp-size 1232;

max-udp-size 1232;

};
</code>

Knot DNS

<code>
server:

max-udp-payload: 1232
</code>

Knot Resolver
<code>
net.bufsize(1232)
</code>

PowerDNS Authoritative

udp-truncation-threshold=1232

PowerDNS Recursor

edns-outgoing-bufsize=1232

udp-truncation-threshold=1232

Unbound

server:

edns-buffer-size: 1232

NSD

server:

ipv4-edns-size: 1232

ipv6-edns-size: 1232

The configuration above will have no visible effect if everything works correctly. Some queries will fail to resolve if the TCP transport is not available.

= Who’s behind DNS Flag Day? =
The DNS Flag Day effort is community driven by DNS software and service providers, and supported by The DNS Operations, Analysis, and Research Center (DNS-OARC) which most in the community are members of.

If you have technical questions about DNS Flag Day, you can join the DNS-operations mailing list and ask them there.

= Get in touch =
For press & media inquiries please use media (at) dns-oarc.net and please put “DNS Flag Day” in the email subject line.

* Web: <nowiki>https://dnsflagday.net/</nowiki>
* Twitter: <nowiki>https://twitter.com/dnsflagday</nowiki>
* Announcements: <nowiki>https://lists.dns-oarc.net/mailman/listinfo/dns-announce</nowiki>
* Discussion: <nowiki>https://lists.dns-oarc.net/mailman/listinfo/dns-operations</nowiki>

DNS flag day 2020

2024-05-22T04:18:42Z

Admin：/* How to test? */

= Contents =

* What’s next?
* DNS Flag Day 2020
** Action: Authoritative DNS Operators
** Action: DNS Resolver Operators
** Action: DNS software vendors
** How to test?
* Who’s behind DNS Flag Day?
* Get in touch
* Supporters
* FAQ
* Previous DNS Flag Days

= What’s next? =
The next DNS Flag Day is scheduled for 2020-10-01. It focuses on the operational and security problems in DNS caused by Internet Protocol packet fragmentation.

On this page you can find comprehensive description of the problem, technical changes planned for 2020-10-01, and ways to test your systems before the set date.

You can also subscribe to the dns-announce mailing list or follow @dnsflagday on Twitter to receive a notification about significant changes.

= DNS Flag Day 2020 =
The DNS community has been discussing persistent interoperability and performance issues with the DNS system on industry mailing lists and at conferences such as DNS-OARC 30 panel discussion (video, slides).

The proposed plan for DNS Flag Day 2020 was announced in October 2019 at RIPE78 by Petr Špaček, CZ.NIC and Ondřej Surý, ISC (video, slides). This year, we are focusing on problems with IP fragmentation of DNS packets.

IP fragmentation is unreliable on the Internet today, and can cause transmission failures when large DNS messages are sent via UDP. Even when fragmentation does work, it may not be secure; it is theoretically possible to spoof ''parts'' of a fragmented DNS message, without easy detection at the receiving end.

* Bonica R. et al, “IP Fragmentation Considered Fragile”, Work in Progress, July 2018
* Huston G., “IPv6, Large UDP Packets and the DNS”, August 2017
* Fujiwara K., “Measures against cache poisoning attacks using IP fragmentation in DNS”, May 2019
* Fujiwara K. et al, “Avoid IP fragmentation in DNS”, September 2019

Recently, there was an paper and presentation Defragmenting DNS - Determining the optimal maximum UDP response size for DNS by Axel Koolhaas, and Tjeerd Slokker in collaboration with NLnet Labs that explored the real world data using the RIPE Atlas probes and the researchers suggested different values for IPv4 and IPv6 and in different scenarios. This is practical for the server operators that know their environment, and the defaults in the DNS software should reflect the minimum safe size which is '''1232'''.

These issues can be addressed by a) configuring servers to limit DNS messages sent over UDP to a size that will not trigger fragmentation on typical network links, and b) ensuring that DNS servers can switch from UDP to TCP when a DNS response is too big to fit in this limited buffer size.

== Message Size Considerations ==
The optimum DNS message size to avoid IP fragmentation while minimizaing the use of TCP will depend on the Maximum Transmission Unit (MTU) of the physical network links connecting two network endpoints. Unfortunately, there is not yet a standard mechanism for DNS server implementors to access this information. Until such a standard exists, we recommend that the EDNS buffer size should, by ''default'', be set to a value small enough to avoid fragmentation on the majority of network links in use today.

An EDNS buffer size of 1232 bytes will avoid fragmentation on nearly all current networks. This is based on an MTU of 1280, which is required by the IPv6 specification, minus 48 bytes for the IPv6 and UDP headers and the aforementioned research.

Note that this recomendation is for a ''default'' value, to be used when better information is not available. Operators may still configure larger values if their networks support larger data frames and they are certain there is no risk of IP fragmentation. DNS server vendors may use higher (or lower) packet sizes if better information about the MTU is available from the kernel.

== Action: Authoritative DNS Operators ==
If you are an authoritative DNS server operator, what you should do to help with these issues is ensure that your DNS servers can answer DNS queries over TCP (port 53). ''Check your firewall(s) as well,'' as some of them block TCP/53.

You should also configure your servers to negotiate an EDNS buffer size that will not cause fragmentation. The value recommended here is 1232 bytes.

''Authoritative DNS servers '''MUST NOT''' send answers larger than the requested EDNS buffer size!''

You can now check your servers by entering your domain name below and pressing “Test!”. This tester uses ISC’s EDNS Compliance Tester and will check that its <code>edns512tcp</code> test is successful, among other tests for general standards compliance.

== Action: DNS Resolver Operators ==
Requrirements on the resolver side are more or less the same as for authoritative: ensure that your servers can answer DNS queries over TCP (port 53), and configure an EDNS buffer size of 1232 bytes to avoid fragmentation. Remember to check your firewall(s) for problems with DNS over TCP!

Most importantly: ''Resolvers '''MUST''' resend queries over TCP if they receive a truncated UDP response (with TC=1 set)!''

'''NEW!''' This checker will test your browser, system and ISP’s resolver by loading an image on a specific URL that can only be looked up if there is support for TCP at the last resolver querying the authority. For more information, go to Check My DNS which this checker uses.

== Action: DNS Software Vendors ==
It is important for DNS software vendors to '''comply with DNS standards''', and to use a default EDNS buffer size (1232 bytes) that will not cause fragmentation on typical network links.

Relevant standards include <nowiki>RFC 7766</nowiki>, <nowiki>RFC 6891</nowiki> section 6.2.3. and <nowiki>RFC 6891</nowiki> section 6.2.4..

The motivation for this effort is described in IETF draft intarea-frag-fragile section 6.1 and IETF draft iab-protocol-maintenance.

== How to test? ==
If you’re the owner of a domain or the operator of an authoritative DNS server, you can use our web-based testing tool to check your domains; you can find it above under Action: Authoritative DNS Operators.

Our web-based testing tool for clients and DNS resolver operators can be found above under Action: DNS Resolver Operators.

You can also test by using the following CLI commands:
<code>$ dig +tcp @auth_IP yourdomain.example.
$ dig +tcp @resolver_IP yourdomain.example.
$ dig @resolver_IP test.knot-resolver.cz. TXT</code>
All DNS queries must be successful, and commands should return the same results both with and without the <code>+tcp</code> option.

If you are a service provider, you can test your authoritative and recursive DNS services by configuring the default EDNS buffer size:

BIND

<code>
options {

edns-udp-size 1232;

max-udp-size 1232;

};
</code>

Knot DNS
<code>
server:

max-udp-payload: 1232
</code>

Knot Resolver
<code>
net.bufsize(1232)
</code>

PowerDNS Authoritative

udp-truncation-threshold=1232

PowerDNS Recursor

edns-outgoing-bufsize=1232

udp-truncation-threshold=1232

Unbound

server:

edns-buffer-size: 1232

NSD

server:

ipv4-edns-size: 1232

ipv6-edns-size: 1232

The configuration above will have no visible effect if everything works correctly. Some queries will fail to resolve if the TCP transport is not available.

DNS flag day 2020

2024-05-22T04:18:16Z

Admin：/* How to test? */

= Contents =

* What’s next?
* DNS Flag Day 2020
** Action: Authoritative DNS Operators
** Action: DNS Resolver Operators
** Action: DNS software vendors
** How to test?
* Who’s behind DNS Flag Day?
* Get in touch
* Supporters
* FAQ
* Previous DNS Flag Days

= What’s next? =
The next DNS Flag Day is scheduled for 2020-10-01. It focuses on the operational and security problems in DNS caused by Internet Protocol packet fragmentation.

On this page you can find comprehensive description of the problem, technical changes planned for 2020-10-01, and ways to test your systems before the set date.

You can also subscribe to the dns-announce mailing list or follow @dnsflagday on Twitter to receive a notification about significant changes.

= DNS Flag Day 2020 =
The DNS community has been discussing persistent interoperability and performance issues with the DNS system on industry mailing lists and at conferences such as DNS-OARC 30 panel discussion (video, slides).

The proposed plan for DNS Flag Day 2020 was announced in October 2019 at RIPE78 by Petr Špaček, CZ.NIC and Ondřej Surý, ISC (video, slides). This year, we are focusing on problems with IP fragmentation of DNS packets.

IP fragmentation is unreliable on the Internet today, and can cause transmission failures when large DNS messages are sent via UDP. Even when fragmentation does work, it may not be secure; it is theoretically possible to spoof ''parts'' of a fragmented DNS message, without easy detection at the receiving end.

* Bonica R. et al, “IP Fragmentation Considered Fragile”, Work in Progress, July 2018
* Huston G., “IPv6, Large UDP Packets and the DNS”, August 2017
* Fujiwara K., “Measures against cache poisoning attacks using IP fragmentation in DNS”, May 2019
* Fujiwara K. et al, “Avoid IP fragmentation in DNS”, September 2019

Recently, there was an paper and presentation Defragmenting DNS - Determining the optimal maximum UDP response size for DNS by Axel Koolhaas, and Tjeerd Slokker in collaboration with NLnet Labs that explored the real world data using the RIPE Atlas probes and the researchers suggested different values for IPv4 and IPv6 and in different scenarios. This is practical for the server operators that know their environment, and the defaults in the DNS software should reflect the minimum safe size which is '''1232'''.

These issues can be addressed by a) configuring servers to limit DNS messages sent over UDP to a size that will not trigger fragmentation on typical network links, and b) ensuring that DNS servers can switch from UDP to TCP when a DNS response is too big to fit in this limited buffer size.

== Message Size Considerations ==
The optimum DNS message size to avoid IP fragmentation while minimizaing the use of TCP will depend on the Maximum Transmission Unit (MTU) of the physical network links connecting two network endpoints. Unfortunately, there is not yet a standard mechanism for DNS server implementors to access this information. Until such a standard exists, we recommend that the EDNS buffer size should, by ''default'', be set to a value small enough to avoid fragmentation on the majority of network links in use today.

An EDNS buffer size of 1232 bytes will avoid fragmentation on nearly all current networks. This is based on an MTU of 1280, which is required by the IPv6 specification, minus 48 bytes for the IPv6 and UDP headers and the aforementioned research.

Note that this recomendation is for a ''default'' value, to be used when better information is not available. Operators may still configure larger values if their networks support larger data frames and they are certain there is no risk of IP fragmentation. DNS server vendors may use higher (or lower) packet sizes if better information about the MTU is available from the kernel.

== Action: Authoritative DNS Operators ==
If you are an authoritative DNS server operator, what you should do to help with these issues is ensure that your DNS servers can answer DNS queries over TCP (port 53). ''Check your firewall(s) as well,'' as some of them block TCP/53.

You should also configure your servers to negotiate an EDNS buffer size that will not cause fragmentation. The value recommended here is 1232 bytes.

''Authoritative DNS servers '''MUST NOT''' send answers larger than the requested EDNS buffer size!''

You can now check your servers by entering your domain name below and pressing “Test!”. This tester uses ISC’s EDNS Compliance Tester and will check that its <code>edns512tcp</code> test is successful, among other tests for general standards compliance.

== Action: DNS Resolver Operators ==
Requrirements on the resolver side are more or less the same as for authoritative: ensure that your servers can answer DNS queries over TCP (port 53), and configure an EDNS buffer size of 1232 bytes to avoid fragmentation. Remember to check your firewall(s) for problems with DNS over TCP!

Most importantly: ''Resolvers '''MUST''' resend queries over TCP if they receive a truncated UDP response (with TC=1 set)!''

'''NEW!''' This checker will test your browser, system and ISP’s resolver by loading an image on a specific URL that can only be looked up if there is support for TCP at the last resolver querying the authority. For more information, go to Check My DNS which this checker uses.

== Action: DNS Software Vendors ==
It is important for DNS software vendors to '''comply with DNS standards''', and to use a default EDNS buffer size (1232 bytes) that will not cause fragmentation on typical network links.

Relevant standards include <nowiki>RFC 7766</nowiki>, <nowiki>RFC 6891</nowiki> section 6.2.3. and <nowiki>RFC 6891</nowiki> section 6.2.4..

The motivation for this effort is described in IETF draft intarea-frag-fragile section 6.1 and IETF draft iab-protocol-maintenance.

== How to test? ==
If you’re the owner of a domain or the operator of an authoritative DNS server, you can use our web-based testing tool to check your domains; you can find it above under Action: Authoritative DNS Operators.

Our web-based testing tool for clients and DNS resolver operators can be found above under Action: DNS Resolver Operators.

You can also test by using the following CLI commands:
<code>$ dig +tcp @auth_IP yourdomain.example.
$ dig +tcp @resolver_IP yourdomain.example.
$ dig @resolver_IP test.knot-resolver.cz. TXT</code>
All DNS queries must be successful, and commands should return the same results both with and without the <code>+tcp</code> option.

If you are a service provider, you can test your authoritative and recursive DNS services by configuring the default EDNS buffer size:

BIND

<code>
options {
edns-udp-size 1232;
max-udp-size 1232;
};
</code>

Knot DNS
<code>
server:

max-udp-payload: 1232
</code>

Knot Resolver

net.bufsize(1232)

PowerDNS Authoritative

udp-truncation-threshold=1232

PowerDNS Recursor

edns-outgoing-bufsize=1232

udp-truncation-threshold=1232

Unbound

server:

edns-buffer-size: 1232

NSD

server:

ipv4-edns-size: 1232

ipv6-edns-size: 1232

The configuration above will have no visible effect if everything works correctly. Some queries will fail to resolve if the TCP transport is not available.

DNS flag day 2020

2024-05-22T04:17:33Z

Admin：

= Contents =

* What’s next?
* DNS Flag Day 2020
** Action: Authoritative DNS Operators
** Action: DNS Resolver Operators
** Action: DNS software vendors
** How to test?
* Who’s behind DNS Flag Day?
* Get in touch
* Supporters
* FAQ
* Previous DNS Flag Days

= What’s next? =
The next DNS Flag Day is scheduled for 2020-10-01. It focuses on the operational and security problems in DNS caused by Internet Protocol packet fragmentation.

On this page you can find comprehensive description of the problem, technical changes planned for 2020-10-01, and ways to test your systems before the set date.

You can also subscribe to the dns-announce mailing list or follow @dnsflagday on Twitter to receive a notification about significant changes.

= DNS Flag Day 2020 =
The DNS community has been discussing persistent interoperability and performance issues with the DNS system on industry mailing lists and at conferences such as DNS-OARC 30 panel discussion (video, slides).

The proposed plan for DNS Flag Day 2020 was announced in October 2019 at RIPE78 by Petr Špaček, CZ.NIC and Ondřej Surý, ISC (video, slides). This year, we are focusing on problems with IP fragmentation of DNS packets.

IP fragmentation is unreliable on the Internet today, and can cause transmission failures when large DNS messages are sent via UDP. Even when fragmentation does work, it may not be secure; it is theoretically possible to spoof ''parts'' of a fragmented DNS message, without easy detection at the receiving end.

* Bonica R. et al, “IP Fragmentation Considered Fragile”, Work in Progress, July 2018
* Huston G., “IPv6, Large UDP Packets and the DNS”, August 2017
* Fujiwara K., “Measures against cache poisoning attacks using IP fragmentation in DNS”, May 2019
* Fujiwara K. et al, “Avoid IP fragmentation in DNS”, September 2019

Recently, there was an paper and presentation Defragmenting DNS - Determining the optimal maximum UDP response size for DNS by Axel Koolhaas, and Tjeerd Slokker in collaboration with NLnet Labs that explored the real world data using the RIPE Atlas probes and the researchers suggested different values for IPv4 and IPv6 and in different scenarios. This is practical for the server operators that know their environment, and the defaults in the DNS software should reflect the minimum safe size which is '''1232'''.

These issues can be addressed by a) configuring servers to limit DNS messages sent over UDP to a size that will not trigger fragmentation on typical network links, and b) ensuring that DNS servers can switch from UDP to TCP when a DNS response is too big to fit in this limited buffer size.

== Message Size Considerations ==
The optimum DNS message size to avoid IP fragmentation while minimizaing the use of TCP will depend on the Maximum Transmission Unit (MTU) of the physical network links connecting two network endpoints. Unfortunately, there is not yet a standard mechanism for DNS server implementors to access this information. Until such a standard exists, we recommend that the EDNS buffer size should, by ''default'', be set to a value small enough to avoid fragmentation on the majority of network links in use today.

An EDNS buffer size of 1232 bytes will avoid fragmentation on nearly all current networks. This is based on an MTU of 1280, which is required by the IPv6 specification, minus 48 bytes for the IPv6 and UDP headers and the aforementioned research.

Note that this recomendation is for a ''default'' value, to be used when better information is not available. Operators may still configure larger values if their networks support larger data frames and they are certain there is no risk of IP fragmentation. DNS server vendors may use higher (or lower) packet sizes if better information about the MTU is available from the kernel.

== Action: Authoritative DNS Operators ==
If you are an authoritative DNS server operator, what you should do to help with these issues is ensure that your DNS servers can answer DNS queries over TCP (port 53). ''Check your firewall(s) as well,'' as some of them block TCP/53.

You should also configure your servers to negotiate an EDNS buffer size that will not cause fragmentation. The value recommended here is 1232 bytes.

''Authoritative DNS servers '''MUST NOT''' send answers larger than the requested EDNS buffer size!''

You can now check your servers by entering your domain name below and pressing “Test!”. This tester uses ISC’s EDNS Compliance Tester and will check that its <code>edns512tcp</code> test is successful, among other tests for general standards compliance.

== Action: DNS Resolver Operators ==
Requrirements on the resolver side are more or less the same as for authoritative: ensure that your servers can answer DNS queries over TCP (port 53), and configure an EDNS buffer size of 1232 bytes to avoid fragmentation. Remember to check your firewall(s) for problems with DNS over TCP!

Most importantly: ''Resolvers '''MUST''' resend queries over TCP if they receive a truncated UDP response (with TC=1 set)!''

'''NEW!''' This checker will test your browser, system and ISP’s resolver by loading an image on a specific URL that can only be looked up if there is support for TCP at the last resolver querying the authority. For more information, go to Check My DNS which this checker uses.

== Action: DNS Software Vendors ==
It is important for DNS software vendors to '''comply with DNS standards''', and to use a default EDNS buffer size (1232 bytes) that will not cause fragmentation on typical network links.

Relevant standards include <nowiki>RFC 7766</nowiki>, <nowiki>RFC 6891</nowiki> section 6.2.3. and <nowiki>RFC 6891</nowiki> section 6.2.4..

The motivation for this effort is described in IETF draft intarea-frag-fragile section 6.1 and IETF draft iab-protocol-maintenance.

== How to test? ==
If you’re the owner of a domain or the operator of an authoritative DNS server, you can use our web-based testing tool to check your domains; you can find it above under Action: Authoritative DNS Operators.

Our web-based testing tool for clients and DNS resolver operators can be found above under Action: DNS Resolver Operators.

You can also test by using the following CLI commands:
<code>$ dig +tcp @auth_IP yourdomain.example.
$ dig +tcp @resolver_IP yourdomain.example.
$ dig @resolver_IP test.knot-resolver.cz. TXT</code>
All DNS queries must be successful, and commands should return the same results both with and without the <code>+tcp</code> option.

If you are a service provider, you can test your authoritative and recursive DNS services by configuring the default EDNS buffer size:

BIND

options {

edns-udp-size 1232;

max-udp-size 1232;

};

Knot DNS

server:

max-udp-payload: 1232

Knot Resolver

net.bufsize(1232)

PowerDNS Authoritative

udp-truncation-threshold=1232

PowerDNS Recursor

edns-outgoing-bufsize=1232

udp-truncation-threshold=1232

Unbound

server:

edns-buffer-size: 1232

NSD

server:

ipv4-edns-size: 1232

ipv6-edns-size: 1232

The configuration above will have no visible effect if everything works correctly. Some queries will fail to resolve if the TCP transport is not available.

OSI七层模型、TCP/IP四层模型

2024-05-22T03:54:56Z

Admin：

=== '''OSI七层模型''' ===
七层模型，亦称OSI（Open System Interconnection）。参考模型是国际标准化组织（ISO）制定的一个用于计算机或通信系统间互联的标准体系，一般称为OSI参考模型或七层模型。

它是一个七层的、抽象的模型体，不仅包括一系列抽象的术语或概念，也包括具体的协议。

[[文件:Image-osi七层模型、tcp-ip四层模型.png|居中|缩略图]]

'''OSI七层模型-分层'''

7. 应用层

网络服务与最终用户的一个接口

各种应用程序协议

协议有：HTTP(超文本传输协议) FTP（文本传输协议） TFTP（简单文件传输协议） SMTP（简单邮件传输协议） SNMP（简单网络管理协议） DNS（域名系统） TELNET（远程终端协议） HTTPS（超文本传输安全协议） POP3（邮局协议版本3 ） DHCP（动态主机配置协议）

6. 表示层

数据的表示、安全、压缩。（在五层模型里面已经合并到了应用层）

信息的语法语义以及他们的关联，如加密解密、转换翻译、压缩解压

格式有，JPEG、ASCll、EBCDIC、加密格式等 [2]

如LPP（轻量级表示协议）

5. 会话层

建立、管理、终止会话。（在五层模型里面已经合并到了应用层）

不同机器上的用户之间建立及管理会话

对应主机进程，指本地主机与远程主机正在进行的会话

安全协议：SSL（安全套接字层协议）、TLS（安全传输层协议）

4. 传输层

定义传输数据的协议端口号，以及流控和差错校验。

接受上一层数据，在必要的时候把数据进行切割，并将这些数据交给网络层，并保证这些数据段有效到达对端

协议有：TCP UDP，数据包一旦离开网卡即进入网络传输层

3. 网络层

进行逻辑地址寻址，实现不同网络之间的路径选择。

控制子网的运行，如逻辑编址、分组传输、路由选择

协议有：ICMP（互联网控制信息协议） IGMP（组管理协议） IP（IPV4 IPV6）（互联网协议）

安全协议、路由协议（vrrp虚拟路由冗余）

2. 数据链路层

建立逻辑连接、进行硬件地址寻址、差错校验 [3] 等功能。（由底层网络定义协议）

将比特组合成字节进而组合成帧，用MAC地址访问介质，错误发现但不能纠正。

物理寻址、同时将原始比特流转变为逻辑传输线路

地址解析协议：ARP、PARP（反向地址转换协议）

1. 物理层

建立、维护、断开物理连接。（由底层网络定义协议）

机械、电子、定时接口通信信道上的原始比特流传输

TCP/IP 层级模型结构，应用层之间的协议通过逐级调用传输层（Transport layer）、网络层（Network Layer）和物理数据链路层（Physical Data Link）而可以实现应用层的应用程序通信互联。

应用层需要关心应用程序的逻辑细节，而不是数据在网络中的传输活动。应用层其下三层则处理真正的通信细节。在 Internet 整个发展过程中的所有思想和着重点都以一种称为 RFC（Request For Comments）的文档格式存在。针对每一种特定的 TCP/IP 应用，有相应的 RFC

一些典型的 TCP/IP 应用有 FTP、Telnet、SMTP、SNTP、REXEC、TFTP、LPD、SNMP、NFS、INETD 等。RFC 使一些基本相同的 TCP/IP 应用程序实现了标准化，从而使得不同厂家开发的应用程序可以互相通信

=== TCP/IP四层模型 ===
TCP/IP（Transmission Control Protocol/Internet Protocol，传输控制协议/网际协议）是指能够在多个不同网络间实现信息传输的协议簇。TCP/IP协议不仅仅指的是TCP 和IP两个协议，而是指一个由FTP、SMTP、TCP、UDP、IP等协议构成的协议簇，只是因为在TCP/IP协议中TCP协议和IP协议最具代表性，所以被称为TCP/IP协议

TCP/IP是在网络的使用中的最基本的通信协议。

TCP/IP传输协议对互联网中各部分进行通信的标准和方法进行了规定。

TCP/IP传输协议是保证网络数据信息及时、完整传输的两个重要的协议。

TCP/IP传输协议是严格来说是一个四层的体系结构，应用层、传输层、网络层和数据链路层都包含其中。

[[文件:Image-OSI七层模型-TCP-IP四层模型.png|居中|缩略图]]

=== TCP/IP协议中的四个层次 ===
应用层：应用层是TCP/IP协议的第一层，是直接为应用进程提供服务的。

（1）对不同种类的应用程序它们会根据自己的需要来使用应用层的不同协议，邮件传输应用使用了SMTP协议、万维网应用使用了HTTP协议、远程登录服务应用使用了有TELNET协议

（2）应用层还能加密、解密、格式化数据

（3）应用层可以建立或解除与其他节点的联系，这样可以充分节省网络资源

运输层：作为TCP/IP协议的第二层，运输层在整个TCP/IP协议中起到了中流砥柱的作用。且在运输层中，TCP和UDP也同样起到了中流砥柱的作用

网络层：网络层在TCP/IP协议中的位于第三层。在TCP/IP协议中网络层可以进行网络连接的建立和终止以及IP地址的寻找等功能

网络接口层：在TCP/IP协议中，网络接口层位于第四层。由于网络接口层兼并了物理层和数据链路层所以，网络接口层既是传输数据的物理媒介，也可以为网络层提供一条准确无误的线路

特点

TCP/IP协议能够迅速发展起来并成为事实上的标准，是它恰好适应了世界范围内数据通信的需要。它有以下特点：

（1）协议标准是完全开放的，可以供用户免费使用，并且独立于特定的计算机硬件与操作系统。

（2）独立于网络硬件系统，可以运行在广域网，更适合于互联网。

（3）网络地址统一分配，网络中每一设备和终端都具有一个唯一地址。

（4）高层协议标准化，可以提供多种多样可靠网络服务

=== 通信过程及相关协议 ===
在网络通信的过程中，将发出数据的主机称为源主机，接收数据的主机称为目的主机。

当源主机发出数据时，数据在源主机中从上层向下层传送。

源主机中的应用进程先将数据交给应用层，应用层加上必要的控制信息就成了报文流，向下传给传输层。

传输层将收到的数据单元加上本层的控制信息，形成报文段、数据报，再交给网际层。

网际层加上本层的控制信息，形成IP数据报，传给网络接口层。

网络接口层将网际层交下来的IP数据报组装成帧，并以比特流的形式传给网络硬件（即物理层），数据就离开源主机。

原文链接：<nowiki>https://blog.csdn.net/wwy0324/article/details/109310658</nowiki>

OSI七层模型、TCP/IP四层模型

2024-05-22T03:32:24Z

Admin：创建页面，内容为“=== '''OSI七层模型''' === 七层模型，亦称OSI（Open System Interconnection）。参考模型是国际标准化组织（ISO）制定的一个用于计算机或通信系统间互联的标准体系，一般称为OSI参考模型或七层模型。它是一个七层的、抽象的模型体，不仅包括一系列抽象的术语或概念，也包括具体的协议。缩略图 '''OSI七…”

=== '''OSI七层模型''' ===
七层模型，亦称OSI（Open System Interconnection）。参考模型是国际标准化组织（ISO）制定的一个用于计算机或通信系统间互联的标准体系，一般称为OSI参考模型或七层模型。

它是一个七层的、抽象的模型体，不仅包括一系列抽象的术语或概念，也包括具体的协议。

[[文件:Image-osi七层模型、tcp-ip四层模型.png|居中|缩略图]]

'''OSI七层模型-分层'''

7. 应用层

网络服务与最终用户的一个接口

各种应用程序协议

协议有：HTTP(超文本传输协议) FTP（文本传输协议） TFTP（简单文件传输协议） SMTP（简单邮件传输协议） SNMP（简单网络管理协议） DNS（域名系统） TELNET（远程终端协议） HTTPS（超文本传输安全协议） POP3（邮局协议版本3 ） DHCP（动态主机配置协议）

6. 表示层

数据的表示、安全、压缩。（在五层模型里面已经合并到了应用层）

信息的语法语义以及他们的关联，如加密解密、转换翻译、压缩解压

格式有，JPEG、ASCll、EBCDIC、加密格式等 [2]

如LPP（轻量级表示协议）

5. 会话层

建立、管理、终止会话。（在五层模型里面已经合并到了应用层）

不同机器上的用户之间建立及管理会话

对应主机进程，指本地主机与远程主机正在进行的会话

安全协议：SSL（安全套接字层协议）、TLS（安全传输层协议）

4. 传输层

定义传输数据的协议端口号，以及流控和差错校验。

接受上一层数据，在必要的时候把数据进行切割，并将这些数据交给网络层，并保证这些数据段有效到达对端

协议有：TCP UDP，数据包一旦离开网卡即进入网络传输层

3. 网络层

进行逻辑地址寻址，实现不同网络之间的路径选择。

控制子网的运行，如逻辑编址、分组传输、路由选择

协议有：ICMP（互联网控制信息协议） IGMP（组管理协议） IP（IPV4 IPV6）（互联网协议）

安全协议、路由协议（vrrp虚拟路由冗余）

2. 数据链路层

建立逻辑连接、进行硬件地址寻址、差错校验 [3] 等功能。（由底层网络定义协议）

将比特组合成字节进而组合成帧，用MAC地址访问介质，错误发现但不能纠正。

物理寻址、同时将原始比特流转变为逻辑传输线路

地址解析协议：ARP、PARP（反向地址转换协议）

1. 物理层

建立、维护、断开物理连接。（由底层网络定义协议）

机械、电子、定时接口通信信道上的原始比特流传输

TCP/IP 层级模型结构，应用层之间的协议通过逐级调用传输层（Transport layer）、网络层（Network Layer）和物理数据链路层（Physical Data Link）而可以实现应用层的应用程序通信互联。

应用层需要关心应用程序的逻辑细节，而不是数据在网络中的传输活动。应用层其下三层则处理真正的通信细节。在 Internet 整个发展过程中的所有思想和着重点都以一种称为 RFC（Request For Comments）的文档格式存在。针对每一种特定的 TCP/IP 应用，有相应的 RFC

一些典型的 TCP/IP 应用有 FTP、Telnet、SMTP、SNTP、REXEC、TFTP、LPD、SNMP、NFS、INETD 等。RFC 使一些基本相同的 TCP/IP 应用程序实现了标准化，从而使得不同厂家开发的应用程序可以互相通信

=== TCP/IP四层模型 ===
TCP/IP（Transmission Control Protocol/Internet Protocol，传输控制协议/网际协议）是指能够在多个不同网络间实现信息传输的协议簇。TCP/IP协议不仅仅指的是TCP 和IP两个协议，而是指一个由FTP、SMTP、TCP、UDP、IP等协议构成的协议簇，只是因为在TCP/IP协议中TCP协议和IP协议最具代表性，所以被称为TCP/IP协议

TCP/IP是在网络的使用中的最基本的通信协议。

TCP/IP传输协议对互联网中各部分进行通信的标准和方法进行了规定。

TCP/IP传输协议是保证网络数据信息及时、完整传输的两个重要的协议。

TCP/IP传输协议是严格来说是一个四层的体系结构，应用层、传输层、网络层和数据链路层都包含其中。

[[文件:Image-OSI七层模型-TCP-IP四层模型.png|居中|缩略图]]

=== TCP/IP协议中的四个层次 ===
应用层：应用层是TCP/IP协议的第一层，是直接为应用进程提供服务的。

（1）对不同种类的应用程序它们会根据自己的需要来使用应用层的不同协议，邮件传输应用使用了SMTP协议、万维网应用使用了HTTP协议、远程登录服务应用使用了有TELNET协议

（2）应用层还能加密、解密、格式化数据

（3）应用层可以建立或解除与其他节点的联系，这样可以充分节省网络资源

运输层：作为TCP/IP协议的第二层，运输层在整个TCP/IP协议中起到了中流砥柱的作用。且在运输层中，TCP和UDP也同样起到了中流砥柱的作用

网络层：网络层在TCP/IP协议中的位于第三层。在TCP/IP协议中网络层可以进行网络连接的建立和终止以及IP地址的寻找等功能

网络接口层：在TCP/IP协议中，网络接口层位于第四层。由于网络接口层兼并了物理层和数据链路层所以，网络接口层既是传输数据的物理媒介，也可以为网络层提供一条准确无误的线路

特点

TCP/IP协议能够迅速发展起来并成为事实上的标准，是它恰好适应了世界范围内数据通信的需要。它有以下特点：

（1）协议标准是完全开放的，可以供用户免费使用，并且独立于特定的计算机硬件与操作系统。

（2）独立于网络硬件系统，可以运行在广域网，更适合于互联网。

（3）网络地址统一分配，网络中每一设备和终端都具有一个唯一地址。

（4）高层协议标准化，可以提供多种多样可靠网络服务

=== 通信过程及相关协议 ===
在网络通信的过程中，将发出数据的主机称为源主机，接收数据的主机称为目的主机。

当源主机发出数据时，数据在源主机中从上层向下层传送。

源主机中的应用进程先将数据交给应用层，应用层加上必要的控制信息就成了报文流，向下传给传输层。

传输层将收到的数据单元加上本层的控制信息，形成报文段、数据报，再交给网际层。

网际层加上本层的控制信息，形成IP数据报，传给网络接口层。

网络接口层将网际层交下来的IP数据报组装成帧，并以比特流的形式传给网络硬件（即物理层），数据就离开源主机。

————————————————

版权声明：本文为博主原创文章，遵循 CC 4.0 BY-SA 版权协议，转载请附上原文出处链接和本声明。

原文链接：<nowiki>https://blog.csdn.net/wwy0324/article/details/109310658</nowiki>

文件:Image-OSI七层模型-TCP-IP四层模型.png

2024-05-22T03:31:43Z

Admin：

Image-OSI七层模型-TCP-IP四层模型

文件:Image-osi七层模型、tcp-ip四层模型.png

2024-05-22T03:29:20Z

Admin：

Image-osi七层模型、tcp/ip四层模型

首页

2024-05-22T03:28:05Z

Admin：/* 其他技术 */

== [[DNS技术]] ==
* [[DNS是什么？]]

* [[DNS-RFC]]
* [[顶级域名（TLD）]]
* [[NAT64与DNS64基本原理概述]]
* [[DNSSEC]]
* [[EDNS]]
* [[名词解释]]

== DNS软件 ==

* [[BIND]]
* PowerDNS
* Unbond
* 其他

== DNS安全 ==

* [[DNSSEC]]
* [[DNS-CVEs]]

* [[网络安全/系统安全/业务安全]]

== [[DNS资讯]] ==
[[新闻-News]]

[[常用公共DNS]]

== [[LINUX]]相关 ==
shell

[[超细节！十年码农讲述eBPF和XDP技术！]]

[[XDP技术 — Linux网络处理的高速公路]]

== 其他技术 ==
cdn

sdn

[[OSI七层模型、TCP/IP四层模型]]
== [[帮助信息]] ==

[[MediaWiki 设置配置]]

[[MediaWiki 使用帮助]]

已安装MediaWiki。

请查阅[https://www.mediawiki.org/wiki/Special:MyLanguage/Help:Contents 用户指导]以获取使用本wiki软件的信息。

DNS flag day 2020

2024-05-22T03:14:12Z

Admin：创建页面，内容为“DNS Software Vendors It is important for DNS software vendors to comply with DNS standards, and to use a default EDNS buffer size (1232 bytes) that will not cause fragmentation on typical network links. Relevant standards include <nowiki>RFC 7766</nowiki>, <nowiki>RFC 6891</nowiki> section 6.2.3. and <nowiki>RFC 6891</nowiki> section 6.2.4.. The motivation for this effort is described in IETF draft intarea-frag-fragile section 6.1 and IETF draft iab-protocol…”

DNS Software Vendors

It is important for DNS software vendors to comply with DNS standards, and to use a default EDNS buffer size (1232 bytes) that will not cause fragmentation on typical network links.

Relevant standards include <nowiki>RFC 7766</nowiki>, <nowiki>RFC 6891</nowiki> section 6.2.3. and <nowiki>RFC 6891</nowiki> section 6.2.4..

The motivation for this effort is described in IETF draft intarea-frag-fragile section 6.1 and IETF draft iab-protocol-maintenance.

How to test?

If you’re the owner of a domain or the operator of an authoritative DNS server, you can use our web-based testing tool to check your domains; you can find it above under Action: Authoritative DNS Operators.

Our web-based testing tool for clients and DNS resolver operators can be found above under Action: DNS Resolver Operators.

You can also test by using the following CLI commands:

$ dig +tcp @auth_IP yourdomain.example.

$ dig +tcp @resolver_IP yourdomain.example.

$ dig @resolver_IP test.knot-resolver.cz. TXT

All DNS queries must be successful, and commands should return the same results both with and without the +tcp option.

If you are a service provider, you can test your authoritative and recursive DNS services by configuring the default EDNS buffer size:

BIND

options {

edns-udp-size 1232;

max-udp-size 1232;

};

Knot DNS

server:

max-udp-payload: 1232

Knot Resolver

net.bufsize(1232)

PowerDNS Authoritative

udp-truncation-threshold=1232

PowerDNS Recursor

edns-outgoing-bufsize=1232

udp-truncation-threshold=1232

Unbound

server:

edns-buffer-size: 1232

NSD

server:

ipv4-edns-size: 1232

ipv6-edns-size: 1232

The configuration above will have no visible effect if everything works correctly. Some queries will fail to resolve if the TCP transport is not available.

新闻-News

2024-05-22T03:14:02Z

Admin：

[[DNS flag day 2020]]

DNS Software Vendors

新闻-News

2024-05-22T03:12:31Z

Admin：创建页面，内容为“DNS flag day 2020”

[[DNS flag day 2020]]

BIND

2024-05-08T04:14:02Z

Admin：

[[BIND 9 Release Note]]

[[BIND 9 Administrator Reference Manual]]

[[BIND 9 ARM Manual Page v9.18.26]]

[[BIND 配置文件解析]]

BIND 9 ARM Manual Page v9.18.26-Named.conf - configuration file for named

2024-05-08T03:56:42Z

Admin：创建页面，内容为“ == named.conf - configuration file for named == === Synopsis === '''named.conf''' === Description === <code>named.conf</code> is the configuration file for <code>named</code>. For complete documentation about the configuration statements, please refer to the Configuration Reference section in the BIND 9 Administrator Reference Manual. Statements are enclosed in braces and terminated with a semi-colon. Clauses in the statements are also semi-colon…”

== named.conf - configuration file for named ==

=== Synopsis ===
'''named.conf'''

=== Description ===
<code>named.conf</code> is the configuration file for <code>named</code>.

For complete documentation about the configuration statements, please refer to the Configuration Reference section in the BIND 9 Administrator Reference Manual.

Statements are enclosed in braces and terminated with a semi-colon. Clauses in the statements are also semi-colon terminated. The usual comment styles are supported:

C style: /* */

C++ style: // to end of line

Unix style: # to end of line
acl <string> { <address_match_element>; ... }; // may occur multiple times

controls {
inet ( <ipv4_address> | <ipv6_address> | * ) [ port ( <integer> | * ) ] allow { <address_match_element>; ... } [ keys { <string>; ... } ] [ read-only <boolean> ]; // may occur multiple times
unix <quoted_string> perm <integer> owner <integer> group <integer> [ keys { <string>; ... } ] [ read-only <boolean> ]; // may occur multiple times
}; // may occur multiple times

dlz <string> {
database <string>;
search <boolean>;
}; // may occur multiple times

dnssec-policy <string> {
dnskey-ttl <duration>;
keys { ( csk | ksk | zsk ) [ ( key-directory ) ] lifetime <duration_or_unlimited> algorithm <string> [ <integer> ]; ... };
max-zone-ttl <duration>;
nsec3param [ iterations <integer> ] [ optout <boolean> ] [ salt-length <integer> ];
parent-ds-ttl <duration>;
parent-propagation-delay <duration>;
parent-registration-delay <duration>; // obsolete
publish-safety <duration>;
purge-keys <duration>;
retire-safety <duration>;
signatures-refresh <duration>;
signatures-validity <duration>;
signatures-validity-dnskey <duration>;
zone-propagation-delay <duration>;
}; // may occur multiple times

dyndb <string> <quoted_string> { <unspecified-text> }; // may occur multiple times

http <string> {
endpoints { <quoted_string>; ... };
listener-clients <integer>;
streams-per-connection <integer>;
}; // may occur multiple times

key <string> {
algorithm <string>;
secret <string>;
}; // may occur multiple times

logging {
category <string> { <string>; ... }; // may occur multiple times
channel <string> {
buffered <boolean>;
file <quoted_string> [ versions ( unlimited | <integer> ) ] [ size <size> ] [ suffix ( increment | timestamp ) ];
null;
print-category <boolean>;
print-severity <boolean>;
print-time ( iso8601 | iso8601-utc | local | <boolean> );
severity <log_severity>;
stderr;
syslog [ <syslog_facility> ];
}; // may occur multiple times
};

managed-keys { <string> ( static-key | initial-key | static-ds | initial-ds ) <integer> <integer> <integer> <quoted_string>; ... }; // may occur multiple times, deprecated

options {
allow-new-zones <boolean>;
allow-notify { <address_match_element>; ... };
allow-query { <address_match_element>; ... };
allow-query-cache { <address_match_element>; ... };
allow-query-cache-on { <address_match_element>; ... };
allow-query-on { <address_match_element>; ... };
allow-recursion { <address_match_element>; ... };
allow-recursion-on { <address_match_element>; ... };
allow-transfer [ port <integer> ] [ transport <string> ] { <address_match_element>; ... };
allow-update { <address_match_element>; ... };
allow-update-forwarding { <address_match_element>; ... };
also-notify [ port <integer> ] { ( <remote-servers> | <ipv4_address> [ port <integer> ] | <ipv6_address> [ port <integer> ] ) [ key <string> ] [ tls <string> ]; ... };
alt-transfer-source ( <ipv4_address> | * ) ; // deprecated
alt-transfer-source-v6 ( <ipv6_address> | * ) ; // deprecated
answer-cookie <boolean>;
attach-cache <string>;
auth-nxdomain <boolean>;
auto-dnssec ( allow | maintain | off ); // deprecated
automatic-interface-scan <boolean>;
avoid-v4-udp-ports { <portrange>; ... }; // deprecated
avoid-v6-udp-ports { <portrange>; ... }; // deprecated
bindkeys-file <quoted_string>;
blackhole { <address_match_element>; ... };
catalog-zones { zone <string> [ default-primaries [ port <integer> ] { ( <remote-servers> | <ipv4_address> [ port <integer> ] | <ipv6_address> [ port <integer> ] ) [ key <string> ] [ tls <string> ]; ... } ] [ zone-directory <quoted_string> ] [ in-memory <boolean> ] [ min-update-interval <duration> ]; ... };
check-dup-records ( fail | warn | ignore );
check-integrity <boolean>;
check-mx ( fail | warn | ignore );
check-mx-cname ( fail | warn | ignore );
check-names ( primary | master | secondary | slave | response ) ( fail | warn | ignore ); // may occur multiple times
check-sibling <boolean>;
check-spf ( warn | ignore );
check-srv-cname ( fail | warn | ignore );
check-wildcard <boolean>;
clients-per-query <integer>;
cookie-algorithm ( aes | siphash24 );
cookie-secret <string>; // may occur multiple times
coresize ( default | unlimited | <sizeval> ); // deprecated
datasize ( default | unlimited | <sizeval> ); // deprecated
deny-answer-addresses { <address_match_element>; ... } [ except-from { <string>; ... } ];
deny-answer-aliases { <string>; ... } [ except-from { <string>; ... } ];
dialup ( notify | notify-passive | passive | refresh | <boolean> ); // deprecated
directory <quoted_string>;
disable-algorithms <string> { <string>; ... }; // may occur multiple times
disable-ds-digests <string> { <string>; ... }; // may occur multiple times
disable-empty-zone <string>; // may occur multiple times
dns64 <netprefix> {
break-dnssec <boolean>;
clients { <address_match_element>; ... };
exclude { <address_match_element>; ... };
mapped { <address_match_element>; ... };
recursive-only <boolean>;
suffix <ipv6_address>;
}; // may occur multiple times
dns64-contact <string>;
dns64-server <string>;
dnskey-sig-validity <integer>;
dnsrps-enable <boolean>; // not configured
dnsrps-options { <unspecified-text> }; // not configured
dnssec-accept-expired <boolean>;
dnssec-dnskey-kskonly <boolean>;
dnssec-loadkeys-interval <integer>;
dnssec-must-be-secure <string> <boolean>; // may occur multiple times, deprecated
dnssec-policy <string>;
dnssec-secure-to-insecure <boolean>;
dnssec-update-mode ( maintain | no-resign );
dnssec-validation ( yes | no | auto );
dnstap { ( all | auth | client | forwarder | resolver | update ) [ ( query | response ) ]; ... }; // not configured
dnstap-identity ( <quoted_string> | none | hostname ); // not configured
dnstap-output ( file | unix ) <quoted_string> [ size ( unlimited | <size> ) ] [ versions ( unlimited | <integer> ) ] [ suffix ( increment | timestamp ) ]; // not configured
dnstap-version ( <quoted_string> | none ); // not configured
dscp <integer>; // obsolete
dual-stack-servers [ port <integer> ] { ( <quoted_string> [ port <integer> ] | <ipv4_address> [ port <integer> ] | <ipv6_address> [ port <integer> ] ); ... };
dump-file <quoted_string>;
edns-udp-size <integer>;
empty-contact <string>;
empty-server <string>;
empty-zones-enable <boolean>;
fetch-quota-params <integer> <fixedpoint> <fixedpoint> <fixedpoint>;
fetches-per-server <integer> [ ( drop | fail ) ];
fetches-per-zone <integer> [ ( drop | fail ) ];
files ( default | unlimited | <sizeval> ); // deprecated
flush-zones-on-shutdown <boolean>;
forward ( first | only );
forwarders [ port <integer> ] { ( <ipv4_address> | <ipv6_address> ) [ port <integer> ]; ... };
fstrm-set-buffer-hint <integer>; // not configured
fstrm-set-flush-timeout <integer>; // not configured
fstrm-set-input-queue-size <integer>; // not configured
fstrm-set-output-notify-threshold <integer>; // not configured
fstrm-set-output-queue-model ( mpsc | spsc ); // not configured
fstrm-set-output-queue-size <integer>; // not configured
fstrm-set-reopen-interval <duration>; // not configured
geoip-directory ( <quoted_string> | none );
glue-cache <boolean>; // deprecated
heartbeat-interval <integer>; // deprecated
hostname ( <quoted_string> | none );
http-listener-clients <integer>;
http-port <integer>;
http-streams-per-connection <integer>;
https-port <integer>;
interface-interval <duration>;
ipv4only-contact <string>;
ipv4only-enable <boolean>;
ipv4only-server <string>;
ixfr-from-differences ( primary | master | secondary | slave | <boolean> );
keep-response-order { <address_match_element>; ... };
key-directory <quoted_string>;
lame-ttl <duration>;
listen-on [ port <integer> ] [ tls <string> ] [ http <string> ] { <address_match_element>; ... }; // may occur multiple times
listen-on-v6 [ port <integer> ] [ tls <string> ] [ http <string> ] { <address_match_element>; ... }; // may occur multiple times
lmdb-mapsize <sizeval>;
lock-file ( <quoted_string> | none );
managed-keys-directory <quoted_string>;
masterfile-format ( raw | text );
masterfile-style ( full | relative );
match-mapped-addresses <boolean>;
max-cache-size ( default | unlimited | <sizeval> | <percentage> );
max-cache-ttl <duration>;
max-clients-per-query <integer>;
max-ixfr-ratio ( unlimited | <percentage> );
max-journal-size ( default | unlimited | <sizeval> );
max-ncache-ttl <duration>;
max-records <integer>;
max-recursion-depth <integer>;
max-recursion-queries <integer>;
max-refresh-time <integer>;
max-retry-time <integer>;
max-rsa-exponent-size <integer>;
max-stale-ttl <duration>;
max-transfer-idle-in <integer>;
max-transfer-idle-out <integer>;
max-transfer-time-in <integer>;
max-transfer-time-out <integer>;
max-udp-size <integer>;
max-zone-ttl ( unlimited | <duration> );
memstatistics <boolean>;
memstatistics-file <quoted_string>;
message-compression <boolean>;
min-cache-ttl <duration>;
min-ncache-ttl <duration>;
min-refresh-time <integer>;
min-retry-time <integer>;
minimal-any <boolean>;
minimal-responses ( no-auth | no-auth-recursive | <boolean> );
multi-master <boolean>;
new-zones-directory <quoted_string>;
no-case-compress { <address_match_element>; ... };
nocookie-udp-size <integer>;
notify ( explicit | master-only | primary-only | <boolean> );
notify-delay <integer>;
notify-rate <integer>;
notify-source ( <ipv4_address> | * ) ;
notify-source-v6 ( <ipv6_address> | * ) ;
notify-to-soa <boolean>;
nsec3-test-zone <boolean>; // test only
nta-lifetime <duration>;
nta-recheck <duration>;
nxdomain-redirect <string>;
parental-source ( <ipv4_address> | * ) ;
parental-source-v6 ( <ipv6_address> | * ) ;
pid-file ( <quoted_string> | none );
port <integer>;
preferred-glue <string>;
prefetch <integer> [ <integer> ];
provide-ixfr <boolean>;
qname-minimization ( strict | relaxed | disabled | off );
query-source [ address ] ( <ipv4_address> | * );
query-source-v6 [ address ] ( <ipv6_address> | * );
querylog <boolean>;
random-device ( <quoted_string> | none ); // obsolete
rate-limit {
all-per-second <integer>;
errors-per-second <integer>;
exempt-clients { <address_match_element>; ... };
ipv4-prefix-length <integer>;
ipv6-prefix-length <integer>;
log-only <boolean>;
max-table-size <integer>;
min-table-size <integer>;
nodata-per-second <integer>;
nxdomains-per-second <integer>;
qps-scale <integer>;
referrals-per-second <integer>;
responses-per-second <integer>;
slip <integer>;
window <integer>;
};
recursing-file <quoted_string>;
recursion <boolean>;
recursive-clients <integer>;
request-expire <boolean>;
request-ixfr <boolean>;
request-nsid <boolean>;
require-server-cookie <boolean>;
reserved-sockets <integer>; // deprecated
resolver-nonbackoff-tries <integer>; // deprecated
resolver-query-timeout <integer>;
resolver-retry-interval <integer>; // deprecated
response-padding { <address_match_element>; ... } block-size <integer>;
response-policy { zone <string> [ add-soa <boolean> ] [ log <boolean> ] [ max-policy-ttl <duration> ] [ min-update-interval <duration> ] [ policy ( cname | disabled | drop | given | no-op | nodata | nxdomain | passthru | tcp-only <quoted_string> ) ] [ recursive-only <boolean> ] [ nsip-enable <boolean> ] [ nsdname-enable <boolean> ]; ... } [ add-soa <boolean> ] [ break-dnssec <boolean> ] [ max-policy-ttl <duration> ] [ min-update-interval <duration> ] [ min-ns-dots <integer> ] [ nsip-wait-recurse <boolean> ] [ nsdname-wait-recurse <boolean> ] [ qname-wait-recurse <boolean> ] [ recursive-only <boolean> ] [ nsip-enable <boolean> ] [ nsdname-enable <boolean> ] [ dnsrps-enable <boolean> ] [ dnsrps-options { <unspecified-text> } ];
reuseport <boolean>;
root-delegation-only [ exclude { <string>; ... } ]; // deprecated
root-key-sentinel <boolean>;
rrset-order { [ class <string> ] [ type <string> ] [ name <quoted_string> ] <string> <string>; ... };
secroots-file <quoted_string>;
send-cookie <boolean>;
serial-query-rate <integer>;
serial-update-method ( date | increment | unixtime );
server-id ( <quoted_string> | none | hostname );
servfail-ttl <duration>;
session-keyalg <string>;
session-keyfile ( <quoted_string> | none );
session-keyname <string>;
sig-signing-nodes <integer>;
sig-signing-signatures <integer>;
sig-signing-type <integer>;
sig-validity-interval <integer> [ <integer> ];
sortlist { <address_match_element>; ... };
stacksize ( default | unlimited | <sizeval> ); // deprecated
stale-answer-client-timeout ( disabled | off | <integer> );
stale-answer-enable <boolean>;
stale-answer-ttl <duration>;
stale-cache-enable <boolean>;
stale-refresh-time <duration>;
startup-notify-rate <integer>;
statistics-file <quoted_string>;
suppress-initial-notify <boolean>; // obsolete
synth-from-dnssec <boolean>;
tcp-advertised-timeout <integer>;
tcp-clients <integer>;
tcp-idle-timeout <integer>;
tcp-initial-timeout <integer>;
tcp-keepalive-timeout <integer>;
tcp-listen-queue <integer>;
tcp-receive-buffer <integer>;
tcp-send-buffer <integer>;
tkey-dhkey <quoted_string> <integer>; // deprecated
tkey-domain <quoted_string>;
tkey-gssapi-credential <quoted_string>;
tkey-gssapi-keytab <quoted_string>;
tls-port <integer>;
transfer-format ( many-answers | one-answer );
transfer-message-size <integer>;
transfer-source ( <ipv4_address> | * ) ;
transfer-source-v6 ( <ipv6_address> | * ) ;
transfers-in <integer>;
transfers-out <integer>;
transfers-per-ns <integer>;
trust-anchor-telemetry <boolean>;
try-tcp-refresh <boolean>;
udp-receive-buffer <integer>;
udp-send-buffer <integer>;
update-check-ksk <boolean>;
update-quota <integer>;
use-alt-transfer-source <boolean>; // deprecated
use-v4-udp-ports { <portrange>; ... }; // deprecated
use-v6-udp-ports { <portrange>; ... }; // deprecated
v6-bias <integer>;
validate-except { <string>; ... };
version ( <quoted_string> | none );
zero-no-soa-ttl <boolean>;
zero-no-soa-ttl-cache <boolean>;
zone-statistics ( full | terse | none | <boolean> );
};

parental-agents <string> [ port <integer> ] { ( <remote-servers> | <ipv4_address> [ port <integer> ] | <ipv6_address> [ port <integer> ] ) [ key <string> ] [ tls <string> ]; ... }; // may occur multiple times

plugin ( query ) <string> [ { <unspecified-text> } ]; // may occur multiple times

primaries <string> [ port <integer> ] { ( <remote-servers> | <ipv4_address> [ port <integer> ] | <ipv6_address> [ port <integer> ] ) [ key <string> ] [ tls <string> ]; ... }; // may occur multiple times

server <netprefix> {
bogus <boolean>;
edns <boolean>;
edns-udp-size <integer>;
edns-version <integer>;
keys <server_key>;
max-udp-size <integer>;
notify-source ( <ipv4_address> | * ) ;
notify-source-v6 ( <ipv6_address> | * ) ;
padding <integer>;
provide-ixfr <boolean>;
query-source [ address ] ( <ipv4_address> | * );
query-source-v6 [ address ] ( <ipv6_address> | * );
request-expire <boolean>;
request-ixfr <boolean>;
request-nsid <boolean>;
send-cookie <boolean>;
tcp-keepalive <boolean>;
tcp-only <boolean>;
transfer-format ( many-answers | one-answer );
transfer-source ( <ipv4_address> | * ) ;
transfer-source-v6 ( <ipv6_address> | * ) ;
transfers <integer>;
}; // may occur multiple times

statistics-channels {
inet ( <ipv4_address> | <ipv6_address> | * ) [ port ( <integer> | * ) ] [ allow { <address_match_element>; ... } ]; // may occur multiple times
}; // may occur multiple times

tls <string> {
ca-file <quoted_string>;
cert-file <quoted_string>;
ciphers <string>;
dhparam-file <quoted_string>;
key-file <quoted_string>;
prefer-server-ciphers <boolean>;
protocols { <string>; ... };
remote-hostname <quoted_string>;
session-tickets <boolean>;
}; // may occur multiple times

trust-anchors { <string> ( static-key | initial-key | static-ds | initial-ds ) <integer> <integer> <integer> <quoted_string>; ... }; // may occur multiple times

trusted-keys { <string> <integer> <integer> <integer> <quoted_string>; ... }; // may occur multiple times, deprecated

view <string> [ <class> ] {
allow-new-zones <boolean>;
allow-notify { <address_match_element>; ... };
allow-query { <address_match_element>; ... };
allow-query-cache { <address_match_element>; ... };
allow-query-cache-on { <address_match_element>; ... };
allow-query-on { <address_match_element>; ... };
allow-recursion { <address_match_element>; ... };
allow-recursion-on { <address_match_element>; ... };
allow-transfer [ port <integer> ] [ transport <string> ] { <address_match_element>; ... };
allow-update { <address_match_element>; ... };
allow-update-forwarding { <address_match_element>; ... };
also-notify [ port <integer> ] { ( <remote-servers> | <ipv4_address> [ port <integer> ] | <ipv6_address> [ port <integer> ] ) [ key <string> ] [ tls <string> ]; ... };
alt-transfer-source ( <ipv4_address> | * ) ; // deprecated
alt-transfer-source-v6 ( <ipv6_address> | * ) ; // deprecated
attach-cache <string>;
auth-nxdomain <boolean>;
auto-dnssec ( allow | maintain | off ); // deprecated
catalog-zones { zone <string> [ default-primaries [ port <integer> ] { ( <remote-servers> | <ipv4_address> [ port <integer> ] | <ipv6_address> [ port <integer> ] ) [ key <string> ] [ tls <string> ]; ... } ] [ zone-directory <quoted_string> ] [ in-memory <boolean> ] [ min-update-interval <duration> ]; ... };
check-dup-records ( fail | warn | ignore );
check-integrity <boolean>;
check-mx ( fail | warn | ignore );
check-mx-cname ( fail | warn | ignore );
check-names ( primary | master | secondary | slave | response ) ( fail | warn | ignore ); // may occur multiple times
check-sibling <boolean>;
check-spf ( warn | ignore );
check-srv-cname ( fail | warn | ignore );
check-wildcard <boolean>;
clients-per-query <integer>;
deny-answer-addresses { <address_match_element>; ... } [ except-from { <string>; ... } ];
deny-answer-aliases { <string>; ... } [ except-from { <string>; ... } ];
dialup ( notify | notify-passive | passive | refresh | <boolean> ); // deprecated
disable-algorithms <string> { <string>; ... }; // may occur multiple times
disable-ds-digests <string> { <string>; ... }; // may occur multiple times
disable-empty-zone <string>; // may occur multiple times
dlz <string> {
database <string>;
search <boolean>;
}; // may occur multiple times
dns64 <netprefix> {
break-dnssec <boolean>;
clients { <address_match_element>; ... };
exclude { <address_match_element>; ... };
mapped { <address_match_element>; ... };
recursive-only <boolean>;
suffix <ipv6_address>;
}; // may occur multiple times
dns64-contact <string>;
dns64-server <string>;
dnskey-sig-validity <integer>;
dnsrps-enable <boolean>; // not configured
dnsrps-options { <unspecified-text> }; // not configured
dnssec-accept-expired <boolean>;
dnssec-dnskey-kskonly <boolean>;
dnssec-loadkeys-interval <integer>;
dnssec-must-be-secure <string> <boolean>; // may occur multiple times, deprecated
dnssec-policy <string>;
dnssec-secure-to-insecure <boolean>;
dnssec-update-mode ( maintain | no-resign );
dnssec-validation ( yes | no | auto );
dnstap { ( all | auth | client | forwarder | resolver | update ) [ ( query | response ) ]; ... }; // not configured
dual-stack-servers [ port <integer> ] { ( <quoted_string> [ port <integer> ] | <ipv4_address> [ port <integer> ] | <ipv6_address> [ port <integer> ] ); ... };
dyndb <string> <quoted_string> { <unspecified-text> }; // may occur multiple times
edns-udp-size <integer>;
empty-contact <string>;
empty-server <string>;
empty-zones-enable <boolean>;
fetch-quota-params <integer> <fixedpoint> <fixedpoint> <fixedpoint>;
fetches-per-server <integer> [ ( drop | fail ) ];
fetches-per-zone <integer> [ ( drop | fail ) ];
forward ( first | only );
forwarders [ port <integer> ] { ( <ipv4_address> | <ipv6_address> ) [ port <integer> ]; ... };
glue-cache <boolean>; // deprecated
ipv4only-contact <string>;
ipv4only-enable <boolean>;
ipv4only-server <string>;
ixfr-from-differences ( primary | master | secondary | slave | <boolean> );
key <string> {
algorithm <string>;
secret <string>;
}; // may occur multiple times
key-directory <quoted_string>;
lame-ttl <duration>;
lmdb-mapsize <sizeval>;
managed-keys { <string> ( static-key | initial-key | static-ds | initial-ds ) <integer> <integer> <integer> <quoted_string>; ... }; // may occur multiple times, deprecated
masterfile-format ( raw | text );
masterfile-style ( full | relative );
match-clients { <address_match_element>; ... };
match-destinations { <address_match_element>; ... };
match-recursive-only <boolean>;
max-cache-size ( default | unlimited | <sizeval> | <percentage> );
max-cache-ttl <duration>;
max-clients-per-query <integer>;
max-ixfr-ratio ( unlimited | <percentage> );
max-journal-size ( default | unlimited | <sizeval> );
max-ncache-ttl <duration>;
max-records <integer>;
max-recursion-depth <integer>;
max-recursion-queries <integer>;
max-refresh-time <integer>;
max-retry-time <integer>;
max-stale-ttl <duration>;
max-transfer-idle-in <integer>;
max-transfer-idle-out <integer>;
max-transfer-time-in <integer>;
max-transfer-time-out <integer>;
max-udp-size <integer>;
max-zone-ttl ( unlimited | <duration> );
message-compression <boolean>;
min-cache-ttl <duration>;
min-ncache-ttl <duration>;
min-refresh-time <integer>;
min-retry-time <integer>;
minimal-any <boolean>;
minimal-responses ( no-auth | no-auth-recursive | <boolean> );
multi-master <boolean>;
new-zones-directory <quoted_string>;
no-case-compress { <address_match_element>; ... };
nocookie-udp-size <integer>;
notify ( explicit | master-only | primary-only | <boolean> );
notify-delay <integer>;
notify-source ( <ipv4_address> | * ) ;
notify-source-v6 ( <ipv6_address> | * ) ;
notify-to-soa <boolean>;
nsec3-test-zone <boolean>; // test only
nta-lifetime <duration>;
nta-recheck <duration>;
nxdomain-redirect <string>;
parental-source ( <ipv4_address> | * ) ;
parental-source-v6 ( <ipv6_address> | * ) ;
plugin ( query ) <string> [ { <unspecified-text> } ]; // may occur multiple times
preferred-glue <string>;
prefetch <integer> [ <integer> ];
provide-ixfr <boolean>;
qname-minimization ( strict | relaxed | disabled | off );
query-source [ address ] ( <ipv4_address> | * );
query-source-v6 [ address ] ( <ipv6_address> | * );
rate-limit {
all-per-second <integer>;
errors-per-second <integer>;
exempt-clients { <address_match_element>; ... };
ipv4-prefix-length <integer>;
ipv6-prefix-length <integer>;
log-only <boolean>;
max-table-size <integer>;
min-table-size <integer>;
nodata-per-second <integer>;
nxdomains-per-second <integer>;
qps-scale <integer>;
referrals-per-second <integer>;
responses-per-second <integer>;
slip <integer>;
window <integer>;
};
recursion <boolean>;
request-expire <boolean>;
request-ixfr <boolean>;
request-nsid <boolean>;
require-server-cookie <boolean>;
resolver-nonbackoff-tries <integer>; // deprecated
resolver-query-timeout <integer>;
resolver-retry-interval <integer>; // deprecated
response-padding { <address_match_element>; ... } block-size <integer>;
response-policy { zone <string> [ add-soa <boolean> ] [ log <boolean> ] [ max-policy-ttl <duration> ] [ min-update-interval <duration> ] [ policy ( cname | disabled | drop | given | no-op | nodata | nxdomain | passthru | tcp-only <quoted_string> ) ] [ recursive-only <boolean> ] [ nsip-enable <boolean> ] [ nsdname-enable <boolean> ]; ... } [ add-soa <boolean> ] [ break-dnssec <boolean> ] [ max-policy-ttl <duration> ] [ min-update-interval <duration> ] [ min-ns-dots <integer> ] [ nsip-wait-recurse <boolean> ] [ nsdname-wait-recurse <boolean> ] [ qname-wait-recurse <boolean> ] [ recursive-only <boolean> ] [ nsip-enable <boolean> ] [ nsdname-enable <boolean> ] [ dnsrps-enable <boolean> ] [ dnsrps-options { <unspecified-text> } ];
root-delegation-only [ exclude { <string>; ... } ]; // deprecated
root-key-sentinel <boolean>;
rrset-order { [ class <string> ] [ type <string> ] [ name <quoted_string> ] <string> <string>; ... };
send-cookie <boolean>;
serial-update-method ( date | increment | unixtime );
server <netprefix> {
bogus <boolean>;
edns <boolean>;
edns-udp-size <integer>;
edns-version <integer>;
keys <server_key>;
max-udp-size <integer>;
notify-source ( <ipv4_address> | * ) ;
notify-source-v6 ( <ipv6_address> | * ) ;
padding <integer>;
provide-ixfr <boolean>;
query-source [ address ] ( <ipv4_address> | * );
query-source-v6 [ address ] ( <ipv6_address> | * );
request-expire <boolean>;
request-ixfr <boolean>;
request-nsid <boolean>;
send-cookie <boolean>;
tcp-keepalive <boolean>;
tcp-only <boolean>;
transfer-format ( many-answers | one-answer );
transfer-source ( <ipv4_address> | * ) ;
transfer-source-v6 ( <ipv6_address> | * ) ;
transfers <integer>;
}; // may occur multiple times
servfail-ttl <duration>;
sig-signing-nodes <integer>;
sig-signing-signatures <integer>;
sig-signing-type <integer>;
sig-validity-interval <integer> [ <integer> ];
sortlist { <address_match_element>; ... };
stale-answer-client-timeout ( disabled | off | <integer> );
stale-answer-enable <boolean>;
stale-answer-ttl <duration>;
stale-cache-enable <boolean>;
stale-refresh-time <duration>;
suppress-initial-notify <boolean>; // obsolete
synth-from-dnssec <boolean>;
transfer-format ( many-answers | one-answer );
transfer-source ( <ipv4_address> | * ) ;
transfer-source-v6 ( <ipv6_address> | * ) ;
trust-anchor-telemetry <boolean>;
trust-anchors { <string> ( static-key | initial-key | static-ds | initial-ds ) <integer> <integer> <integer> <quoted_string>; ... }; // may occur multiple times
trusted-keys { <string> <integer> <integer> <integer> <quoted_string>; ... }; // may occur multiple times, deprecated
try-tcp-refresh <boolean>;
update-check-ksk <boolean>;
use-alt-transfer-source <boolean>; // deprecated
v6-bias <integer>;
validate-except { <string>; ... };
zero-no-soa-ttl <boolean>;
zero-no-soa-ttl-cache <boolean>;
zone-statistics ( full | terse | none | <boolean> );
}; // may occur multiple times
Any of these zone statements can also be set inside the view statement.
zone <string> [ <class> ] {
type primary;
allow-query { <address_match_element>; ... };
allow-query-on { <address_match_element>; ... };
allow-transfer [ port <integer> ] [ transport <string> ] { <address_match_element>; ... };
allow-update { <address_match_element>; ... };
also-notify [ port <integer> ] { ( <remote-servers> | <ipv4_address> [ port <integer> ] | <ipv6_address> [ port <integer> ] ) [ key <string> ] [ tls <string> ]; ... };
alt-transfer-source ( <ipv4_address> | * ) ; // deprecated
alt-transfer-source-v6 ( <ipv6_address> | * ) ; // deprecated
auto-dnssec ( allow | maintain | off ); // deprecated
check-dup-records ( fail | warn | ignore );
check-integrity <boolean>;
check-mx ( fail | warn | ignore );
check-mx-cname ( fail | warn | ignore );
check-names ( fail | warn | ignore );
check-sibling <boolean>;
check-spf ( warn | ignore );
check-srv-cname ( fail | warn | ignore );
check-wildcard <boolean>;
database <string>;
dialup ( notify | notify-passive | passive | refresh | <boolean> ); // deprecated
dlz <string>;
dnskey-sig-validity <integer>;
dnssec-dnskey-kskonly <boolean>;
dnssec-loadkeys-interval <integer>;
dnssec-policy <string>;
dnssec-secure-to-insecure <boolean>;
dnssec-update-mode ( maintain | no-resign );
file <quoted_string>;
forward ( first | only );
forwarders [ port <integer> ] { ( <ipv4_address> | <ipv6_address> ) [ port <integer> ]; ... };
inline-signing <boolean>;
ixfr-from-differences <boolean>;
journal <quoted_string>;
key-directory <quoted_string>;
masterfile-format ( raw | text );
masterfile-style ( full | relative );
max-ixfr-ratio ( unlimited | <percentage> );
max-journal-size ( default | unlimited | <sizeval> );
max-records <integer>;
max-transfer-idle-out <integer>;
max-transfer-time-out <integer>;
max-zone-ttl ( unlimited | <duration> );
notify ( explicit | master-only | primary-only | <boolean> );
notify-delay <integer>;
notify-source ( <ipv4_address> | * ) ;
notify-source-v6 ( <ipv6_address> | * ) ;
notify-to-soa <boolean>;
nsec3-test-zone <boolean>; // test only
parental-agents [ port <integer> ] { ( <remote-servers> | <ipv4_address> [ port <integer> ] | <ipv6_address> [ port <integer> ] ) [ key <string> ] [ tls <string> ]; ... };
parental-source ( <ipv4_address> | * ) ;
parental-source-v6 ( <ipv6_address> | * ) ;
serial-update-method ( date | increment | unixtime );
sig-signing-nodes <integer>;
sig-signing-signatures <integer>;
sig-signing-type <integer>;
sig-validity-interval <integer> [ <integer> ];
update-check-ksk <boolean>;
update-policy ( local | { ( deny | grant ) <string> ( 6to4-self | external | krb5-self | krb5-selfsub | krb5-subdomain | krb5-subdomain-self-rhs | ms-self | ms-selfsub | ms-subdomain | ms-subdomain-self-rhs | name | self | selfsub | selfwild | subdomain | tcp-self | wildcard | zonesub ) [ <string> ] <rrtypelist>; ... } );
zero-no-soa-ttl <boolean>;
zone-statistics ( full | terse | none | <boolean> );
};

zone <string> [ <class> ] {
type secondary;
allow-notify { <address_match_element>; ... };
allow-query { <address_match_element>; ... };
allow-query-on { <address_match_element>; ... };
allow-transfer [ port <integer> ] [ transport <string> ] { <address_match_element>; ... };
allow-update-forwarding { <address_match_element>; ... };
also-notify [ port <integer> ] { ( <remote-servers> | <ipv4_address> [ port <integer> ] | <ipv6_address> [ port <integer> ] ) [ key <string> ] [ tls <string> ]; ... };
alt-transfer-source ( <ipv4_address> | * ) ; // deprecated
alt-transfer-source-v6 ( <ipv6_address> | * ) ; // deprecated
auto-dnssec ( allow | maintain | off ); // deprecated
check-names ( fail | warn | ignore );
database <string>;
dialup ( notify | notify-passive | passive | refresh | <boolean> ); // deprecated
dlz <string>;
dnskey-sig-validity <integer>;
dnssec-dnskey-kskonly <boolean>;
dnssec-loadkeys-interval <integer>;
dnssec-policy <string>;
dnssec-update-mode ( maintain | no-resign );
file <quoted_string>;
forward ( first | only );
forwarders [ port <integer> ] { ( <ipv4_address> | <ipv6_address> ) [ port <integer> ]; ... };
inline-signing <boolean>;
ixfr-from-differences <boolean>;
journal <quoted_string>;
key-directory <quoted_string>;
masterfile-format ( raw | text );
masterfile-style ( full | relative );
max-ixfr-ratio ( unlimited | <percentage> );
max-journal-size ( default | unlimited | <sizeval> );
max-records <integer>;
max-refresh-time <integer>;
max-retry-time <integer>;
max-transfer-idle-'''in''' <integer>;
max-transfer-idle-out <integer>;
max-transfer-time-'''in''' <integer>;
max-transfer-time-out <integer>;
min-refresh-time <integer>;
min-retry-time <integer>;
multi-master <boolean>;
notify ( explicit | master-only | primary-only | <boolean> );
notify-delay <integer>;
notify-source ( <ipv4_address> | * ) ;
notify-source-v6 ( <ipv6_address> | * ) ;
notify-to-soa <boolean>;
nsec3-test-zone <boolean>; // test only
parental-agents [ port <integer> ] { ( <remote-servers> | <ipv4_address> [ port <integer> ] | <ipv6_address> [ port <integer> ] ) [ key <string> ] [ tls <string> ]; ... };
parental-source ( <ipv4_address> | * ) ;
parental-source-v6 ( <ipv6_address> | * ) ;
primaries [ port <integer> ] { ( <remote-servers> | <ipv4_address> [ port <integer> ] | <ipv6_address> [ port <integer> ] ) [ key <string> ] [ tls <string> ]; ... };
request-expire <boolean>;
request-ixfr <boolean>;
sig-signing-nodes <integer>;
sig-signing-signatures <integer>;
sig-signing-type <integer>;
sig-validity-interval <integer> [ <integer> ];
transfer-source ( <ipv4_address> | * ) ;
transfer-source-v6 ( <ipv6_address> | * ) ;
'''try'''-tcp-refresh <boolean>;
update-check-ksk <boolean>;
use-alt-transfer-source <boolean>; // deprecated
zero-no-soa-ttl <boolean>;
zone-statistics ( full | terse | none | <boolean> );
};

zone <string> [ <class> ] {
type mirror;
allow-notify { <address_match_element>; ... };
allow-query { <address_match_element>; ... };
allow-query-on { <address_match_element>; ... };
allow-transfer [ port <integer> ] [ transport <string> ] { <address_match_element>; ... };
allow-update-forwarding { <address_match_element>; ... };
also-notify [ port <integer> ] { ( <remote-servers> | <ipv4_address> [ port <integer> ] | <ipv6_address> [ port <integer> ] ) [ key <string> ] [ tls <string> ]; ... };
alt-transfer-source ( <ipv4_address> | * ) ; // deprecated
alt-transfer-source-v6 ( <ipv6_address> | * ) ; // deprecated
check-names ( fail | warn | ignore );
database <string>;
file <quoted_string>;
ixfr-from-differences <boolean>;
journal <quoted_string>;
masterfile-format ( raw | text );
masterfile-style ( full | relative );
max-ixfr-ratio ( unlimited | <percentage> );
max-journal-size ( default | unlimited | <sizeval> );
max-records <integer>;
max-refresh-time <integer>;
max-retry-time <integer>;
max-transfer-idle-'''in''' <integer>;
max-transfer-idle-out <integer>;
max-transfer-time-'''in''' <integer>;
max-transfer-time-out <integer>;
min-refresh-time <integer>;
min-retry-time <integer>;
multi-master <boolean>;
notify ( explicit | master-only | primary-only | <boolean> );
notify-delay <integer>;
notify-source ( <ipv4_address> | * ) ;
notify-source-v6 ( <ipv6_address> | * ) ;
primaries [ port <integer> ] { ( <remote-servers> | <ipv4_address> [ port <integer> ] | <ipv6_address> [ port <integer> ] ) [ key <string> ] [ tls <string> ]; ... };
request-expire <boolean>;
request-ixfr <boolean>;
transfer-source ( <ipv4_address> | * ) ;
transfer-source-v6 ( <ipv6_address> | * ) ;
'''try'''-tcp-refresh <boolean>;
use-alt-transfer-source <boolean>; // deprecated
zero-no-soa-ttl <boolean>;
zone-statistics ( full | terse | none | <boolean> );
};

zone <string> [ <class> ] {
type forward;
delegation-only <boolean>; // deprecated
forward ( first | only );
forwarders [ port <integer> ] { ( <ipv4_address> | <ipv6_address> ) [ port <integer> ]; ... };
};

zone <string> [ <class> ] {
type hint;
check-names ( fail | warn | ignore );
delegation-only <boolean>; // deprecated
file <quoted_string>;
};

zone <string> [ <class> ] {
type redirect;
allow-query { <address_match_element>; ... };
allow-query-on { <address_match_element>; ... };
dlz <string>;
file <quoted_string>;
masterfile-format ( raw | text );
masterfile-style ( full | relative );
max-records <integer>;
max-zone-ttl ( unlimited | <duration> );
primaries [ port <integer> ] { ( <remote-servers> | <ipv4_address> [ port <integer> ] | <ipv6_address> [ port <integer> ] ) [ key <string> ] [ tls <string> ]; ... };
zone-statistics ( full | terse | none | <boolean> );
};

zone <string> [ <class> ] {
type static-stub;
allow-query { <address_match_element>; ... };
allow-query-on { <address_match_element>; ... };
forward ( first | only );
forwarders [ port <integer> ] { ( <ipv4_address> | <ipv6_address> ) [ port <integer> ]; ... };
max-records <integer>;
server-addresses { ( <ipv4_address> | <ipv6_address> ); ... };
server-names { <string>; ... };
zone-statistics ( full | terse | none | <boolean> );
};

zone <string> [ <class> ] {
type stub;
allow-query { <address_match_element>; ... };
allow-query-on { <address_match_element>; ... };
check-names ( fail | warn | ignore );
database <string>;
delegation-only <boolean>; // deprecated
dialup ( notify | notify-passive | passive | refresh | <boolean> ); // deprecated
file <quoted_string>;
forward ( first | only );
forwarders [ port <integer> ] { ( <ipv4_address> | <ipv6_address> ) [ port <integer> ]; ... };
masterfile-format ( raw | text );
masterfile-style ( full | relative );
max-records <integer>;
max-refresh-time <integer>;
max-retry-time <integer>;
max-transfer-idle-'''in''' <integer>;
max-transfer-time-'''in''' <integer>;
min-refresh-time <integer>;
min-retry-time <integer>;
multi-master <boolean>;
primaries [ port <integer> ] { ( <remote-servers> | <ipv4_address> [ port <integer> ] | <ipv6_address> [ port <integer> ] ) [ key <string> ] [ tls <string> ]; ... };
transfer-source ( <ipv4_address> | * ) ;
transfer-source-v6 ( <ipv6_address> | * ) ;
use-alt-transfer-source <boolean>; // deprecated
zone-statistics ( full | terse | none | <boolean> );
};

zone <string> [ <class> ] {
type delegation-only;
};

zone <string> [ <class> ] {
'''in'''-view <string>;
};

=== Files ===
<code>/usr/local/etc/named.conf</code>

=== See Also ===
<code>named(8)</code>, <code>named-checkconf(8)</code>, <code>rndc(8)</code>, <code>rndc-confgen(8)</code>, <code>tsig-keygen(8)</code>, BIND 9 Administrator Reference Manual.

BIND 9 ARM Manual Page v9.18.26

2024-05-08T03:56:01Z

Admin：创建页面，内容为“* arpaname - translate IP addresses to the corresponding ARPA names * ddns-confgen - TSIG key generation tool * delv - DNS lookup and validation utility * dig - DNS lookup utility * dnssec-cds - change DS records for a child zone based on CDS/CDNSKEY * dnssec-dsfromkey - DNSSEC DS RR generation tool * dnssec-importkey - import DNSKEY records from external systems so they can be managed * dnssec-keyfromlabel - DNSSEC key generation tool * dnssec-keygen: DNSSEC k…”

* arpaname - translate IP addresses to the corresponding ARPA names
* ddns-confgen - TSIG key generation tool
* delv - DNS lookup and validation utility
* dig - DNS lookup utility
* dnssec-cds - change DS records for a child zone based on CDS/CDNSKEY
* dnssec-dsfromkey - DNSSEC DS RR generation tool
* dnssec-importkey - import DNSKEY records from external systems so they can be managed
* dnssec-keyfromlabel - DNSSEC key generation tool
* dnssec-keygen: DNSSEC key generation tool
* dnssec-revoke - set the REVOKED bit on a DNSSEC key
* dnssec-settime: set the key timing metadata for a DNSSEC key
* dnssec-signzone - DNSSEC zone signing tool
* dnssec-verify - DNSSEC zone verification tool
* dnstap-read - print dnstap data in human-readable form
* filter-aaaa.so - filter AAAA in DNS responses when A is present
* host - DNS lookup utility
* mdig - DNS pipelined lookup utility
* named-checkconf - named configuration file syntax checking tool
* named-checkzone - zone file validation tool
* named-compilezone - zone file converting tool
* named-journalprint - print zone journal in human-readable form
* named-nzd2nzf - convert an NZD database to NZF text format
* named-rrchecker - syntax checker for individual DNS resource records
* [[BIND 9 ARM Manual Page v9.18.26-Named.conf - configuration file for named|named.conf - configuration file for '''named''']]
* [[BIND 9 ARM Manual Page v9.18.26-Named - Internet domain name server|named - Internet domain name server]]
* nsec3hash - generate NSEC3 hash
* nslookup - query Internet name servers interactively
* nsupdate - dynamic DNS update utility
* rndc-confgen - rndc key generation tool
* rndc.conf - rndc configuration file
* rndc - name server control utility
* tsig-keygen - TSIG key generation tool

BIND

2024-05-08T03:53:10Z

Admin：

[[BIND 9 Release Note]]

[[BIND 9 Administrator Reference Manual]]

[[BIND 9 ARM Manual Page v9.18.26]]

BIND v9 ARM Manual Page v9.18.26

2024-05-08T03:52:16Z

Admin：

* [[BIND v9 ARM Manual Page v9.18.26-Arpaname - translate IP addresses to the corresponding ARPA names|arpaname - translate IP addresses to the corresponding ARPA names]]
* [[ddns-confgen - TSIG key generation tool]]
* [[delv - DNS lookup and validation utility]]
* [[BIND v9 ARM Manual Page v9.18.26-Dig - DNS lookup utility|dig - DNS lookup utility]]
* [[dnssec-cds - change DS records for a child zone based on CDS/CDNSKEY]]
* [[BIND v9 ARM Manual Page v9.18.26-Dnssec-dsfromkey - DNSSEC DS RR generation tool|dnssec-dsfromkey - DNSSEC DS RR generation tool]]
* dnssec-importkey - import DNSKEY records from external systems so they can be managed
* dnssec-keyfromlabel - DNSSEC key generation tool
* dnssec-keygen: DNSSEC key generation tool
* dnssec-revoke - set the REVOKED bit on a DNSSEC key
* dnssec-settime: set the key timing metadata for a DNSSEC key
* dnssec-signzone - DNSSEC zone signing tool
* dnssec-verify - DNSSEC zone verification tool
* dnstap-read - print dnstap data in human-readable form
* filter-aaaa.so - filter AAAA in DNS responses when A is present
* host - DNS lookup utility
* mdig - DNS pipelined lookup utility
* named-checkconf - named configuration file syntax checking tool
* named-checkzone - zone file validation tool
* named-compilezone - zone file converting tool
* named-journalprint - print zone journal in human-readable form
* named-nzd2nzf - convert an NZD database to NZF text format
* named-rrchecker - syntax checker for individual DNS resource records
* [[BIND v9 ARM Manual Page v9.18.26 - Named.conf - configuration file for named|named.conf - configuration file for '''named''']]
* [[BIND v9 ARM Manual Page v9.18.26-Named - Internet domain name server|named - Internet domain name server]]
* nsec3hash - generate NSEC3 hash
* nslookup - query Internet name servers interactively
* nsupdate - dynamic DNS update utility
* rndc-confgen - rndc key generation tool
* rndc.conf - rndc configuration file
* rndc - name server control utility
* tsig-keygen - TSIG key generation tool

BIND v9 ARM Manual Page v9.18.26-Named - Internet domain name server

2024-05-08T03:51:14Z

Admin：创建页面，内容为“ == named - Internet domain name server == === Synopsis === '''named''' [ ['''-4'''] | ['''-6'''] ] ['''-c''' config-file] ['''-C'''] ['''-d''' debug-level] ['''-D''' string] ['''-E''' engine-name] ['''-f'''] ['''-g'''] ['''-L''' logfile] ['''-M''' option] ['''-m''' flag] ['''-n''' #cpus] ['''-p''' port] ['''-s'''] ['''-t''' directory] ['''-U''' #listeners] ['''-u''' user] ['''-v'''] ['''-V'''] ['''-X''' lock-file] === Description === '''named''' is…”

== named - Internet domain name server ==

=== Synopsis ===
'''named''' [ ['''-4'''] | ['''-6'''] ] ['''-c''' config-file] ['''-C'''] ['''-d''' debug-level] ['''-D''' string] ['''-E''' engine-name] ['''-f'''] ['''-g'''] ['''-L''' logfile] ['''-M''' option] ['''-m''' flag] ['''-n''' #cpus] ['''-p''' port] ['''-s'''] ['''-t''' directory] ['''-U''' #listeners] ['''-u''' user] ['''-v'''] ['''-V'''] ['''-X''' lock-file]

=== Description ===
'''named''' is a Domain Name System (DNS) server, part of the BIND 9 distribution from ISC. For more information on the DNS, see '''<nowiki>RFC 1033</nowiki>''', '''<nowiki>RFC 1034</nowiki>''', and '''<nowiki>RFC 1035</nowiki>'''.

When invoked without arguments, '''named''' reads the default configuration file <code>/usr/local/etc/named.conf</code>, reads any initial data, and listens for queries.

=== Options ===

; -4
: This option tells '''named''' to use only IPv4, even if the host machine is capable of IPv6. <code>-4</code> and <code>-6</code> are mutually exclusive.

; -6
: This option tells '''named''' to use only IPv6, even if the host machine is capable of IPv4. <code>-4</code> and <code>-6</code> are mutually exclusive.

; -c config-file
: This option tells '''named''' to use <code>config-file</code> as its configuration file instead of the default, <code>/usr/local/etc/named.conf</code>. To ensure that the configuration file can be reloaded after the server has changed its working directory due to to a possible <code>directory</code> option in the configuration file, <code>config-file</code> should be an absolute pathname.

; -C
: This option prints out the default built-in configuration and exits. NOTE: This is for debugging purposes only and is not an accurate representation of the actual configuration used by <code>named</code> at runtime.

; -d debug-level
: This option sets the daemon’s debug level to <code>debug-level</code>. Debugging traces from '''named''' become more verbose as the debug level increases.

; -D string
: This option specifies a string that is used to identify a instance of '''named''' in a process listing. The contents of <code>string</code> are not examined.

; -E engine-name
: When applicable, this option specifies the hardware to use for cryptographic operations, such as a secure key store used for signing. When BIND 9 is built with OpenSSL, this needs to be set to the OpenSSL engine identifier that drives the cryptographic accelerator or hardware service module (usually <code>pkcs11</code>).

; -f
: This option runs the server in the foreground (i.e., do not daemonize).

; -g
: This option runs the server in the foreground and forces all logging to <code>stderr</code>.

; -L logfile
: This option sets the log to the file <code>logfile</code> by default, instead of the system log.

; -M option
: This option sets the default (comma-separated) memory context options. The possible flags are:
:* <code>fill</code>: fill blocks of memory with tag values when they are allocated or freed, to assist debugging of memory problems; this is the implicit default if '''named''' has been compiled with <code>--enable-developer</code>.
:* <code>nofill</code>: disable the behavior enabled by <code>fill</code>; this is the implicit default unless '''named''' has been compiled with <code>--enable-developer</code>.

; -m flag
: This option turns on memory usage debugging flags. Possible flags are <code>usage</code>, <code>trace</code>, <code>record</code>, <code>size</code>, and <code>mctx</code>. These correspond to the <code>ISC_MEM_DEBUGXXXX</code> flags described in <code><isc/mem.h></code>.

; -n #cpus
: This option creates <code>#cpus</code> worker threads to take advantage of multiple CPUs. If not specified, '''named''' tries to determine the number of CPUs present and creates one thread per CPU. If it is unable to determine the number of CPUs, a single worker thread is created.

; -p value
: This option specifies the port(s) on which the server will listen for queries. If <code>value</code> is of the form <code><portnum></code> or <code>dns=<portnum></code>, the server will listen for DNS queries on <code>portnum</code>; if not not specified, the default is port 53. If <code>value</code> is of the form <code>tls=<portnum></code>, the server will listen for TLS queries on <code>portnum</code>; the default is 853. If <code>value</code> is of the form <code>https=<portnum></code>, the server will listen for HTTPS queries on <code>portnum</code>; the default is 443. If <code>value</code> is of the form <code>http=<portnum></code>, the server will listen for HTTP queries on <code>portnum</code>; the default is 80.

; -s
: This option writes memory usage statistics to <code>stdout</code> on exit.

Note

This option is mainly of interest to BIND 9 developers and may be removed or changed in a future release.

; -S #max-socks
: This option is deprecated and no longer has any function.

Warning

This option should be unnecessary for the vast majority of users. The use of this option could even be harmful, because the specified value may exceed the limitation of the underlying system API. It is therefore set only when the default configuration causes exhaustion of file descriptors and the operational environment is known to support the specified number of sockets. Note also that the actual maximum number is normally slightly fewer than the specified value, because '''named''' reserves some file descriptors for its internal use.

; -t directory
: This option tells '''named''' to chroot to <code>directory</code> after processing the command-line arguments, but before reading the configuration file.

Warning

This option should be used in conjunction with the <code>-u</code> option, as chrooting a process running as root doesn’t enhance security on most systems; the way <code>chroot</code> is defined allows a process with root privileges to escape a chroot jail.

; -U #listeners
: This option tells '''named''' the number of <code>#listeners</code> worker threads to listen on, for incoming UDP packets on each address. If not specified, '''named''' calculates a default value based on the number of detected CPUs: 1 for 1 CPU, and the number of detected CPUs minus one for machines with more than 1 CPU. This cannot be increased to a value higher than the number of CPUs. If <code>-n</code> has been set to a higher value than the number of detected CPUs, then <code>-U</code> may be increased as high as that value, but no higher.

; -u user
: This option sets the setuid to <code>user</code> after completing privileged operations, such as creating sockets that listen on privileged ports.

Note

On Linux, '''named''' uses the kernel’s capability mechanism to drop all root privileges except the ability to <code>bind</code> to a privileged port and set process resource limits. Unfortunately, this means that the <code>-u</code> option only works when '''named''' is run on kernel 2.2.18 or later, or kernel 2.3.99-pre3 or later, since previous kernels did not allow privileges to be retained after <code>setuid</code>.

; -v
: This option reports the version number and exits.

; -V
: This option reports the version number, build options, supported cryptographics algorithms, and exits.

; -X lock-file
: This option acquires a lock on the specified file at runtime; this helps to prevent duplicate '''named''' instances from running simultaneously. Use of this option overrides the <code>lock-file</code> option in <code>named.conf</code>. If set to <code>none</code>, the lock file check is disabled.

=== Signals ===
In routine operation, signals should not be used to control the nameserver; <code>rndc</code> should be used instead.

; SIGHUP
: This signal forces a reload of the server.
; SIGINT, SIGTERM
: These signals shut down the server.

The result of sending any other signals to the server is undefined.

=== Configuration ===
The '''named''' configuration file is too complex to describe in detail here. A complete description is provided in the BIND 9 Administrator Reference Manual.

'''named''' inherits the <code>umask</code> (file creation mode mask) from the parent process. If files created by '''named''', such as journal files, need to have custom permissions, the <code>umask</code> should be set explicitly in the script used to start the '''named''' process.

=== Files ===

; <code>/usr/local/etc/named.conf</code>
: The default configuration file.
; <code>/usr/local/var/run/named.pid</code>
: The default process-id file.

=== See Also ===
'''<nowiki>RFC 1033</nowiki>''', '''<nowiki>RFC 1034</nowiki>''', '''<nowiki>RFC 1035</nowiki>''', <code>named-checkconf(8)</code>, <code>named-checkzone(8)</code>, <code>rndc(8)</code>, <code>named.conf(5)</code>, BIND 9 Administrator Reference Manual.

BIND v9 ARM Manual Page v9.18.26

2024-05-08T03:50:37Z

Admin：

* [[BIND v9 ARM Manual Page v9.18.26-Arpaname - translate IP addresses to the corresponding ARPA names|arpaname - translate IP addresses to the corresponding ARPA names]]
* [[ddns-confgen - TSIG key generation tool]]
* [[delv - DNS lookup and validation utility]]
* [[BIND v9 ARM Manual Page v9.18.26-Dig - DNS lookup utility|dig - DNS lookup utility]]
* [[dnssec-cds - change DS records for a child zone based on CDS/CDNSKEY]]
* dnssec-dsfromkey - DNSSEC DS RR generation tool
* dnssec-importkey - import DNSKEY records from external systems so they can be managed
* dnssec-keyfromlabel - DNSSEC key generation tool
* dnssec-keygen: DNSSEC key generation tool
* dnssec-revoke - set the REVOKED bit on a DNSSEC key
* dnssec-settime: set the key timing metadata for a DNSSEC key
* dnssec-signzone - DNSSEC zone signing tool
* dnssec-verify - DNSSEC zone verification tool
* dnstap-read - print dnstap data in human-readable form
* filter-aaaa.so - filter AAAA in DNS responses when A is present
* host - DNS lookup utility
* mdig - DNS pipelined lookup utility
* named-checkconf - named configuration file syntax checking tool
* named-checkzone - zone file validation tool
* named-compilezone - zone file converting tool
* named-journalprint - print zone journal in human-readable form
* named-nzd2nzf - convert an NZD database to NZF text format
* named-rrchecker - syntax checker for individual DNS resource records
* [[BIND v9 ARM Manual Page v9.18.26 - Named.conf - configuration file for named|named.conf - configuration file for '''named''']]
* [[BIND v9 ARM Manual Page v9.18.26-Named - Internet domain name server|named - Internet domain name server]]
* nsec3hash - generate NSEC3 hash
* nslookup - query Internet name servers interactively
* nsupdate - dynamic DNS update utility
* rndc-confgen - rndc key generation tool
* rndc.conf - rndc configuration file
* rndc - name server control utility
* tsig-keygen - TSIG key generation tool

BIND v9 ARM Manual Page v9.18.26

2024-05-08T03:50:09Z

Admin：

* [[arpaname - translate IP addresses to the corresponding ARPA names]]
* [[ddns-confgen - TSIG key generation tool]]
* [[delv - DNS lookup and validation utility]]
* [[BIND v9 ARM Manual Page v9.18.26-Dig - DNS lookup utility|dig - DNS lookup utility]]
* [[dnssec-cds - change DS records for a child zone based on CDS/CDNSKEY]]
* dnssec-dsfromkey - DNSSEC DS RR generation tool
* dnssec-importkey - import DNSKEY records from external systems so they can be managed
* dnssec-keyfromlabel - DNSSEC key generation tool
* dnssec-keygen: DNSSEC key generation tool
* dnssec-revoke - set the REVOKED bit on a DNSSEC key
* dnssec-settime: set the key timing metadata for a DNSSEC key
* dnssec-signzone - DNSSEC zone signing tool
* dnssec-verify - DNSSEC zone verification tool
* dnstap-read - print dnstap data in human-readable form
* filter-aaaa.so - filter AAAA in DNS responses when A is present
* host - DNS lookup utility
* mdig - DNS pipelined lookup utility
* named-checkconf - named configuration file syntax checking tool
* named-checkzone - zone file validation tool
* named-compilezone - zone file converting tool
* named-journalprint - print zone journal in human-readable form
* named-nzd2nzf - convert an NZD database to NZF text format
* named-rrchecker - syntax checker for individual DNS resource records
* [[BIND v9 ARM Manual Page v9.18.26 - Named.conf - configuration file for named|named.conf - configuration file for '''named''']]
* named - Internet domain name server
* nsec3hash - generate NSEC3 hash
* nslookup - query Internet name servers interactively
* nsupdate - dynamic DNS update utility
* rndc-confgen - rndc key generation tool
* rndc.conf - rndc configuration file
* rndc - name server control utility
* tsig-keygen - TSIG key generation tool

BIND v9 ARM Manual Page v9.18.26

2024-05-08T03:46:23Z

Admin：

* [[arpaname - translate IP addresses to the corresponding ARPA names]]
* [[ddns-confgen - TSIG key generation tool]]
* [[delv - DNS lookup and validation utility]]
* [[dig - DNS lookup utility]]
* [[dnssec-cds - change DS records for a child zone based on CDS/CDNSKEY]]
* dnssec-dsfromkey - DNSSEC DS RR generation tool
* dnssec-importkey - import DNSKEY records from external systems so they can be managed
* dnssec-keyfromlabel - DNSSEC key generation tool
* dnssec-keygen: DNSSEC key generation tool
* dnssec-revoke - set the REVOKED bit on a DNSSEC key
* dnssec-settime: set the key timing metadata for a DNSSEC key
* dnssec-signzone - DNSSEC zone signing tool
* dnssec-verify - DNSSEC zone verification tool
* dnstap-read - print dnstap data in human-readable form
* filter-aaaa.so - filter AAAA in DNS responses when A is present
* host - DNS lookup utility
* mdig - DNS pipelined lookup utility
* named-checkconf - named configuration file syntax checking tool
* named-checkzone - zone file validation tool
* named-compilezone - zone file converting tool
* named-journalprint - print zone journal in human-readable form
* named-nzd2nzf - convert an NZD database to NZF text format
* named-rrchecker - syntax checker for individual DNS resource records
* [[BIND v9 ARM Manual Page v9.18.26 - Named.conf - configuration file for named|named.conf - configuration file for '''named''']]
* named - Internet domain name server
* nsec3hash - generate NSEC3 hash
* nslookup - query Internet name servers interactively
* nsupdate - dynamic DNS update utility
* rndc-confgen - rndc key generation tool
* rndc.conf - rndc configuration file
* rndc - name server control utility
* tsig-keygen - TSIG key generation tool

Dig - DNS lookup utility

2024-05-08T03:45:15Z

Admin：创建页面，内容为“ == dig - DNS lookup utility == === Synopsis === '''dig''' [@server] ['''-b''' address] ['''-c''' class] ['''-f''' filename] ['''-k''' filename] ['''-m'''] ['''-p''' port#] ['''-q''' name] ['''-t''' type] ['''-v'''] ['''-x''' addr] ['''-y''' [hmac:]name:key] [ ['''-4'''] | ['''-6'''] ] [name] [type] [class] [queryopt…] '''dig''' ['''-h'''] '''dig''' [global-queryopt…] [query…] === Description === '''dig''' is a flexible tool for interrogating…”

== dig - DNS lookup utility ==

=== Synopsis ===
'''dig''' [@server] ['''-b''' address] ['''-c''' class] ['''-f''' filename] ['''-k''' filename] ['''-m'''] ['''-p''' port#] ['''-q''' name] ['''-t''' type] ['''-v'''] ['''-x''' addr] ['''-y''' [hmac:]name:key] [ ['''-4'''] | ['''-6'''] ] [name] [type] [class] [queryopt…]

'''dig''' ['''-h''']

'''dig''' [global-queryopt…] [query…]

=== Description ===
'''dig''' is a flexible tool for interrogating DNS name servers. It performs DNS lookups and displays the answers that are returned from the name server(s) that were queried. Most DNS administrators use '''dig''' to troubleshoot DNS problems because of its flexibility, ease of use, and clarity of output. Other lookup tools tend to have less functionality than '''dig'''.

Although '''dig''' is normally used with command-line arguments, it also has a batch mode of operation for reading lookup requests from a file. A brief summary of its command-line arguments and options is printed when the <code>-h</code> option is given. The BIND 9 implementation of '''dig''' allows multiple lookups to be issued from the command line.

Unless it is told to query a specific name server, '''dig''' tries each of the servers listed in <code>/etc/resolv.conf</code>. If no usable server addresses are found, '''dig''' sends the query to the local host.

When no command-line arguments or options are given, '''dig''' performs an NS query for “.” (the root).

It is possible to set per-user defaults for '''dig''' via <code>${HOME}/.digrc</code>. This file is read and any options in it are applied before the command-line arguments. The <code>-r</code> option disables this feature, for scripts that need predictable behavior.

The IN and CH class names overlap with the IN and CH top-level domain names. Either use the <code>-t</code> and <code>-c</code> options to specify the type and class, use the <code>-q</code> to specify the domain name, or use “IN.” and “CH.” when looking up these top-level domains.

=== Simple Usage ===
A typical invocation of '''dig''' looks like:
dig @server name type
where:

; server
: is the name or IP address of the name server to query. This can be an IPv4 address in dotted-decimal notation or an IPv6 address in colon-delimited notation. When the supplied <code>server</code> argument is a hostname, '''dig''' resolves that name before querying that name server. If no <code>server</code> argument is provided, '''dig''' consults <code>/etc/resolv.conf</code>; if an address is found there, it queries the name server at that address. If either of the <code>-4</code> or <code>-6</code> options are in use, then only addresses for the corresponding transport are tried. If no usable addresses are found, '''dig''' sends the query to the local host. The reply from the name server that responds is displayed.

; name
: is the name of the resource record that is to be looked up.

; type
: indicates what type of query is required - ANY, A, MX, SIG, etc. <code>type</code> can be any valid query type. If no <code>type</code> argument is supplied, '''dig''' performs a lookup for an A record.

=== Options ===

; -4
: This option indicates that only IPv4 should be used.

; -6
: This option indicates that only IPv6 should be used.

; -b address[#port]
: This option sets the source IP address of the query. The <code>address</code> must be a valid address on one of the host’s network interfaces, or “0.0.0.0” or “::”. An optional port may be specified by appending <code>#port</code>.

; -c class
: This option sets the query class. The default <code>class</code> is IN; other classes are HS for Hesiod records or CH for Chaosnet records.

; -f file
: This option sets batch mode, in which '''dig''' reads a list of lookup requests to process from the given <code>file</code>. Each line in the file should be organized in the same way it would be presented as a query to '''dig''' using the command-line interface.

; -h
: Print a usage summary.

; -k keyfile
: This option tells '''dig''' to sign queries using TSIG or SIG(0) using a key read from the given file. Key files can be generated using <code>tsig-keygen</code>. When using TSIG authentication with '''dig''', the name server that is queried needs to know the key and algorithm that is being used. In BIND, this is done by providing appropriate <code>key</code> and <code>server</code> statements in <code>named.conf</code> for TSIG and by looking up the KEY record in zone data for SIG(0).

; -m
: This option enables memory usage debugging.

; -p port
: This option sends the query to a non-standard port on the server, instead of the default port 53. This option is used to test a name server that has been configured to listen for queries on a non-standard port number.

; -q name
: This option specifies the domain name to query. This is useful to distinguish the <code>name</code> from other arguments.

; -r
: This option indicates that options from <code>${HOME}/.digrc</code> should not be read. This is useful for scripts that need predictable behavior.

; -t type
: This option indicates the resource record type to query, which can be any valid query type. If it is a resource record type supported in BIND 9, it can be given by the type mnemonic (such as <code>NS</code> or <code>AAAA</code>). The default query type is <code>A</code>, unless the <code>-x</code> option is supplied to indicate a reverse lookup. A zone transfer can be requested by specifying a type of AXFR. When an incremental zone transfer (IXFR) is required, set the <code>type</code> to <code>ixfr=N</code>. The incremental zone transfer contains all changes made to the zone since the serial number in the zone’s SOA record was <code>N</code>. All resource record types can be expressed as <code>TYPEnn</code>, where <code>nn</code> is the number of the type. If the resource record type is not supported in BIND 9, the result is displayed as described in '''<nowiki>RFC 3597</nowiki>'''.

; -u
: This option indicates that print query times should be provided in microseconds instead of milliseconds.

; -v
: This option prints the version number and exits.

; -x addr
: This option sets simplified reverse lookups, for mapping addresses to names. The <code>addr</code> is an IPv4 address in dotted-decimal notation, or a colon-delimited IPv6 address. When the <code>-x</code> option is used, there is no need to provide the <code>name</code>, <code>class</code>, and <code>type</code> arguments. '''dig''' automatically performs a lookup for a name like <code>94.2.0.192.in-addr.arpa</code> and sets the query type and class to PTR and IN respectively. IPv6 addresses are looked up using nibble format under the IP6.ARPA domain.

; <nowiki>-y [hmac:]keyname:secret</nowiki>
: This option signs queries using TSIG with the given authentication key. <code>keyname</code> is the name of the key, and <code>secret</code> is the base64-encoded shared secret. <code>hmac</code> is the name of the key algorithm; valid choices are <code>hmac-md5</code>, <code>hmac-sha1</code>, <code>hmac-sha224</code>, <code>hmac-sha256</code>, <code>hmac-sha384</code>, or <code>hmac-sha512</code>. If <code>hmac</code> is not specified, the default is <code>hmac-md5</code>; if MD5 was disabled, the default is <code>hmac-sha256</code>.

Note

Only the <code>-k</code> option should be used, rather than the <code>-y</code> option, because with <code>-y</code> the shared secret is supplied as a command-line argument in clear text. This may be visible in the output from <code>ps1</code> or in a history file maintained by the user’s shell.

=== Query Options ===
'''dig''' provides a number of query options which affect the way in which lookups are made and the results displayed. Some of these set or reset flag bits in the query header, some determine which sections of the answer get printed, and others determine the timeout and retry strategies.

Each query option is identified by a keyword preceded by a plus sign (<code>+</code>). Some keywords set or reset an option; these may be preceded by the string <code>no</code> to negate the meaning of that keyword. Other keywords assign values to options, like the timeout interval. They have the form <code>+keyword=value</code>. Keywords may be abbreviated, provided the abbreviation is unambiguous; for example, <code>+cd</code> is equivalent to <code>+cdflag</code>. The query options are:

; +aaflag, +noaaflag
: This option is a synonym for <code>+aaonly</code>, <code>+noaaonly</code>.

; +aaonly, +noaaonly
: This option sets the <code>aa</code> flag in the query.

; +additional, +noadditional
: This option displays [or does not display] the additional section of a reply. The default is to display it.

; +adflag, +noadflag
: This option sets [or does not set] the AD (authentic data) bit in the query. This requests the server to return whether all of the answer and authority sections have been validated as secure, according to the security policy of the server. <code>AD=1</code> indicates that all records have been validated as secure and the answer is not from a OPT-OUT range. <code>AD=0</code> indicates that some part of the answer was insecure or not validated. This bit is set by default.

; +all, +noall
: This option sets or clears all display flags.

; +answer, +noanswer
: This option displays [or does not display] the answer section of a reply. The default is to display it.

; +authority, +noauthority
: This option displays [or does not display] the authority section of a reply. The default is to display it.

; +badcookie, +nobadcookie
: This option retries the lookup with a new server cookie if a BADCOOKIE response is received.

; +besteffort, +nobesteffort
: This option attempts to display the contents of messages which are malformed. The default is to not display malformed answers.

; +bufsize[=B]
: This option sets the UDP message buffer size advertised using EDNS0 to <code>B</code> bytes. The maximum and minimum sizes of this buffer are 65535 and 0, respectively. <code>+bufsize</code> restores the default buffer size.

; +cd, +cdflag, +nocdflag
: This option sets [or does not set] the CD (checking disabled) bit in the query. This requests the server to not perform DNSSEC validation of responses.

; +class, +noclass
: This option displays [or does not display] the CLASS when printing the record.

; +cmd, +nocmd
: This option toggles the printing of the initial comment in the output, identifying the version of '''dig''' and the query options that have been applied. This option always has a global effect; it cannot be set globally and then overridden on a per-lookup basis. The default is to print this comment.

; +comments, +nocomments
: This option toggles the display of some comment lines in the output, with information about the packet header and OPT pseudosection, and the names of the response section. The default is to print these comments. Other types of comments in the output are not affected by this option, but can be controlled using other command-line switches. These include <code>+cmd</code>, <code>+question</code>, <code>+stats</code>, and <code>+rrcomments</code>.

; +cookie=####, +nocookie
: This option sends [or does not send] a COOKIE EDNS option, with an optional value. Replaying a COOKIE from a previous response allows the server to identify a previous client. The default is <code>+cookie</code>. <code>+cookie</code> is also set when <code>+trace</code> is set to better emulate the default queries from a nameserver.

; +crypto, +nocrypto
: This option toggles the display of cryptographic fields in DNSSEC records. The contents of these fields are unnecessary for debugging most DNSSEC validation failures and removing them makes it easier to see the common failures. The default is to display the fields. When omitted, they are replaced by the string <code>[omitted]</code> or, in the DNSKEY case, the key ID is displayed as the replacement, e.g. <code>[ key id = value ]</code>.

; +defname, +nodefname
: This option, which is deprecated, is treated as a synonym for <code>+search</code>, <code>+nosearch</code>.

; +dns64prefix, +nodns64prefix
: Lookup IPV4ONLY.ARPA AAAA and print any DNS64 prefixes found.

; +dnssec, +do, +nodnssec, +nodo
: This option requests that DNSSEC records be sent by setting the DNSSEC OK (DO) bit in the OPT record in the additional section of the query.

; +domain=somename
: This option sets the search list to contain the single domain <code>somename</code>, as if specified in a <code>domain</code> directive in <code>/etc/resolv.conf</code>, and enables search list processing as if the <code>+search</code> option were given.

; +dscp=value
: This option formerly set the DSCP value used when sending a query. It is now obsolete, and has no effect.

; +edns[=#], +noedns
: This option specifies the EDNS version to query with. Valid values are 0 to 255. Setting the EDNS version causes an EDNS query to be sent. <code>+noedns</code> clears the remembered EDNS version. EDNS is set to 0 by default.

; +ednsflags[=#], +noednsflags
: This option sets the must-be-zero EDNS flags bits (Z bits) to the specified value. Decimal, hex, and octal encodings are accepted. Setting a named flag (e.g., DO) is silently ignored. By default, no Z bits are set.

; +ednsnegotiation, +noednsnegotiation
: This option enables/disables EDNS version negotiation. By default, EDNS version negotiation is enabled.

; <nowiki>+ednsopt[=code[:value]], +noednsopt</nowiki>
: This option specifies the EDNS option with code point <code>code</code> and an optional payload of <code>value</code> as a hexadecimal string. <code>code</code> can be either an EDNS option name (for example, <code>NSID</code> or <code>ECS</code>) or an arbitrary numeric value. <code>+noednsopt</code> clears the EDNS options to be sent.

; +expire, +noexpire
: This option sends an EDNS Expire option.

; +fail, +nofail
: This option indicates that <code>named</code> should try [or not try] the next server if a SERVFAIL is received. The default is to not try the next server, which is the reverse of normal stub resolver behavior.

; +fuzztime[=value], +nofuzztime
: This option allows the signing time to be specified when generating signed messages. If a value is specified it is the seconds since 00:00:00 January 1, 1970 UTC ignoring leap seconds. If no value is specified 1646972129 (Fri 11 Mar 2022 04:15:29 UTC) is used. The default is <code>+nofuzztime</code> and the current time is used.

; +header-only, +noheader-only
: This option sends a query with a DNS header without a question section. The default is to add a question section. The query type and query name are ignored when this is set.

; +https[=value], +nohttps
: This option indicates whether to use DNS over HTTPS (DoH) when querying name servers. When this option is in use, the port number defaults to 443. The HTTP POST request mode is used when sending the query. If <code>value</code> is specified, it will be used as the HTTP endpoint in the query URI; the default is <code>/dns-query</code>. So, for example, <code>dig @example.com +https</code> will use the URI <code><nowiki>https://example.com/dns-query</nowiki></code>.

; +https-get[=value], +nohttps-get
: Similar to <code>+https</code>, except that the HTTP GET request mode is used when sending the query.

; +https-post[=value], +nohttps-post
: Same as <code>+https</code>.

; +http-plain[=value], +nohttp-plain
: Similar to <code>+https</code>, except that HTTP queries will be sent over a non-encrypted channel. When this option is in use, the port number defaults to 80 and the HTTP request mode is POST.

; +http-plain-get[=value], +nohttp-plain-get
: Similar to <code>+http-plain</code>, except that the HTTP request mode is GET.

; +http-plain-post[=value], +nohttp-plain-post
: Same as <code>+http-plain</code>.

; +identify, +noidentify
: This option shows [or does not show] the IP address and port number that supplied the answer, when the <code>+short</code> option is enabled. If short form answers are requested, the default is not to show the source address and port number of the server that provided the answer.

; +idnin, +noidnin
: This option processes [or does not process] IDN domain names on input. This requires <code>IDN SUPPORT</code> to have been enabled at compile time. The default is to process IDN input when standard output is a tty. The IDN processing on input is disabled when '''dig''' output is redirected to files, pipes, and other non-tty file descriptors.

; +idnout, +noidnout
: This option converts [or does not convert] puny code on output. This requires <code>IDN SUPPORT</code> to have been enabled at compile time. The default is to process puny code on output when standard output is a tty. The puny code processing on output is disabled when '''dig''' output is redirected to files, pipes, and other non-tty file descriptors.

; +ignore, +noignore
: This option ignores [or does not ignore] truncation in UDP responses instead of retrying with TCP. By default, TCP retries are performed.

; +keepalive, +nokeepalive
: This option sends [or does not send] an EDNS Keepalive option.

; +keepopen, +nokeepopen
: This option keeps [or does not keep] the TCP socket open between queries, and reuses it rather than creating a new TCP socket for each lookup. The default is <code>+nokeepopen</code>.

; +multiline, +nomultiline
: This option prints [or does not print] records, like the SOA records, in a verbose multi-line format with human-readable comments. The default is to print each record on a single line to facilitate machine parsing of the '''dig''' output.

; +ndots=D
: This option sets the number of dots (<code>D</code>) that must appear in <code>name</code> for it to be considered absolute. The default value is that defined using the <code>ndots</code> statement in <code>/etc/resolv.conf</code>, or 1 if no <code>ndots</code> statement is present. Names with fewer dots are interpreted as relative names, and are searched for in the domains listed in the <code>search</code> or <code>domain</code> directive in <code>/etc/resolv.conf</code> if <code>+search</code> is set.

; +nsid, +nonsid
: When enabled, this option includes an EDNS name server ID request when sending a query.

; +nssearch, +nonssearch
: When this option is set, '''dig''' attempts to find the authoritative name servers for the zone containing the name being looked up, and display the SOA record that each name server has for the zone. Addresses of servers that did not respond are also printed.

; +onesoa, +noonesoa
: When enabled, this option prints only one (starting) SOA record when performing an AXFR. The default is to print both the starting and ending SOA records.

; +opcode=value, +noopcode
: When enabled, this option sets (restores) the DNS message opcode to the specified value. The default value is QUERY (0).

; +padding=value
: This option pads the size of the query packet using the EDNS Padding option to blocks of <code>value</code> bytes. For example, <code>+padding=32</code> causes a 48-byte query to be padded to 64 bytes. The default block size is 0, which disables padding; the maximum is 512. Values are ordinarily expected to be powers of two, such as 128; however, this is not mandatory. Responses to padded queries may also be padded, but only if the query uses TCP or DNS COOKIE.

; +qid=value
: This option specifies the query ID to use when sending queries.

; +qr, +noqr
: This option toggles the display of the query message as it is sent. By default, the query is not printed.

; +question, +noquestion
: This option toggles the display of the question section of a query when an answer is returned. The default is to print the question section as a comment.

; +raflag, +noraflag
: This option sets [or does not set] the RA (Recursion Available) bit in the query. The default is <code>+noraflag</code>. This bit is ignored by the server for QUERY.

; +rdflag, +nordflag
: This option is a synonym for <code>+recurse</code>, <code>+norecurse</code>.

; +recurse, +norecurse
: This option toggles the setting of the RD (recursion desired) bit in the query. This bit is set by default, which means '''dig''' normally sends recursive queries. Recursion is automatically disabled when the <code>+nssearch</code> or <code>+trace</code> query option is used.

; +retry=T
: This option sets the number of times to retry UDP and TCP queries to server to <code>T</code> instead of the default, 2. Unlike <code>+tries</code>, this does not include the initial query.

; +rrcomments, +norrcomments
: This option toggles the display of per-record comments in the output (for example, human-readable key information about DNSKEY records). The default is not to print record comments unless multiline mode is active.

; +search, +nosearch
: This option uses [or does not use] the search list defined by the searchlist or domain directive in <code>resolv.conf</code>, if any. The search list is not used by default. <code>ndots</code> from <code>resolv.conf</code> (default 1), which may be overridden by <code>+ndots</code>, determines whether the name is treated as relative and hence whether a search is eventually performed.

; +short, +noshort
: This option toggles whether a terse answer is provided. The default is to print the answer in a verbose form. This option always has a global effect; it cannot be set globally and then overridden on a per-lookup basis.

; +showbadcookie, +noshowbadcookie
: This option toggles whether to show the message containing the BADCOOKIE rcode before retrying the request or not. The default is to not show the messages.

; +showsearch, +noshowsearch
: This option performs [or does not perform] a search showing intermediate results.

; +sigchase, +nosigchase
: This feature is now obsolete and has been removed; use <code>delv</code> instead.

; +split=W
: This option splits long hex- or base64-formatted fields in resource records into chunks of <code>W</code> characters (where <code>W</code> is rounded up to the nearest multiple of 4). <code>+nosplit</code> or <code>+split=0</code> causes fields not to be split at all. The default is 56 characters, or 44 characters when multiline mode is active.

; +stats, +nostats
: This option toggles the printing of statistics: when the query was made, the size of the reply, etc. The default behavior is to print the query statistics as a comment after each lookup.

; +subnet=addr[/prefix-length], +nosubnet
: This option sends [or does not send] an EDNS CLIENT-SUBNET option with the specified IP address or network prefix. <code>dig +subnet=0.0.0.0/0</code>, or simply <code>dig +subnet=0</code> for short, sends an EDNS CLIENT-SUBNET option with an empty address and a source prefix-length of zero, which signals a resolver that the client’s address information must ''not'' be used when resolving this query.

; +tcflag, +notcflag
: This option sets [or does not set] the TC (TrunCation) bit in the query. The default is <code>+notcflag</code>. This bit is ignored by the server for QUERY.

; +tcp, +notcp
: This option indicates whether to use TCP when querying name servers. The default behavior is to use UDP unless a type <code>any</code> or <code>ixfr=N</code> query is requested, in which case the default is TCP. AXFR queries always use TCP. To prevent retry over TCP when TC=1 is returned from a UDP query, use <code>+ignore</code>.

; +timeout=T
: This option sets the timeout for a query to <code>T</code> seconds. The default timeout is 5 seconds. An attempt to set <code>T</code> to less than 1 is silently set to 1.

; +tls, +notls
: This option indicates whether to use DNS over TLS (DoT) when querying name servers. When this option is in use, the port number defaults to 853.

; +tls-ca[=file-name], +notls-ca
: This option enables remote server TLS certificate validation for DNS transports, relying on TLS. Certificate authorities certificates are loaded from the specified PEM file (<code>file-name</code>). If the file is not specified, the default certificates from the global certificates store are used.

; +tls-certfile=file-name, +tls-keyfile=file-name, +notls-certfile, +notls-keyfile
: These options set the state of certificate-based client authentication for DNS transports, relying on TLS. Both certificate chain file and private key file are expected to be in PEM format. Both options must be specified at the same time.

; +tls-hostname=hostname, +notls-hostname
: This option makes '''dig''' use the provided hostname during remote server TLS certificate verification. Otherwise, the DNS server name is used. This option has no effect if <code>+tls-ca</code> is not specified.

; +topdown, +notopdown
: This feature is related to <code>dig +sigchase</code>, which is obsolete and has been removed. Use <code>delv</code> instead.

; +trace, +notrace
: This option toggles tracing of the delegation path from the root name servers for the name being looked up. Tracing is disabled by default. When tracing is enabled, '''dig''' makes iterative queries to resolve the name being looked up. It follows referrals from the root servers, showing the answer from each server that was used to resolve the lookup. If <code>@server</code> is also specified, it affects only the initial query for the root zone name servers. <code>+dnssec</code> is also set when <code>+trace</code> is set, to better emulate the default queries from a name server.

; +tries=T
: This option sets the number of times to try UDP and TCP queries to server to <code>T</code> instead of the default, 3. If <code>T</code> is less than or equal to zero, the number of tries is silently rounded up to 1.

; +trusted-key=####
: This option formerly specified trusted keys for use with <code>dig +sigchase</code>. This feature is now obsolete and has been removed; use <code>delv</code> instead.

; +ttlid, +nottlid
: This option displays [or does not display] the TTL when printing the record.

; +ttlunits, +nottlunits
: This option displays [or does not display] the TTL in friendly human-readable time units of <code>s</code>, <code>m</code>, <code>h</code>, <code>d</code>, and <code>w</code>, representing seconds, minutes, hours, days, and weeks. This implies <code>+ttlid</code>.

; +unknownformat, +nounknownformat
: This option prints all RDATA in unknown RR type presentation format ('''<nowiki>RFC 3597</nowiki>'''). The default is to print RDATA for known types in the type’s presentation format.

; +vc, +novc
: This option uses [or does not use] TCP when querying name servers. This alternate syntax to <code>+tcp</code> is provided for backwards compatibility. The <code>vc</code> stands for “virtual circuit.”

; +yaml, +noyaml
: When enabled, this option prints the responses (and, if <code>+qr</code> is in use, also the outgoing queries) in a detailed YAML format.

; +zflag, +nozflag
: This option sets [or does not set] the last unassigned DNS header flag in a DNS query. This flag is off by default.

=== Multiple Queries ===
The BIND 9 implementation of '''dig''' supports specifying multiple queries on the command line (in addition to supporting the <code>-f</code> batch file option). Each of those queries can be supplied with its own set of flags, options, and query options.

In this case, each <code>query</code> argument represents an individual query in the command-line syntax described above. Each consists of any of the standard options and flags, the name to be looked up, an optional query type and class, and any query options that should be applied to that query.

A global set of query options, which should be applied to all queries, can also be supplied. These global query options must precede the first tuple of name, class, type, options, flags, and query options supplied on the command line. Any global query options (except <code>+cmd</code> and <code>+short</code> options) can be overridden by a query-specific set of query options. For example:
dig +qr www.isc.org any -x 127.0.0.1 isc.org ns +noqr
shows how '''dig''' can be used from the command line to make three lookups: an ANY query for <code>www.isc.org</code>, a reverse lookup of 127.0.0.1, and a query for the NS records of <code>isc.org</code>. A global query option of <code>+qr</code> is applied, so that '''dig''' shows the initial query it made for each lookup. The final query has a local query option of <code>+noqr</code> which means that '''dig''' does not print the initial query when it looks up the NS records for <code>isc.org</code>.

=== IDN Support ===
If '''dig''' has been built with IDN (internationalized domain name) support, it can accept and display non-ASCII domain names. '''dig''' appropriately converts character encoding of a domain name before sending a request to a DNS server or displaying a reply from the server. To turn off IDN support, use the parameters <code>+idnin</code> and <code>+idnout</code>, or define the <code>IDN_DISABLE</code> environment variable.

=== Return Codes ===
'''dig''' return codes are:

; <code>0</code>
: DNS response received, including NXDOMAIN status
; <code>1</code>
: Usage error
; <code>8</code>
: Couldn’t open batch file
; <code>9</code>
: No reply from server
; <code>10</code>
: Internal error

=== Files ===
<code>/etc/resolv.conf</code>

<code>${HOME}/.digrc</code>

=== See Also ===
<code>delv(1)</code>, <code>host(1)</code>, <code>named(8)</code>, <code>dnssec-keygen(8)</code>, '''<nowiki>RFC 1035</nowiki>'''.

=== Bugs ===
There are probably too many query options.

BIND v9 ARM Manual Page v9.18.26

2024-05-08T03:42:41Z

* [[arpaname - translate IP addresses to the corresponding ARPA names]]
* [[ddns-confgen - TSIG key generation tool]]
* [[delv - DNS lookup and validation utility]]
* [[dig - DNS lookup utility]]
* [[dnssec-cds - change DS records for a child zone based on CDS/CDNSKEY]]
* dnssec-dsfromkey - DNSSEC DS RR generation tool
* dnssec-importkey - import DNSKEY records from external systems so they can be managed
* dnssec-keyfromlabel - DNSSEC key generation tool
* dnssec-keygen: DNSSEC key generation tool
* dnssec-revoke - set the REVOKED bit on a DNSSEC key
* dnssec-settime: set the key timing metadata for a DNSSEC key
* dnssec-signzone - DNSSEC zone signing tool
* dnssec-verify - DNSSEC zone verification tool
* dnstap-read - print dnstap data in human-readable form
* filter-aaaa.so - filter AAAA in DNS responses when A is present
* host - DNS lookup utility
* mdig - DNS pipelined lookup utility
* named-checkconf - named configuration file syntax checking tool
* named-checkzone - zone file validation tool
* named-compilezone - zone file converting tool
* named-journalprint - print zone journal in human-readable form
* named-nzd2nzf - convert an NZD database to NZF text format
* named-rrchecker - syntax checker for individual DNS resource records
* named.conf - configuration file for '''named'''
* named - Internet domain name server
* nsec3hash - generate NSEC3 hash
* nslookup - query Internet name servers interactively
* nsupdate - dynamic DNS update utility
* rndc-confgen - rndc key generation tool
* rndc.conf - rndc configuration file
* rndc - name server control utility
* tsig-keygen - TSIG key generation tool

BIND

2024-05-08T02:42:46Z

Admin：

[[BIND 9 Release Note]]

[[BIND 9 Administrator Reference Manual]]

[[BIND v9 ARM Manual Page v9.18.26]]