如何捕获完整的DNS递归查询名称服务器路径？

Question

我想知道是否有一种方法可以捕获整个DNS递归查询路径？(即，当我的计算机上的解析器将UDP查询发送到本地DNS服务器时，服务器会在查询到达权威名称服务器之前通过一系列名称服务器。我想知道这条路径上的每台服务器。)

尝试了nslookup和各种DNS查找工具，但它们只给出了权威资源记录，而没有显示导致此结果的路由。

Answer 1

看看dns +trace吧。

$ dig +trace www.stackoverflow.com A

; <<>> DiG 9.12.0 <<>> +trace www.stackoverflow.com A
;; global options: +cmd
.           10h11m19s IN NS l.root-servers.net.
.           10h11m19s IN NS f.root-servers.net.
.           10h11m19s IN NS b.root-servers.net.
.           10h11m19s IN NS e.root-servers.net.
.           10h11m19s IN NS d.root-servers.net.
.           10h11m19s IN NS m.root-servers.net.
.           10h11m19s IN NS i.root-servers.net.
.           10h11m19s IN NS g.root-servers.net.
.           10h11m19s IN NS k.root-servers.net.
.           10h11m19s IN NS c.root-servers.net.
.           10h11m19s IN NS a.root-servers.net.
.           10h11m19s IN NS h.root-servers.net.
.           10h11m19s IN NS j.root-servers.net.
.           10h11m19s IN RRSIG NS 8 0 518400 (
                20190731050000 20190718040000 59944 .
                h37qHHCpVvZ5cw5RCHQs9FiNUc6cYO0bSxDatRwZlnza
                lf7otk/DGAibKrvtmVdE7sePmdh6pA7XcaICyuWKrucG
                SJdNlnwDCSXgZGNjOQL+fI3aU1kczxbvVCpMdSOk8pWS
                eV9Iwz109qBcvDUJB8a8lYxa4Y9BZAONcnmr5yeIiQsy
                UvwWOST6f/pSTAJKMTMFkFC/O5bmi527SglJs1oVx7Oq
                MA+RYx647LF5W/nvRXlKU0FHcWy8GH2pRY3obBr6yg19
                QUHYPX+oCizP65IJDoz3h1sp902lHRDFlsILAk0m6tHK
                KV4QixZYl9l6KoI8QtHYSkOxwwX6FnF2Zw== )
;; Received 525 bytes from 9.9.9.9#53(9.9.9.9) in 79 ms

com.            2d IN NS a.gtld-servers.net.
com.            2d IN NS b.gtld-servers.net.
com.            2d IN NS c.gtld-servers.net.
com.            2d IN NS d.gtld-servers.net.
com.            2d IN NS e.gtld-servers.net.
com.            2d IN NS f.gtld-servers.net.
com.            2d IN NS g.gtld-servers.net.
com.            2d IN NS h.gtld-servers.net.
com.            2d IN NS i.gtld-servers.net.
com.            2d IN NS j.gtld-servers.net.
com.            2d IN NS k.gtld-servers.net.
com.            2d IN NS l.gtld-servers.net.
com.            2d IN NS m.gtld-servers.net.
com.            1d IN DS 30909 8 2 (
                E2D3C916F6DEEAC73294E8268FB5885044A833FC5459
                588F4A9184CFC41A5766 )
com.            1d IN RRSIG DS 8 1 86400 (
                20190731050000 20190718040000 59944 .
                hmwZHci5TxM6wPVGdaDRKJ5w5554UbLN1cc/W/5Ksb1/
                lZDMmVQKaGPYUP1qss6UqMqkXSbyx2sz5aQbukBQOlkK
                PwG6xFdzjBWw3yNxNQM6/0npP64/EzJ0dBU0qvTfxIeE
                TMSuRtbcPFMsX4PtXlZcsEsnn9xg5uwE1n5fBguGRsOL
                qiMJTpHiv4iq44Ll5Z84D+MX9axzgijkUvY04NVL/CI3
                yN1xtujOQZUFk35XdXN/KfKMRrdLieKp7j6iS/rPp5ph
                At85ZJa0c93fDsPzyQs88qWpnpxd4iy/2e7xCCr5SLp9
                ZNUtmyxyqfnZ4wSJdOZjtZovUj4GyLUy3w== )
;; Received 1181 bytes from 193.0.14.129#53(k.root-servers.net) in 141 ms

stackoverflow.com.  2d IN NS ns-358.awsdns-44.com.
stackoverflow.com.  2d IN NS ns-1033.awsdns-01.org.
stackoverflow.com.  2d IN NS ns-cloud-e1.googledomains.com.
stackoverflow.com.  2d IN NS ns-cloud-e2.googledomains.com.
CK0POJMG874LJREF7EFN8430QVIT8BSM.com. 1d IN NSEC3 1 1 0 - (
                CK0Q1GIN43N1ARRC9OSM6QPQR81H5M9A
                NS SOA RRSIG DNSKEY NSEC3PARAM )
CK0POJMG874LJREF7EFN8430QVIT8BSM.com. 1d IN RRSIG NSEC3 8 2 86400 (
                20190722044529 20190715033529 3800 com.
                QruEtMEx3JMwz1cwK+gArQ3ZkNbCR4x+8ul54fAkec4I
                eN6LvHGTo61mDq5w/D0fzhLIhwXRtbxSpDPspvqYpEys
                6f69kM1U4NzGvTb8/iz7/b0Tes+n3i+Gx0S+/X7ajkvu
                +J6GmVpgsZPIMxpSJjGSLZXtlEB4YyPBprWZsck= )
QJLANLBLFPUKKIO73G776E7389OP43C0.com. 1d IN NSEC3 1 1 0 - (
                QJLBMGGUF1TGTFH7U479EFSNO84B6UPD
                NS DS RRSIG )
QJLANLBLFPUKKIO73G776E7389OP43C0.com. 1d IN RRSIG NSEC3 8 2 86400 (
                20190725050317 20190718035317 17708 com.
                UrrzTGluj/zP3D4mj/D0WIv3/JkM9XbMPtnGCamyWv3Y
                GQqb7fdUa9+DXzBjTR1XiS7AGtL5DeivPKCMU1FDHv28
                0uFdk/IAUWTGknlAalujtZWlXUSwlCEifAJrqrDK+itv
                sVtWPG1Xf4Oq0yZAcxWeiSC+SX3Tv8fR0m5jBL4= )
;; Received 771 bytes from 192.35.51.30#53(f.gtld-servers.net) in 135 ms

www.stackoverflow.com.  1h IN CNAME stackoverflow.com.
stackoverflow.com.  5m IN A 151.101.129.69
stackoverflow.com.  5m IN A 151.101.65.69
stackoverflow.com.  5m IN A 151.101.193.69
stackoverflow.com.  5m IN A 151.101.1.69
stackoverflow.com.  2d IN NS ns-1033.awsdns-01.org.
stackoverflow.com.  2d IN NS ns-358.awsdns-44.com.
stackoverflow.com.  2d IN NS ns-cloud-e1.googledomains.com.
stackoverflow.com.  2d IN NS ns-cloud-e2.googledomains.com.
;; Received 260 bytes from 205.251.193.102#53(ns-358.awsdns-44.com) in 80 ms

然后这取决于你所说的捕获到底是什么意思。您还可以：

• 运行网络嗅探器并记录所有TCP/53和UDP/53数据包
• 运行本地递归名称服务器并切换其日志记录，将您的请求指向它，并在日志文件中查看结果。