碼上快樂

相關內容    簡體    繁體

bind-chroot和dnssec技術實戰

本文轉載自   查看原文   2021-01-20 18:22   404    DNS

安裝部署bind-chroot

系統環境

服務器：騰訊雲主機，有公網IP
OS：CentOS Linux release 7.4.1708 (Core)
bind-chroot：bind-chroot-9.9.4-73.el7_6.x86_64

yum 安裝

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
 
# yum install bind-chroot -y
=============================================================================================================================================================

 Package Arch Version Repository Size
=============================================================================================================================================================

Installing:
 bind-chroot x86_64 32:9.9.4-73.el7_6 updates 88 k
Installing for dependencies:
 bind x86_64 32:9.9.4-73.el7_6 updates 1.8 M
Updating for dependencies:
 bind-libs x86_64 32:9.9.4-73.el7_6 updates 1.0 M
 bind-libs-lite x86_64 32:9.9.4-73.el7_6 updates 741 k
 bind-license noarch 32:9.9.4-73.el7_6 updates 87 k
 bind-utils x86_64 32:9.9.4-73.el7_6 updates 206 k

Transaction Summary
=============================================================================================================================================================

Install 1 Package (+1 Dependent package)
Upgrade ( 4 Dependent packages)

Installed:
 bind-chroot.x86_64 32:9.9.4-73.el7_6 


Dependency Installed:
 bind.x86_64 32:9.9.4-73.el7_6 


Dependency Updated:
 bind-libs.x86_64 32:9.9.4-73.el7_6 bind-libs-lite.x86_64 32:9.9.4-73.el7_6 bind-license.noarch 32:9.9.4-73.el7_6 bind-utils.x86_64 32:9.9.4-73.el7_6 

Complete!

配置bind-chroot

bind-chroot本質上是使用chroot方式給bind軟件換了個“根”，這時bind軟件的“根”在/var/named/chroot下，弄懂這一點，配置起來就跟BIND9沒什么區別了
把yum安裝的bind-chroot在/etc下的產生的配置文件硬鏈接到/var/named/chroot/etc下

/var/named/chroot/etc/ 
1
2
3
4
 
[root@VM_0_13_centos ~]# cd /var/named/chroot/etc/
[root@VM_0_13_centos etc]# ls /etc/named
named/ named.conf named.iscdlv.key named.rfc1912.zones named.root.key 
[root@VM_0_13_centos etc]# ln /etc/named.* .
/var/named/chroot/var/named 
1
2
3
4
5
6
7
8
9
10
11
12
 
[root@VM_0_13_centos named]# ln /var/named/named.* .
[root@VM_0_13_centos named]# mkdir data/ dynamic/ slaves/ dnssec-key/
[root@VM_0_13_centos named]# chgrp -R named *
[root@VM_0_13_centos named]# ll
drwxrwx--- 2 root named 4096 Feb 27 18:30 data
drwxr-xr-x 3 root named 4096 Feb 28 14:31 dnssec-key
drwxrwx--- 2 root named 4096 Feb 28 14:33 dynamic
-rw-r----- 2 root named 2281 May 22 2017 named.ca
-rw-r----- 2 root named 152 Dec 15 2009 named.empty
-rw-r----- 2 root named 152 Jun 21 2007 named.localhost
-rw-r----- 2 root named 168 Dec 15 2009 named.loopback
drwxrwx--- 2 root named 4096 Jan 30 01:23 slaves

/etc/named.conf主配置文件

編輯主配置文件，這里把53端口開放到公網

/etc/named.conf 
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
 
options {
 listen-on port 53 { any; };
 directory "/var/named";
 dump-file "/var/named/data/cache_dump.db";
 statistics-file "/var/named/data/named_stats.txt";
 memstatistics-file "/var/named/data/named_mem_stats.txt";
 recursing-file "/var/named/data/named.recursing";
 secroots-file "/var/named/data/named.secroots";
 allow-query { any; };

 /* 
 - If you are building an AUTHORITATIVE DNS server, do NOT enable recursion.
 - If you are building a RECURSIVE (caching) DNS server, you need to enable 
 recursion. 
 - If your recursive DNS server has a public IP address, you MUST enable access 
 control to limit queries to your legitimate users. Failing to do so will
 cause your server to become part of large scale DNS amplification 
 attacks. Implementing BCP38 within your network would greatly
 reduce such attack surface 
 */
 recursion no;

 dnssec-enable yes;
 dnssec-validation yes;
 dnssec-lookaside auto;

 /* Path to ISC DLV key */
 bindkeys-file "/etc/named.iscdlv.key";

 managed-keys-directory "/var/named/dynamic";
 
 pid-file "/run/named/named.pid";
 session-keyfile "/run/named/session.key";
};

logging {
 channel default_debug {
 file "data/named.run";
 severity dynamic;
 };
};

zone "." IN {
 type hint;
 file "named.ca";
};

include "/etc/named.rfc1912.zones";
include "/etc/named.root.key";

使用dnssec技術維護一個業務域

在公網上使用BIND9維護的業務域，最好使用dnssec技術對該域添加數字簽名
DNSSEC（DNS Security Extension）—-DNS安全擴展，主要是為了解決DNS欺騙和緩存污染問題而設計的一種安全機制。

DNSSEC技術參考文獻1
DNSSEC技術參考文獻2

打開dnssec支持選項

/etc/named.conf 
1
2
3
 
dnssec-enable yes;
dnssec-validation yes;
dnssec-lookaside auto;

配置一個業務域bkjf-inc.com

/etc/named.rfc1912.zones 
1
2
3
4
5
6
7
8
 
zone "bkjf-inc.com" IN {
 type master;
 file "bkjf-inc.com.zone";
 key-directory "dnssec-key/bkjf-inc.com";
 inline-signing yes;
 auto-dnssec maintain;
 allow-update { none; };
};

創建數字簽名證書

/var/named/chroot/var/named/dnssec-key 
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
 
[root@VM_0_13_centos dnssec-key]# mkdir bkjf-inc.com
[root@VM_0_13_centos dnssec-key]# chgrp named bkjf-inc.com
[root@VM_0_13_centos dnssec-key]# cd bkjf-inc.com
[root@VM_0_13_centos bkjf-inc.com]# dnssec-keygen -a RSASHA256 -b 1024 bkjf-inc.com
Generating key pair..................................++++++ .++++++ 
Kbkjf-inc.com.+008+53901
[root@VM_0_13_centos bkjf-inc.com]# dnssec-keygen -a RSASHA256 -b 2048 -f KSK bkjf-inc.com KSK bkjf-inc.com
Generating key pair..........................................................................................+++ ............................................
.....+++ 
Kbkjf-inc.com.+008+40759

[root@VM_0_13_centos bkjf-inc.com]# chgrp named *
[root@VM_0_13_centos bkjf-inc.com]# chmod g+r *.private
[root@VM_0_13_centos bkjf-inc.com]# ll
total 16
-rw-r--r-- 1 root named 607 Feb 28 14:10 Kbkjf-inc.com.+008+40759.key
-rw-r----- 1 root named 1776 Feb 28 14:10 Kbkjf-inc.com.+008+40759.private
-rw-r--r-- 1 root named 433 Feb 28 14:10 Kbkjf-inc.com.+008+53901.key
-rw-r----- 1 root named 1012 Feb 28 14:10 Kbkjf-inc.com.+008+53901.private

這里如果生成密鑰的速度很慢，需要yum安裝一下haveged軟件並開啟

1
 
# systemctl start haveged.service

創建區域數據庫文件

/var/named/chroot/var/named/bkjf-inc.com.zone 
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
 
[root@VM_0_13_centos named]# cat bkjf-inc.com.zone
$TTL 600 ; 10 minutes
@ IN SOA ns1.bkjf-inc.com. 87527941.qq.com. (
 2018121605 ; serial
 10800 ; refresh (3 hours)
 900 ; retry (15 minutes)
 604800 ; expire (1 week)
 86400 ; minimum (1 day)
 )
 NS ns1.bkjf-inc.com.
 NS ns2.bkjf-inc.com.
$ORIGIN bkjf-inc.com.
$TTL 60 ; 1 minute
ns1 A 192.144.198.128
ns2 A 192.144.198.128
www A 192.144.198.128
eshop CNAME www

啟動bind-chroot服務

1
 
# systemctl start named-chroot

自動生成了簽名zone

如果啟動成功且配置無誤，應該自動生成了帶簽名的zone

/var/named/chroot/var/named/ 
1
2
3
4
5
6
7
 
[root@VM_0_13_centos named]# ll
total 60
-rw-r--r-- 1 root named 507 Feb 28 14:34 bkjf-inc.com.zone
-rw-r--r-- 1 named named 512 Feb 28 14:26 bkjf-inc.com.zone.jbk
-rw-r--r-- 1 named named 742 Feb 28 14:35 bkjf-inc.com.zone.jnl
-rw-r--r-- 1 named named 4102 Feb 28 14:44 bkjf-inc.com.zone.signed
-rw-r--r-- 1 named named 7481 Feb 28 14:35 bkjf-inc.com.zone.signed.jnl

檢查簽名區需要用到完全區域傳送命令

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
 
[root@VM_0_13_centos named]# dig -t AXFR bkjf-inc.com @localhost

; <<>> DiG 9.9.4-RedHat-9.9.4-73.el7_6 <<>> -t AXFR bkjf-inc.com @localhost
;; global options: +cmd
bkjf-inc.com. 600 IN SOA ns1.bkjf-inc.com. 87527941.qq.com. 2018121608 10800 900 604800 86400
bkjf-inc.com. 86400 IN RRSIG NSEC 8 2 86400 20190330063503 20190228053503 53901 bkjf-inc.com. 0fyLJXxaDOI+RWnYjK2tGpd6WgbWmgeIADtjpPQFQLrv1X9fuDLi2MFR q0+csg5P22eVUdasKi3q5tMmFW8GZtLEBBVtOtSba3/FvtoitvyBGcG6 KJ155dPbhEFe/eR0/JhWtFsIsyj/UHtgELB4eGYJYCeEI+WzUopT7voz 4UE=
bkjf-inc.com. 86400 IN NSEC eshop.bkjf-inc.com. NS SOA RRSIG NSEC DNSKEY TYPE65534
bkjf-inc.com. 600 IN RRSIG NS 8 2 600 20190330063017 20190228053309 53901 bkjf-inc.com. Y/T0m4p0yNrJwJiHc0mjDgit/9E4h7MXPb5F2WgBd+huXYgL0pS0vOb3 c2aRvHHW/zngPjShOfy3sYY5203SzPS15tN6E/RAs36/I33sZE7jZBFo 9q0KjEdKHNsoC9XISSdbLPCX879/B1rKZcmhpPNmhpAK6P351nWWgd9L jtU=
bkjf-inc.com. 600 IN RRSIG SOA 8 2 600 20190330063503 20190228053503 53901 bkjf-inc.com. eE3nKlCmAZrjJ3DwdzPStYmrC38X6VCqCxIc6otLJDX65Uk2uSqGSPre WIu16zEsbuuxq7/38ABrupQNwkPAgaSaiLIRC/000PXzKsUPhll0xO4x u9tLg2LBRATQ+4dHpKtLsoBTX0nXVHlz09YeAAA82r5wyQye2/ebesxH +A4=
bkjf-inc.com. 0 IN RRSIG TYPE65534 8 2 0 20190330054441 20190228053309 53901 bkjf-inc.com. sEX7jpdTbUZ3hlIR2CRWHbgceAQFVOVKnVl6CXvyQhavIFjUyBMMhXTw hKYwXd2Hc0LGg9koWJqlt0oYS8YbXacKbeBUrLovmcbYP46Uhm05zaVo jswG7oYYsYDE3ekbl5ImnAEyjksSNOgk8if/WoUvXfF5QH6Rdl+6Q3qG cEI=
bkjf-inc.com. 600 IN RRSIG DNSKEY 8 2 600 20190330063309 20190228053309 53901 bkjf-inc.com. rUGjMTxmbthB6UbmemoorQOfuen8u0xeOosl7lPRNLV2Hk7KsAZzUD2/ tRAJaY9NRZ1JhZHkmX/N5hncuVpPxZnrp8UB7qOoairqgjA73IFGoT0F 00KIU0FZaqsQAbBSzpzfbwr9KVbn1hTAq6/5Q/wrWZvQOASMYrF5Xhr9 lW4=
bkjf-inc.com. 600 IN RRSIG DNSKEY 8 2 600 20190330063309 20190228053309 40759 bkjf-inc.com. lBXWXbTshdeH/oOkBGdwIspet0ABbhUZfzAXUjOP3ivCMW5sse3ZayEA qPe6mZncURqomWNA/xQKemoJJjtlAwc5F4CjmtrUierdy3EVVKS0NFnz 9L3PxiJcOxl1VVtSBX+XAOPa0xkS3cpEbFVOym4NaKsoLgcqKKBjjBu4 dhWoXoxXk7PE5fogo9/BM0heGI4XpnixUSTbucMw4bcnNYPY0qKUBs2o alt1CvrGz78oOO10//pXpw/ml89UwWo28/FDvxeuXS7soeImDRklTLlE xV/Q3//v7o73ZosAdSR+9xFdcZtVs43Jjo3Cy8WL1Zjz6BdRd59Fyu6h WghEKg==
bkjf-inc.com. 0 IN TYPE65534 \# 5 08D28D0001
bkjf-inc.com. 0 IN TYPE65534 \# 5 089F370001
bkjf-inc.com. 600 IN DNSKEY 256 3 8 AwEAAflXAWLXAVJUEj29iidwVvZALuQr03hLn1bEl81XDtD63H7wwHS9 i9fNDYL0q0FkRDkuzXEQpb3UUleu/RYtSd9w6Ads0RWNUyB6X1E4Djmv sPwFwvo570svZSVky2rjEHnySgVI2ywqhcRYLMKjxE6pXuzXrqecQcF2 qrMq2xmJ
bkjf-inc.com. 600 IN DNSKEY 257 3 8 AwEAAbxFYlbq+R8y/hGg/xL8xDBasZGYtgPOqVd3bP68p98YHsFwHyG8 u3svatzRoq8STNjKKZEluDC2bcUIn9/mRHyorTYPtwyePxPEgVE4yhBy 9xqD4ES+ty7kuHOUz/WEHdNdYRhYyHe+SGf4dHnmU49pHIBCE8xFX6fs t270webjuXs4Pt6qRlyoFC3XmpRDiMNVwtM+doUxo/MRK4mw5zTeHyyf dFLVOvE3mW/ZKgBfnrsj0zE71bnD5nTxJIjDv1bUppbiRy5RK40jPhHu zaa3quxg1yS/BceYcjJpZJUc3LS55HGzatfuK799KvukuDKf7u71ylW+ 5ynT7Sxhbt0=
bkjf-inc.com. 600 IN NS ns1.bkjf-inc.com.
bkjf-inc.com. 600 IN NS ns2.bkjf-inc.com.
eshop.bkjf-inc.com. 86400 IN RRSIG NSEC 8 3 86400 20190330063503 20190228053503 53901 bkjf-inc.com. dHM2PhYs7BVuhD//iGhcwPZGZmHDkBCfWKju6ZZlvSx3I+QmWWvVdKCj 8YCw2AkWhgARxFfRMzhxRwDjgEgHhxUr4UGPH9+kJpvGi+UpFBVoBvPw iL43qCn/4J2f6URuAY8Dcq0DFpR0QLVJgIXBZpyhUYu5hZNWI2tzfyhO GlM=
eshop.bkjf-inc.com. 86400 IN NSEC ns1.bkjf-inc.com. CNAME RRSIG NSEC
eshop.bkjf-inc.com. 60 IN RRSIG CNAME 8 3 60 20190330063503 20190228053503 53901 bkjf-inc.com. 9ONt81AjpHFrM8YwDm7pQAg62oDBgaNzdtDIqtBHt5h/BPl83fOP/dOp P0Xi+y/OsFjDzHBSBDU4sy3fJwHBqm8uuMc6m33pIZfTq15fxFXF+2hU ift1bc0b0dk/L7ANZ5haEsDcl+hSVjwru2o2ISJtvp5zySZ61pdMvA6y ktg=
eshop.bkjf-inc.com. 60 IN CNAME www.bkjf-inc.com.
ns1.bkjf-inc.com. 60 IN RRSIG A 8 3 60 20190330063017 20190228053309 53901 bkjf-inc.com. 9MUZhsTxlmn5B6QXg/iCQoFyilRh8H4OJcTgpu1KgSyMTiBoEwJGdhIx k2XimlJZr9/MrSeRbuLwMZOnwFJ7w9fcIunrYHiE1T71y0BcLnQOKaJf SkJI5VKUam80+J6unkscCj0i/Y1kXTjXWLODKsZzw4+zLz5cGJk6hvsn XP4=
ns1.bkjf-inc.com. 86400 IN RRSIG NSEC 8 3 86400 20190330063017 20190228053309 53901 bkjf-inc.com. EFeX2LsEd/flN2/5lCgKlSTtC93WH0LDw9GW1RAlLIfxFAptPsXkmy7y B0Blt7tOuaxA/cTNbnFZBnyo8G3YW90LnYagqeuNzl+90gjUxsbbhE4f pTkQkRXRsvcagYDKQjs9nkN1SAF13SagnupR8D2crHADICjy8RHjHtgA byM=
ns1.bkjf-inc.com. 86400 IN NSEC ns2.bkjf-inc.com. A RRSIG NSEC
ns1.bkjf-inc.com. 60 IN A 192.144.198.128
ns2.bkjf-inc.com. 60 IN RRSIG A 8 3 60 20190330063017 20190228053309 53901 bkjf-inc.com. N2ssp0Eh6SyHBYHskedxUpfIp29DETt2g74sCuhrXwMuwLjOdVwuB02i /LqzDLyDbVZnMZncqoQ367AV2b/ttU/FJZcHiAlI2tLRTxVuNyj/E2YN BIDAtIqueNdJzsyE7n1yz9sPcsTrOidrIqqbM3qom5tMQvdo+2jrnhR3 UoY=
ns2.bkjf-inc.com. 86400 IN RRSIG NSEC 8 3 86400 20190330063017 20190228053309 53901 bkjf-inc.com. sTTRnUQxPBbeAG0WrQpn4iK/U62D2s8umLwx8w8bx+bwxQdhR8Yyz8Ke tSelkffgctCtyUi5i7ibSTnvUJTcvOcvWWteMOQfQqXJmAngADx87cba /M+OJqRwp8tu3PEniPpTYN3msGSEFILyxLCO/2cyBzK+8jhFFKYyMOn/ ViQ=
ns2.bkjf-inc.com. 86400 IN NSEC www.bkjf-inc.com. A RRSIG NSEC
ns2.bkjf-inc.com. 60 IN A 192.144.198.128
www.bkjf-inc.com. 60 IN RRSIG A 8 3 60 20190330063017 20190228053309 53901 bkjf-inc.com. aKI5N4y6eqN/xunC7+4vYa3cSHyXcW533iGA6/q34/ahvq0sTgYN36aF oBO0t8fRvwS3chZaPxwuqbk6hGSW+tRhJ8x/Nnwtbcn004W0ZxI1k046 JW/ePLhq1Cw2GPHXJTsfCjYmAOcwssX2yUv6q9/vocXx/mipuTMljrId yhE=
www.bkjf-inc.com. 86400 IN RRSIG NSEC 8 3 86400 20190330063017 20190228053309 53901 bkjf-inc.com. 0q3C+xMKE1p586q+p8U4AHGiNjzzI899TcmL2P4x8x1B7rkc22rsakX9 AnNFAzkPOTVLr81GQtBraI1K6El2QDKcPkE9+0e+34tirpuUzVlzjYB2 f4WHGxTscdOMpCestqnmspQpmXm37+EBWS0alBBq3Db8T+F/3CSEGRS7 Ao0=
www.bkjf-inc.com. 86400 IN NSEC bkjf-inc.com. A RRSIG NSEC
www.bkjf-inc.com. 60 IN A 192.144.198.128
bkjf-inc.com. 600 IN SOA ns1.bkjf-inc.com. 87527941.qq.com. 2018121608 10800 900 604800 86400
;; Query time: 1 msec
;; SERVER: 127.0.0.1#53(127.0.0.1)
;; WHEN: Thu Feb 28 15:22:46 CST 2019
;; XFR size: 31 records (messages 1, bytes 3433)

這里看到了每個記錄都附帶了一個RRSIG記錄，說明已經進行了數字簽名

檢查本地解析

1
2
3
 
[root@VM_0_13_centos named]# dig -t A www.bkjf-inc.com @localhost +dnssec +short
192.144.198.128
A 8 3 60 20190330063017 20190228053309 53901 bkjf-inc.com. aKI5N4y6eqN/xunC7+4vYa3cSHyXcW533iGA6/q34/ahvq0sTgYN36aF oBO0t8fRvwS3chZaPxwuqbk6hGSW+tRhJ8x/Nnwtbcn004W0ZxI1k046 JW/ePLhq1Cw2GPHXJTsfCjYmAOcwssX2yUv6q9/vocXx/mipuTMljrId yhE=

DS記錄

在生成證書的目錄對ZSK執行dnssec-dsfromkey命令，得到bkjf-inc.com的DS記錄，這里我們使用比較長的那個

/var/named/chroot/var/named/dnssec-key/bkjf-inc.com 
1
2
3
 
[root@VM_0_13_centos bkjf-inc.com]#  dnssec-dsfromkey `grep -l zone-signing *key`
bkjf-inc.com. IN DS 53901 8 1 5E13F6C0ECEE84248C2543693CE7D8617920983B
bkjf-inc.com. IN DS 53901 8 2 3006068B784AFBBC67133F123A0C389514959FCB6CAB0032DB200F08E6E5C384

其中：

  • 53901：關鍵標簽，用於標識域名的DNSSEC記錄，一個小於65535的整數值
  • 8：生成簽名的加密算法，8對應RSA/SHA-256
  • 2：構建摘要的加密算法，2對應SHA-256
  • 最后一段：摘要值，就是DS記錄值

參考萬網（阿里雲）上關於dnssec配置的文檔：參考文檔

DS記錄需要通過運營商提交到上級DNS的信任錨中，這里是通過萬網的配置頁面，提交到.com域

注意：要在阿里雲上將該域名的dns服務器指向自定義DNS服務器：參考文檔

后續維護

dnssec需要定期輪轉，所以需要經常變更簽名，其中

  • ZSK輪轉

    建議每年輪轉

  • KSK輪轉

    建議更新ssl證書后盡快輪轉？

輪轉方法：

  • ZSK(zone-signing key)

    /var/named/chroot/var/named/dnssec-key/bkjf-inc.com 
    1
    2
    3
    4
    5
    		 
    $ cd /var/named/chroot/var/named/dnssec-key/bkjf-inc.com
    $ dnssec-settime -I yyyy0101 -D yyyy0201 Kbkjf-inc.com.+008+53901
    $ dnssec-keygen -S Kbkjf-inc.com.+008+53901
    $ chgrp bind *
    $ chmod g+r *.private

  • KSK輪轉(key-signing key)

    /var/named/chroot/var/named/dnssec-key/bkjf-inc.com 
    1
    2
    3
    4
    5
    		 
    $ cd /var/named/chroot/var/named/dnssec-key/bkjf-inc.com
    $ dnssec-settime -I yyyy0101 -D yyyy0201 Kbkjf-inc.com.+008+40759
    $ dnssec-keygen -S Kbkjf-inc.com.+008+40759
    $ chgrp bind *
    $ chmod g+r *.private

注意：KSK輪轉需要同步在萬網上更新DS記錄

在任意客戶端驗證解析

1
2
3
4
5
6
7
 
#dig -t A www.bkjf-inc.com @8.8.8.8 +dnssec +short
192.144.198.128
A 8 3 60 20190330063017 20190228053309 53901 bkjf-inc.com. aKI5N4y6eqN/xunC7+4vYa3cSHyXcW533iGA6/q34/ahvq0sTgYN36aF oBO0t8fRvwS3chZaPxwuqbk6hGSW+tRhJ8x/Nnwtbcn004W0ZxI1k046 JW/ePLhq1Cw2GPHXJTsfCjYmAOcwssX2yUv6q9/vocXx/mipuTMljrId yhE=

#dig CNAME eshop.bkjf-inc.com @8.8.8.8 +dnssec +short
www.bkjf-inc.com.
CNAME 8 3 60 20190330063503 20190228053503 53901 bkjf-inc.com. 9ONt81AjpHFrM8YwDm7pQAg62oDBgaNzdtDIqtBHt5h/BPl83fOP/dOp P0Xi+y/OsFjDzHBSBDU4sy3fJwHBqm8uuMc6m33pIZfTq15fxFXF+2hU ift1bc0b0dk/L7ANZ5haEsDcl+hSVjwru2o2ISJtvp5zySZ61pdMvA6y ktg=

在第三方網站驗證

https://en.internet.nl/site/www.bkjf-inc.com/473349/

瀏覽器插件

https://www.dnssec-validator.cz/

參考文獻

 

 

 

原文地址：https://blog.stanley.wang/page/2/


免責聲明！

本站轉載的文章為個人學習借鑒使用，本站對版權不負任何法律責任。如果侵犯了您的隱私權益，請聯系本站郵箱yoyou2525@163.com刪除。



猜您在找 bind-chroot和dnssec技術實戰 bind9(named)編譯安裝;bind-chroot BIND簡易教程（3）：DNSSec配置 linux容器技術之chroot 容器技術之Chroot&Docker chroot 在 CentOS7.0 上搭建 Chroot 的 Bind DNS 服務器 chroot的用法 socket編程實戰-bind端口占用問題
 
粵ICP備18138465號   © 2018-2025 CODEPRJ.COM