審查 DNS 概念Reviewing DNS Concepts

適用於:Windows Server 2016、Windows Server 2012 R2、Windows Server 2012Applies To: Windows Server 2016, Windows Server 2012 R2, Windows Server 2012

網域名稱系統」(DNS) 時,表示命名空間分散式的資料庫。Domain Name System (DNS) is a distributed database that represents a namespace. 命名空間包含所有所需的任何查詢任何名稱 client 的資訊。The namespace contains all of the information needed for any client to look up any name. 任何 DNS 伺服器可回答關於其命名空間任何知名查詢。Any DNS server can answer queries about any name within its namespace. DNS 伺服器解答查詢其中一項下列方法:A DNS server answers queries in one of the following ways:

  • 快取中解答時,它會解答查詢從快取。If the answer is in its cache, it answers the query from the cache.

  • 如果解答裝載的 DNS 伺服器區中,它會解答查詢從它的區域。If the answer is in a zone hosted by the DNS server, it answers the query from its zone. 區域是 DNS 樹 DNS 伺服器上儲存的部分。A zone is a portion of the DNS tree stored on a DNS server. 時 DNS 伺服器裝載區域,就授權的區域中的名稱(也就是 DNS 伺服器可以回應查詢區域中的任何名稱)。When a DNS server hosts a zone, it is authoritative for the names in that zone (that is, the DNS server can answer queries for any name in the zone). 例如裝載區域 contoso.com 伺服器可回答查詢 contoso.com 中的任何名稱。For example, a server hosting the zone contoso.com can answer queries for any name in contoso.com.

  • 如果伺服器無法回應查詢其快取或區域,它會查詢其他伺服器的解答。If the server cannot answer the query from its cache or zones, it queries other servers for the answer.

請務必以了解核心的功能 DNS,例如委派、遞迴名稱解析度和 Active Directory 整合 DNS 區域,因為它們影響直接在您的 Active Directory 邏輯結構設計。It is important to understand the core features of DNS, such as delegation, recursive name resolution, and Active Directory-integrated DNS zones, because they have a direct impact on your Active Directory logical structure design.

如需有關 DNS Active Directory Domain Services (AD DS),請查看DNS 和 AD DSFor more information about DNS and Active Directory Domain Services (AD DS), see DNS and AD DS.

委派Delegation

回答關於任何名稱查詢的 DNS 伺服器,您必須先直接或間接路徑每命名空間中的時區。For a DNS server to answer queries about any name, it must have a direct or indirect path to every zone in the namespace. 利用委派所建立這些路徑。These paths are created by means of delegation. 委派是會列出名稱伺服器區中的下一步層級階層的授權家長區域中記錄。A delegation is a record in a parent zone that lists a name server that is authoritative for the zone in the next level of the hierarchy. 委派讓參考其他區域中的伺服器戶端一個區域中的伺服器。Delegations make it possible for servers in one zone to refer clients to servers in other zones. 下圖顯示委派的一個例子。The following illustration shows one example of delegation.

DNS 概念

根 DNS 伺服器主控表示為點根區域 (。The DNS root server hosts the root zone represented as a dot ( . ).). 根區域包含區域中階層、com 區域的下一步層級的委派。The root zone contains a delegation to a zone in the next level of the hierarchy, the com zone. 委派根區域中的會顯示根 DNS 伺服器,若要尋找 com 區域,就必須連絡 Com 伺服器。The delegation in the root zone tells the DNS root server that, to find the com zone, it must contact the Com server. 同樣地,委派 com 區域中的會顯示 Com 伺服器,尋找 contoso.com 區域,就必須連絡 Contoso 伺服器。Likewise, the delegation in the com zone tells the Com server that, to find the contoso.com zone, it must contact the Contoso server.

注意

委派使用兩種類型的記錄。A delegation uses two types of records. 名稱(奈秒)伺服器資源記錄提供授權伺服器的名稱。The name server (NS) resource record provides the name of an authoritative server. 主機 (A) 和主機 (AAAA) 資源記錄提供 IP 版本 4 (IPv4) 與 IP 6 授權伺服器 (IPv6) 位址。Host (A) and host (AAAA) resource records provide IP version 4 (IPv4) and IP version 6 (IPv6) addresses of an authoritative server.

這個區域和委派系統建立階層樹代表 DNS 命名空間。This system of zones and delegations creates a hierarchical tree that represents the DNS namespace. 每個區域表示階層、中的層級,每個委派表示樹的分支。Each zone represents a layer in the hierarchy, and each delegation represents a branch of the tree.

使用的區域和委派階層、DNS 伺服器根可以找到 DNS 命名空間任何名稱。By using the hierarchy of zones and delegations, a DNS root server can find any name in the DNS namespace. 根區域包含委派導致直接或間接其他階層中的所有區域。The root zone includes delegations that lead directly or indirectly to all other zones in the hierarchy. 可以查詢根 DNS 伺服器的任何伺服器可以使用委派中的資訊,來命名空間中尋找任何名稱。Any server that can query the DNS root server can use the information in the delegations to find any name in the namespace.

遞迴名稱解析Recursive name resolution

遞迴名稱解析為程序的 DNS 伺服器使用的區域和委派階層回應查詢的不是授權。Recursive name resolution is the process by which a DNS server uses the hierarchy of zones and delegations to respond to queries for which it is not authoritative.

在某些設定、DNS 伺服器包含根提示(也就是一份名稱與 IP 位址),讓它們查詢根 DNS 伺服器。In some configurations, DNS servers include root hints (that is, a list of names and IP addresses) that enable them to query the DNS root servers. 在其他設定,他們無法回應到另一個伺服器的所有查詢都轉寄伺服器。In other configurations, servers forward all queries that they cannot answer to another server. 轉寄和根提示有兩種方法可以使用解析的查詢,它們不會 DNS 伺服器。Forwarding and root hints are both methods that DNS servers can use to resolve queries for which they are not authoritative.

使用根提示解析名稱Resolving names by using root hints

根提示可讓任何 DNS 伺服器找出根 DNS 伺服器。Root hints enable any DNS server to locate the DNS root servers. DNS 伺服器找出 DNS 伺服器根之後,它可以解析任何查詢命名空間。After a DNS server locates the DNS root server, it can resolve any query for that namespace. 下圖告訴您如何 DNS 名稱解析使用根提示。The following illustration describes how DNS resolves a name by using root hints.

DNS 概念

在此範例中,進行下列事件:In this example, the following events occur:

  1. Client 傳送遞迴查詢 DNS 伺服器,以要求名稱 ftp.contoso.com 相對應的 IP 位址。A client sends a recursive query to a DNS server to request the IP address that corresponds to the name ftp.contoso.com. 遞迴查詢指示 client 想其查詢明確的解答。A recursive query indicates that the client wants a definitive answer to its query. 回應遞迴查詢必須有效的地址或訊息,指出找不到的位址。The response to the recursive query must be a valid address or a message indicating that the address cannot be found.

  2. 因為 DNS 伺服器不適用於名稱,在該快取不需要解答的 DNS 伺服器使用根提示尋找根 DNS 伺服器的 IP 位址。Because the DNS server is not authoritative for the name and does not have the answer in its cache, the DNS server uses root hints to find the IP address of the DNS root server.

  3. DNS 伺服器使用反覆查詢要求 DNS 根伺服器解析 ftp.contoso.com 的名稱。The DNS server uses an iterative query to ask the DNS root server to resolve the name ftp.contoso.com. 反覆查詢指示伺服器會接收到另一個的伺服器來取代查詢明確回答推薦。An iterative query indicates that the server will accept a referral to another server in place of a definitive answer to the query. 因為名稱 ftp.contoso.com 結束標籤與 com,根 DNS 伺服器傳回推薦 Com 伺服器裝載 com 區域。Because the name ftp.contoso.com ends with the label com, the DNS root server returns a referral to the Com server that hosts the com zone.

  4. DNS 伺服器使用反覆查詢要求 Com 伺服器解析 ftp.contoso.com 的名稱。The DNS server uses an iterative query to ask the Com server to resolve the name ftp.contoso.com. 因為名稱 ftp.contoso.com 結束 contoso.com 名稱、Com 伺服器傳回推薦 Contoso 伺服器該主機 contoso.com 區域。Because the name ftp.contoso.com ends with the name contoso.com, the Com server returns a referral to the Contoso server that hosts the contoso.com zone.

  5. DNS 伺服器使用反覆查詢要求 Contoso 伺服器解析 ftp.contoso.com 的名稱。The DNS server uses an iterative query to ask the Contoso server to resolve the name ftp.contoso.com. Contoso 伺服器其時區資料中找到答案,然後傳回伺服器的解答。The Contoso server finds the answer in its zone data and then returns the answer to the server.

  6. 伺服器然後傳回至 client 的結果。The server then returns the result to the client.

使用轉接解析名稱Resolving names by using forwarding

轉送可讓您透過特定的伺服器,而不是使用根提示路由名稱解析。Forwarding enables you to route name resolution through specific servers instead of using root hints. 下圖告訴您如何 DNS 名稱解析使用轉接。The following illustration describes how DNS resolves a name by using forwarding.

DNS 概念

在此範例中,進行下列事件:In this example, the following events occur:

  1. Client 查詢名稱 ftp.contoso.com DNS 伺服器。A client queries a DNS server for the name ftp.contoso.com.

  2. DNS 伺服器將其他 DNS 伺服器,稱為 [轉寄查詢。The DNS server forwards the query to another DNS server, known as a forwarder.

  3. 轉寄名稱的授權並不在該快取不需要回應,因為它會使用根提示尋找根 DNS 伺服器的 IP 位址。Because the forwarder is not authoritative for the name and does not have the answer in its cache, it uses root hints to find the IP address of the DNS root server.

  4. 轉寄使用反覆查詢要求 DNS 根伺服器解析 ftp.contoso.com 的名稱。The forwarder uses an iterative query to ask the DNS root server to resolve the name ftp.contoso.com. 因為名稱 ftp.contoso.com 結束名稱 com,根 DNS 伺服器傳回推薦 Com 伺服器裝載 com 區域。Because the name ftp.contoso.com ends with the name com, the DNS root server returns a referral to the Com server that hosts the com zone.

  5. 轉寄使用反覆查詢要求 Com 伺服器解析 ftp.contoso.com 的名稱。The forwarder uses an iterative query to ask the Com server to resolve the name ftp.contoso.com. 因為名稱 ftp.contoso.com 結束 contoso.com 名稱、Com 伺服器傳回推薦 Contoso 伺服器該主機 contoso.com 區域。Because the name ftp.contoso.com ends with the name contoso.com, the Com server returns a referral to the Contoso server that hosts the contoso.com zone.

  6. 轉寄使用反覆查詢要求 Contoso 伺服器解析 ftp.contoso.com 的名稱。The forwarder uses an iterative query to ask the Contoso server to resolve the name ftp.contoso.com. Contoso 伺服器區檔案中, 尋找解答,然後傳回伺服器的答案。The Contoso server finds the answer in its zone files, and then returns the answer to the server.

  7. 然後轉寄會傳回結果原始的 DNS 伺服器。The forwarder then returns the result to the original DNS server.

  8. 原始 DNS 伺服器然後傳回 client 結果。The original DNS server then returns the result to the client.