问题现象:
[root@192-168-174-39 ~]# dig www.baidu.com @192.168.184.11
; > DiG 9.9.4-RedHat-9.9.4-29.el7_2.2 > www.baidu.com @192.168.184.11
;; global options: +cmd
;; Got answer:
;; ->>HEADER ;; flags: qr rd ra; QUERY: 1, ANSWER: 0, AUTHORITY: 0, ADDITIONAL: 1
;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 4096
;; QUESTION SECTION:
;www.baidu.com. IN A
;; Query time: 28 msec
;; SERVER: 192.168.184.11#53(192.168.184.11)
;; WHEN: Thu Mar 10 14:47:57 CST 2016
;; MSG SIZE rcvd: 42
日志查看:
Mar 10 14:47:57 192-168-174-42 named[15948]: error (no valid RRSIG) resolving 'com/DS/IN': 223.5.5.5#53
Mar 10 14:47:57 192-168-174-42 named[15948]: error (no valid RRSIG) resolving 'com/DS/IN': 114.114.114.114#53
Mar 10 14:47:57 192-168-174-42 named[15948]: error (no valid DS) resolving 'www.baidu.com/A/IN': 114.114.114.114#53
Mar 10 14:47:57 192-168-174-42 named[15948]: validating @0x7fdba0000dd0: www.baidu.com A: bad cache hit (com/DS)
Mar 10 14:47:57 192-168-174-42 named[15948]: error (broken trust chain) resolving 'www.baidu.com/A/IN': 223.5.5.5#53
解决:
由于是局域网内非法DNS,所以将DNS安全关闭.
[root@192-168-174-42 ~]# vim /etc/named.conf
将下面的两项设置为no
dnssec-enable no;
dnssec-validation no;
[root@192-168-174-39 ~]# dig www.baidu.com @192.168.184.11
; > DiG 9.9.4-RedHat-9.9.4-29.el7_2.2 > www.baidu.com @192.168.184.11
;; global options: +cmd
;; Got answer:
;; ->>HEADER ;; flags: qr rd ra; QUERY: 1, ANSWER: 3, AUTHORITY: 0, ADDITIONAL: 1
;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 4096
;; QUESTION SECTION:
;www.baidu.com. IN A
;; ANSWER SECTION:
www.baidu.com. 30 IN CNAME www.a.shifen.com.
www.a.shifen.com. 249 IN A 111.13.100.92
www.a.shifen.com. 249 IN A 111.13.100.91
;; Query time: 18 msec
;; SERVER: 192.168.184.11#53(192.168.184.11)
;; WHEN: Thu Mar 10 14:49:43 CST 2016
;; MSG SIZE rcvd: 101
[root@192-168-174-39 ~]#