Ir al contenido
1337skills 1337skills - Hojas de Trucos

Hoja de Referencia de Gestión de DNS

Descripción General

La Gestión de DNS abarca la administración, configuración y mantenimiento de la infraestructura del Sistema de Nombres de Dominio. Esta hoja de referencia cubre comandos y procedimientos esenciales para administrar servidores DNS, zonas y registros en diferentes plataformas y entornos.

⚠️ Advertencia: Los cambios en DNS pueden afectar la conectividad de red y la disponibilidad de servicios. Siempre pruebe los cambios en entornos que no sean de producción y siga los procedimientos de gestión de cambios.

Gestión de Servidores DNS

BIND (Berkeley Internet Name Domain)

Instalación

# Ubuntu/Debian
sudo apt update && sudo apt install bind9 bind9utils bind9-doc

# CentOS/RHEL/Rocky Linux
sudo dnf install bind bind-utils

# macOS (using Homebrew)
brew install bind

Gestión de Servicios

# Start BIND service
sudo systemctl start named
sudo systemctl start bind9  # Ubuntu/Debian

# Stop BIND service
sudo systemctl stop named
sudo systemctl stop bind9   # Ubuntu/Debian

# Restart BIND service
sudo systemctl restart named
sudo systemctl restart bind9  # Ubuntu/Debian

# Enable auto-start
sudo systemctl enable named
sudo systemctl enable bind9   # Ubuntu/Debian

# Check service status
sudo systemctl status named
sudo systemctl status bind9   # Ubuntu/Debian

Gestión de Configuración

# Check BIND configuration syntax
sudo named-checkconf

# Check zone file syntax
sudo named-checkzone example.com /etc/bind/db.example.com

# Reload configuration without restart
sudo rndc reload

# Reload specific zone
sudo rndc reload example.com

# Flush cache
sudo rndc flush

# View BIND statistics
sudo rndc stats

Servidor DNS de Windows

Gestión con PowerShell

# Install DNS Server role
Install-WindowsFeature -Name DNS -IncludeManagementTools

# Start DNS service
Start-Service DNS

# Stop DNS service
Stop-Service DNS

# Restart DNS service
Restart-Service DNS

# Get DNS server settings
Get-DnsServer

# Get DNS server statistics
Get-DnsServerStatistics

Gestión de Zonas

Creación de Zonas

Creación de Zona en BIND

# Create forward lookup zone file
sudo nano /etc/bind/db.example.com

# Add zone to named.conf
echo 'zone "example.com" \\\\{
    type master;
    file "/etc/bind/db.example.com";
    allow-transfer \\\\{ 192.168.1.10; \\\\};
\\\\};'|sudo tee -a /etc/bind/named.conf.local

# Create reverse lookup zone
sudo nano /etc/bind/db.192.168.1

# Add reverse zone to named.conf
echo 'zone "1.168.192.in-addr.arpa" \\\\{
    type master;
    file "/etc/bind/db.192.168.1";
    allow-transfer \\\\{ 192.168.1.10; \\\\};
\\\\};'|sudo tee -a /etc/bind/named.conf.local

Creación de Zona en DNS de Windows

# Create primary zone
Add-DnsServerPrimaryZone -Name "example.com" -ZoneFile "example.com.dns"

# Create Active Directory integrated zone
Add-DnsServerPrimaryZone -Name "example.com" -ReplicationScope "Domain"

# Create secondary zone
Add-DnsServerSecondaryZone -Name "example.com" -ZoneFile "example.com.dns" -MasterServers "192.168.1.10"

# Create reverse lookup zone
Add-DnsServerPrimaryZone -NetworkId "192.168.1.0/24" -ReplicationScope "Domain"

Gestión de Transferencia de Zonas

Transferencias de Zona en BIND

# Configure zone transfer in named.conf
zone "example.com" \\\\{
    type master;
    file "/etc/bind/db.example.com";
    allow-transfer \\\\{ 192.168.1.10; 192.168.1.11; \\\\};
    also-notify \\\\{ 192.168.1.10; 192.168.1.11; \\\\};
    notify yes;
\\\\};

# Force zone transfer
sudo rndc notify example.com

# Check zone transfer status
sudo rndc status

Transferencias de Zona en Windows

# Configure zone transfer settings
Set-DnsServerZoneTransferPolicy -ZoneName "example.com" -SecondaryServers "192.168.1.10","192.168.1.11"

# Enable zone transfer notifications
Set-DnsServerZoneTransferPolicy -ZoneName "example.com" -Notify "Yes" -NotifyServers "192.168.1.10","192.168.1.11"

# Force zone transfer
Start-DnsServerZoneTransfer -ZoneName "example.com"

Gestión de Registros DNS

Tipos de Registros Comunes

Registros A (IPv4)

# BIND - Add A record to zone file
echo "www    IN    A    192.168.1.100" >> /etc/bind/db.example.com

# Windows PowerShell
Add-DnsServerResourceRecordA -ZoneName "example.com" -Name "www" -IPv4Address "192.168.1.100"

# Using nsupdate (dynamic updates)
nsupdate -k /etc/bind/rndc.key
> server 192.168.1.10
> zone example.com
> update add www.example.com 300 A 192.168.1.100
> send
> quit

Registros AAAA (IPv6)

# BIND - Add AAAA record
echo "www    IN    AAAA    2001:db8::1" >> /etc/bind/db.example.com

# Windows PowerShell
Add-DnsServerResourceRecordAAAA -ZoneName "example.com" -Name "www" -IPv6Address "2001:db8::1"

Registros CNAME

# BIND - Add CNAME record
echo "mail    IN    CNAME    www.example.com." >> /etc/bind/db.example.com

# Windows PowerShell
Add-DnsServerResourceRecordCName -ZoneName "example.com" -Name "mail" -HostNameAlias "www.example.com"

Registros MX

# BIND - Add MX record
echo "@    IN    MX    10    mail.example.com." >> /etc/bind/db.example.com

# Windows PowerShell
Add-DnsServerResourceRecordMX -ZoneName "example.com" -Name "@" -MailExchange "mail.example.com" -Preference 10

Registros TXT

# BIND - Add TXT record
echo "@    IN    TXT    \"v=spf1 include:_spf.google.com ~all\"" >> /etc/bind/db.example.com

# Windows PowerShell
Add-DnsServerResourceRecordTxt -ZoneName "example.com" -Name "@" -DescriptiveText "v=spf1 include:_spf.google.com ~all"

Registros PTR (DNS Inverso)

# BIND - Add PTR record to reverse zone
echo "100    IN    PTR    www.example.com." >> /etc/bind/db.192.168.1

# Windows PowerShell
Add-DnsServerResourceRecordPtr -ZoneName "1.168.192.in-addr.arpa" -Name "100" -PtrDomainName "www.example.com"

Modificación y Eliminación de Registros

Gestión de Registros en BIND

# Edit zone file directly
sudo nano /etc/bind/db.example.com

# Increment serial number (important!)
# Change: 2024063001 to 2024063002

# Reload zone after changes
sudo rndc reload example.com

# Delete record using nsupdate
nsupdate -k /etc/bind/rndc.key
> server 192.168.1.10
> zone example.com
> update delete old-server.example.com A
> send
> quit

Gestión de Registros en Windows

# Modify A record
Set-DnsServerResourceRecordA -ZoneName "example.com" -Name "www" -IPv4Address "192.168.1.101"

# Remove A record
Remove-DnsServerResourceRecord -ZoneName "example.com" -Name "www" -RRType "A"

# Remove all records for a name
Remove-DnsServerResourceRecord -ZoneName "example.com" -Name "old-server" -Force

Gestión de Seguridad DNS

Configuración de DNSSEC

Configuración de DNSSEC en BIND

# Generate zone signing keys
cd /etc/bind/keys
dnssec-keygen -a RSASHA256 -b 2048 -n ZONE example.com
dnssec-keygen -a RSASHA256 -b 4096 -f KSK -n ZONE example.com

# Sign the zone
dnssec-signzone -A -3 $(head -c 1000 /dev/random|sha1sum|cut -b 1-16) -N INCREMENT -o example.com -t /etc/bind/db.example.com

# Update named.conf to use signed zone
zone "example.com" \\\\{
    type master;
    file "/etc/bind/db.example.com.signed";
    key-directory "/etc/bind/keys";
    auto-dnssec maintain;
    inline-signing yes;
\\\\};

Configuración de DNSSEC en Windows

# Enable DNSSEC for zone
Enable-DnsServerSigningKeyRollover -ZoneName "example.com" -KeyType "KeySigningKey"

# Add Key Signing Key (KSK)
Add-DnsServerSigningKey -ZoneName "example.com" -Type "KeySigningKey" -CryptoAlgorithm "RsaSha256"

# Add Zone Signing Key (ZSK)
Add-DnsServerSigningKey -ZoneName "example.com" -Type "ZoneSigningKey" -CryptoAlgorithm "RsaSha256"

# Sign the zone
Invoke-DnsServerZoneSigning -ZoneName "example.com" -Sign

Listas de Control de Acceso (ACL)

Configuración de ACL en BIND

Would you like me to continue with the remaining sections?```bash

Define ACLs in named.conf

acl “internal-networks” \\{ 192.168.1.0/24; 10.0.0.0/8; 172.16.0.0/12; \\};

acl “dns-servers” \\{ 192.168.1.10; 192.168.1.11; \\};

Apply ACLs to zones

zone “example.com” \\{ type master; file “/etc/bind/db.example.com”; allow-query \\{ internal-networks; \\}; allow-transfer \\{ dns-servers; \\}; allow-update \\{ none; \\}; \\};

```powershell
# Configure zone transfer security
Set-DnsServerZoneTransferPolicy -ZoneName "example.com" -SecondaryServers "192.168.1.10","192.168.1.11"

# Disable recursion for external queries
Set-DnsServerRecursion -Enable $false -AdditionalTimeout 4 -RetryInterval 3 -Timeout 8
```## Monitoreo y Resolución de Problemas de DNS
```bash
# Configure logging in named.conf
logging \\\\{
    channel default_debug \\\\{
        file "data/named.run";
        severity dynamic;
    \\\\};
    channel query_log \\\\{
        file "/var/log/bind/query.log" versions 3 size 5m;
        severity info;
        print-category yes;
        print-severity yes;
        print-time yes;
    \\\\};
    category queries \\\\{ query_log; \\\\};
    category default \\\\{ default_debug; \\\\};
\\\\};

# Enable query logging
sudo rndc querylog on

# View logs
sudo tail -f /var/log/bind/query.log
sudo journalctl -u named -f
```### Gestión de Registros
```powershell
# Enable DNS debug logging
Set-DnsServerDiagnostics -All $true

# Enable query logging
Set-DnsServerDiagnostics -Queries $true

# View DNS events
Get-WinEvent -LogName "DNS Server"|Select-Object -First 10

# Export DNS logs
Get-DnsServerQueryResolutionPolicy|Export-Csv -Path "C:\dns-policies.csv"
```#### Registro de BIND
```bash
# Enable statistics
statistics-channels \\\\{
    inet 127.0.0.1 port 8053 allow \\\\{ 127.0.0.1; \\\\};
\\\\};

# View statistics via HTTP
curl http://127.0.0.1:8053/

# Command line statistics
sudo rndc stats
cat /var/cache/bind/named.stats
```#### Registro de DNS en Windows
```powershell
# Get DNS server statistics
Get-DnsServerStatistics

# Monitor DNS performance counters
Get-Counter "\DNS\Total Query Received/sec"
Get-Counter "\DNS\Total Response Sent/sec"
Get-Counter "\DNS\Recursive Queries/sec"

# Export performance data
Get-DnsServerStatistics|Export-Csv -Path "C:\dns-stats.csv"
```### Monitoreo de Rendimiento
```bash
# Test DNS resolution
nslookup www.example.com
dig www.example.com
host www.example.com

# Test specific record types
dig MX example.com
dig TXT example.com
dig NS example.com

# Test reverse DNS
dig -x 192.168.1.100

# Test DNSSEC validation
dig +dnssec www.example.com
```#### Estadísticas de BIND
```bash
# Test zone transfer
dig @192.168.1.10 example.com AXFR

# Test zone serial number
dig @192.168.1.10 example.com SOA
```#### Rendimiento de DNS en Windows
```powershell
# Test DNS resolution
Resolve-DnsName -Name "www.example.com"
Resolve-DnsName -Name "example.com" -Type MX

# Test DNS server connectivity
Test-DnsServer -IPAddress "192.168.1.10" -ZoneName "example.com"

# Validate zone
Test-DnsServer -IPAddress "192.168.1.10" -ZoneName "example.com" -RRType "SOA"
```### Comandos de Resolución de Problemas
```bash
# Backup BIND zone files
sudo tar -czf /backup/dns-zones-$(date +%Y%m%d).tar.gz /etc/bind/

# Backup Windows DNS zones
Export-DnsServerZone -Name "example.com" -FileName "example.com.backup"
```#### Pruebas de Resolución de DNS
```bash
# Clear DNS cache (BIND)
sudo rndc flush

# Clear DNS cache (Windows)
Clear-DnsServerCache

# Clear local resolver cache (Linux)
sudo systemctl restart systemd-resolved

# Clear local resolver cache (Windows)
ipconfig /flushdns
```#### Pruebas de Transferencia de Zona
```bash
# Update zone serial number
# Edit zone file and increment serial: 2024063001 -> 2024063002

# Reload zone
sudo rndc reload example.com

# Force zone refresh on secondary
sudo rndc refresh example.com
```#### Pruebas de DNS en Windows

| Comando | Descripción |
|---------|-------------|
| `named-checkconf` | Validar configuración de BIND |
| `named-checkzone` | Validar sintaxis de archivo de zona |
| `rndc reload` | Recargar configuración DNS |
| `rndc flush` | Limpiar caché de DNS |
| `rndc stats` | Generar estadísticas |
| `rndc querylog` | Alternar registro de consultas |
| `nsupdate` | Actualizaciones de Dynamic DNS |
| `dig` | Utilidad de búsqueda DNS |
| `nslookup` | Utilidad de búsqueda DNS |
| `host` | Utilidad de búsqueda DNS |## Tareas de Mantenimiento de DNS

| Cmdlet | Descripción |
|--------|-------------|
| `Get-DnsServer` | Obtener configuración del servidor DNS |
| `Add-DnsServerPrimaryZone` | Crear zona primaria |
| `Add-DnsServerSecondaryZone` | Crear zona secundaria |
| `Add-DnsServerResourceRecord*` | Agregar registros DNS |
| `Remove-DnsServerResourceRecord` | Eliminar registros DNS |
| `Set-DnsServerZoneTransferPolicy` | Configurar transferencias de zona |
| `Test-DnsServer` | Probar la funcionalidad del servidor DNS |
| `Clear-DnsServerCache` | Limpiar caché de DNS |### Respaldo de Archivos de Zona
```bash
# Check zone transfer configuration
named-checkconf
named-checkzone example.com /etc/bind/db.example.com

# Verify network connectivity
telnet secondary-dns-server 53

# Check TSIG key configuration
rndc-confgen -a
```### Gestión de Caché
```bash
# Check DNSSEC chain
dig +dnssec +trace www.example.com

# Verify key signatures
dig +dnssec example.com DNSKEY

# Check DS records in parent zone
dig +dnssec example.com DS
```### Mantenimiento de Zona
```bash
# Monitor query load
rndc stats
tail -f /var/log/bind/query.log

# Check cache hit ratio
rndc dumpdb -cache
grep "cache" /var/cache/bind/named_dump.db

# Analyze query patterns
awk '\\\\{print $1\\\\}' /var/log/bind/query.log|sort|uniq -c|sort -nr
```## Referencia de Comandos