BIND DNS 服务器搭建完全教程 / 第 07 章：动态更新与 DDNS

# 传统方式：编辑区域文件 → 递增 Serial → 重载
vim /var/cache/bind/primary/example.com.zone
rndc reload example.com

# 动态更新：直接通过 nsupdate 命令发送更新
nsupdate -k Kexample.com.+013+12345.key
> update add test.example.com 3600 A 192.168.1.50
> send

# 使用 tsig-keygen 生成密钥（推荐）
tsig-keygen -a hmac-sha256 update-key > /etc/bind/update.key

# 查看生成的密钥
cat /etc/bind/update.key

key "update-key" {
    algorithm hmac-sha256;
    secret "aBcDeFgHiJkLmNoPqRsTuVwXyZ0123456789=";
};

# 或者使用旧工具（不推荐）
dnssec-keygen -a HMAC-SHA256 -b 256 -n HOST update-key

// 引入 TSIG 密钥
include "/etc/bind/update.key";

zone "example.com" {
    type primary;
    file "primary/example.com.zone";
    
    // 仅允许使用 TSIG 密钥的客户端进行动态更新
    allow-update { key update-key; };
};

# 交互模式
nsupdate -k /etc/bind/update.key

> server 127.0.0.1
> zone example.com.
> update add test.example.com 3600 A 192.168.1.50
> send
> quit

# 添加 A 记录
nsupdate -k /etc/bind/update.key <<EOF
server 127.0.0.1
zone example.com.
update add newhost.example.com 3600 A 192.168.1.60
send
EOF

# 添加 AAAA 记录
nsupdate -k /etc/bind/update.key <<EOF
server 127.0.0.1
zone example.com.
update add newhost.example.com 3600 AAAA fd00::60
send
EOF

# 添加 MX 记录
nsupdate -k /etc/bind/update.key <<EOF
server 127.0.0.1
zone example.com.
update add example.com 3600 MX 10 mail.example.com.
send
EOF

# 添加 TXT 记录
nsupdate -k /etc/bind/update.key <<EOF
server 127.0.0.1
zone example.com.
update add _dmarc.example.com 3600 TXT "v=DMARC1; p=reject"
send
EOF

# 删除特定记录
nsupdate -k /etc/bind/update.key <<EOF
server 127.0.0.1
zone example.com.
update delete test.example.com A
send
EOF

# 删除该名称的所有记录
nsupdate -k /etc/bind/update.key <<EOF
server 127.0.0.1
zone example.com.
update delete test.example.com
send
EOF

# 条件添加：仅当记录不存在时添加
nsupdate -k /etc/bind/update.key <<EOF
server 127.0.0.1
zone example.com.
prereq nxdomain newhost.example.com
update add newhost.example.com 3600 A 192.168.1.60
send
EOF

# 条件删除：仅当记录值匹配时删除
nsupdate -k /etc/bind/update.key <<EOF
server 127.0.0.1
zone example.com.
prereq yxrrset test.example.com A 192.168.1.50
update delete test.example.com A 192.168.1.50
send
EOF

# 动态更新后，BIND 会自动修改区域文件
# 原始文件：example.com.zone → 变为 example.com.zone.jnl（日志）
# 最终写入：example.com.zone（定期或冻结时合并）

# 查看日志文件
ls -la /var/cache/bind/primary/
# example.com.zone
# example.com.zone.jnl   ← 动态更新日志

# 冻结区域（合并日志到区域文件，禁止动态更新）
sudo rndc freeze example.com

# 现在可以手动编辑区域文件
sudo vim /var/cache/bind/primary/example.com.zone
# 注意：需要手动更新 Serial！

# 解冻区域（重新启用动态更新）
sudo rndc thaw example.com

# /etc/dhcp/dhcpd.conf

# TSIG 密钥
key dhcp-update-key {
    algorithm hmac-sha256;
    secret "dhcp-secret-key-here=";
}

# 区域定义
zone example.com. {
    primary 127.0.0.1;
    key dhcp-update-key;
}

zone 1.168.192.in-addr.arpa. {
    primary 127.0.0.1;
    key dhcp-update-key;
}

# 子网配置
subnet 192.168.1.0 netmask 255.255.255.0 {
    range 192.168.1.100 192.168.1.200;
    option routers 192.168.1.1;
    option domain-name-servers 192.168.1.10;
    option domain-name "example.com";
    
    # DDNS 设置
    ddns-domainname "example.com.";
    ddns-rev-domainname "in-addr.arpa.";
    ddns-updates on;
    update-static-leases on;
    
    # 租约时间
    default-lease-time 3600;
    max-lease-time 86400;
}

// named.conf

// DHCP 更新密钥
key dhcp-update-key {
    algorithm hmac-sha256;
    secret "dhcp-secret-key-here=";
};

// 正向区域
zone "example.com" {
    type primary;
    file "primary/example.com.zone";
    allow-update { key dhcp-update-key; };
    // 也可以限制来源 IP
    // allow-update { key dhcp-update-key; 192.168.1.1; };
};

// 反向区域
zone "1.168.192.in-addr.arpa" {
    type primary;
    file "primary/192.168.1.rev";
    allow-update { key dhcp-update-key; };
};

// /etc/kea/kea-dhcp4.conf
{
    "Dhcp4": {
        "interfaces-config": {
            "interfaces": ["eth0"]
        },
        "lease-database": {
            "type": "memfile"
        },
        "ddns-qualifying-suffix": "example.com",
        "dhcp-ddns": {
            "enable-updates": true,
            "server-ip": "127.0.0.1",
            "server-port": 53,
            "sender-ip": "192.168.1.1",
            "sender-port": 53,
            "ncr-protocol": "UDP",
            "ncr-format": "JSON"
        },
        "subnet4": [{
            "subnet": "192.168.1.0/24",
            "pools": [{"pool": "192.168.1.100 - 192.168.1.200"}],
            "option-data": [
                {"name": "routers", "data": "192.168.1.1"},
                {"name": "domain-name-servers", "data": "192.168.1.10"}
            ]
        }]
    }
}

zone "example.com" {
    type primary;
    file "primary/example.com.zone";
    
    // 仅允许特定 IP 更新
    allow-update { 192.168.1.1; };  // 仅 DHCP 服务器 IP
};

key "update-key" {
    algorithm hmac-sha256;
    secret "...";
};

zone "example.com" {
    type primary;
    file "primary/example.com.zone";
    
    // 仅允许持有 TSIG 密钥的客户端更新
    allow-update { key update-key; };
};

// 不同服务使用不同的 TSIG 密钥
key "dhcp-key" {
    algorithm hmac-sha256;
    secret "dhcp-secret...";
};

key "monitoring-key" {
    algorithm hmac-sha256;
    secret "monitoring-secret...";
};

key "devops-key" {
    algorithm hmac-sha256;
    secret "devops-secret...";
};

zone "example.com" {
    type primary;
    file "primary/example.com.zone";
    
    // DHCP 可更新正向和反向
    allow-update {
        key dhcp-key;
    };
};

zone "dev.example.com" {
    type primary;
    file "primary/dev.example.com.zone";
    
    // 开发团队可更新 dev 子域
    allow-update {
        key dhcp-key;
        key devops-key;
    };
};

zone "example.com" {
    type primary;
    file "primary/example.com.zone";
    
    // 动态更新 + DNSSEC 自动签名
    inline-signing yes;
    auto-dnssec maintain;
    key-directory "primary/keys";
    allow-update { key update-key; };
};

# 冻结 → 编辑 → 签名 → 解冻
rndc freeze example.com
# 手动编辑区域文件
dnssec-signzone -o example.com example.com.zone
rndc thaw example.com

logging {
    channel update_log {
        file "/var/log/named/update.log" versions 10 size 50m;
        severity info;
        print-time yes;
        print-severity yes;
        print-category yes;
    };
    
    category update { update_log; };
    category update-security { update_log; };
};

# 查看更新日志
tail -f /var/log/named/update.log

# 典型日志条目：
# 10-Jan-2026 14:30:15.123 client @0x7f8b8c0d 192.168.1.1#12345/key dhcp-key: updating zone 'example.com/IN': adding an RR at 'newhost.example.com' A 192.168.1.60

# 查看更新统计
rndc stats
cat /var/cache/bind/named.stats

# 症状：update failed: REFUSED

# 检查 allow-update 配置
named-checkconf

# 检查 TSIG 密钥是否匹配
# 客户端和服务器的密钥必须完全一致

# 查看安全日志
tail -f /var/log/named/security.log

# 测试更新
nsupdate -k update.key
> server 127.0.0.1
> zone example.com.
> update add test.example.com 3600 A 192.168.1.50
> send
# 检查返回的响应码

# 可能原因：日志未合并到区域文件
# 解决：rndc freeze → rndc thaw

# 检查日志文件
ls -la /var/cache/bind/primary/*.jnl

# 验证更新
dig @127.0.0.1 test.example.com A

# 罕见情况：动态更新可能导致区域文件损坏
# 解决：从备份恢复
sudo rndc freeze example.com
sudo cp /backup/example.com.zone /var/cache/bind/primary/
sudo rndc thaw example.com