BIND9 -开放式Resolver

Question

我正在运行Ubuntu12.04和bind9。我的缓存仅DNS服务器实际上是一个开放的dns解析器，所以我试图纠正这一点。

我试着跟踪本指南。

named.conf

// This is the primary configuration file for the BIND DNS server named.
//
// Please read /usr/share/doc/bind9/README.Debian.gz for information on the
// structure of BIND configuration files in Debian, *BEFORE* you customize
// this configuration file.
//
// If you are just adding zones, please do that in /etc/bind/named.conf.local

include "/etc/bind/named.conf.options";
include "/etc/bind/named.conf.local";
#include "/etc/bind/named.conf.default-zones";

named.conf.local只是包含了。

    //
    // Do any local configuration here
    //

    // Consider adding the 1918 zones here, if they are not used in your
    // organization
    //include "/etc/bind/zones.rfc1918";

named.conf.options

acl "trusted" {
        127.0.0.1/32;
        X.X.192.0/20;

};

options {
        recursion no;
        additional-from-cache no;
        allow-query { none; };
        dnssec-validation auto;
        auth-nxdomain no;    # conform to RFC1035
};

view "trusted" in {
        match-clients { trusted; };
        allow-query { trusted; };
        recursion yes;
        additional-from-cache yes;
        dnssec-validation auto;
        auth-nxdomain no;    # conform to RFC1035
};

我可以在没有问题的情况下重新启动bind，也可以查询bind。然而，当我测试时，我仍然是一个开放的解析器，当我查看DNS顶部时，我所有的顶级查询都来自定义范围之外的I。所以我知道我出了点问题。

Answer 1

这就是我所用的：

options {
    directory "/var/named/master";
    allow-recursion { 127.0.0.1; x.y.z.0/19; ...; };
    allow-transfer { 127.0.0.1; x.y.z.0/19; ...;  };