┌─────────────────────────────────┐
│ 应用层：DoH/DoT加密传输          │
├─────────────────────────────────┤
│ 传输层：DNSSEC签名验证           │
├─────────────────────────────────┤
│ 网络层：防火墙策略+流量审计      │
├─────────────────────────────────┤
│ 数据层：恶意域名情报+实时拦截    │
└─────────────────────────────────┘

# 使用dnsperf进行基准测试

dnsperf -s 223.5.5.5 -d queries.txt -c 100 -l 60

# 使用namebench进行智能推荐

namebench --isolate --no-gui

# 自定义脚本监测P99延迟

#!/bin/bash

for dns in "223.5.5.5" "119.29.29.29" "114.114.114.114"; do

    echo "Testing $dns"

    time dig @$dns www.example.com +short

done

# /etc/config/dhcp
config dnsmasq
    option domainneeded '1'
    option boguspriv '1'
    option filterwin2k '1'
    option localise_queries '1'
    option rebind_protection '1'
    option rebind_localhost '1'
    option local '/lan/'
    option domain 'lan'
    option expandhosts '1'
    option nonegcache '0'
    option authoritative '1'
    option readethers '1'
    option leasefile '/tmp/dhcp.leases'
    option resolvfile '/tmp/resolv.conf.d/resolv.conf.auto'
    option nonwildcard '1'
    option localservice '1'
    list server '223.5.5.5'
    list server '223.6.6.6'
    option dnssec '1'
    option noresolv '1'

# 允许DNS查询（UDP/TCP 53）
iptables -A OUTPUT -p udp --dport 53 -j ACCEPT
iptables -A OUTPUT -p tcp --dport 53 -j ACCEPT

# 允许DoH/DoT加密查询
iptables -A OUTPUT -p tcp --dport 443 -m string --string "application/dns-https" --algo bm -j ACCEPT
iptables -A OUTPUT -p tcp --dport 853 -j ACCEPT  # DoT

# 限制非授权DNS服务器访问（防DNS劫持）
iptables -A OUTPUT -p udp --dport 53 ! -d 223.5.5.5/32 ! -d 223.6.6.6/32 -j LOG --log-prefix "DNS-LEAK: "

# daemon.json
{
  "dns": ["223.5.5.5", "223.6.6.6"],
  "dns-search": ["corp.example.com"],
  "dns-opts": ["ndots:2", "timeout:2", "attempts:3"]
}

# DNS故障快速切换脚本
#!/bin/bash
PRIMARY_DNS="223.5.5.5"
BACKUP_DNS="119.29.29.29"
TIMEOUT=2

check_dns() {
    timeout $TIMEOUT dig @$1 www.baidu.com +short > /dev/null 2>&1
    return $?
}

if ! check_dns $PRIMARY_DNS; then
    logger "Primary DNS $PRIMARY_DNS unreachable, switching to backup"
    # 调用配置管理工具切换DNS
    ansible-playbook -i hosts switch_dns.yml -e "dns_server=$BACKUP_DNS"
    # 发送告警
    curl -X POST https://alert.example.com/webhook \
         -H "Content-Type: application/json" \
         -d "{\"msg\":\"DNS failover triggered\"}"
fi

# 1. 基础连通性
ping -c 4 223.5.5.5
nc -zv -u 223.5.5.5 53

# 2. 解析功能验证
dig @223.5.5.5 example.com +time=2 +tries=2
nslookup example.com 223.5.5.5

# 3. DNSSEC验证
dig @223.5.5.5 example.com +dnssec +multiline
# 检查ad标志与RRSIG记录

# 4. 延迟与丢包分析
mtr -r -c 100 223.5.5.5
dnsperf -s 223.5.5.5 -d queries.txt -l 300

# 5. 本地缓存干扰排查
ipconfig /flushdns  # Windows
sudo systemd-resolve --flush-caches  # Linux

Configuration DnsClientSettings {
    Import-DscResource -ModuleName PSDscResources
    Node "localhost" {
        DnsClientGlobalSetting GlobalSettings {
            UseSuffixSearchOrder = $false
            SuffixSearchList = @("corp.example.com", "example.com")
        }
        DnsClientServerAddress DnsServers {
            InterfaceAlias = "Ethernet"
            AddressFamily = "IPv4"
            ServerAddresses = @("223.5.5.5", "223.6.6.6")
        }
    }
}
DnsClientSettings -OutputPath "C:\DSC\DnsConfig"
Start-DscConfiguration -Path "C:\DSC\DnsConfig" -Wait -Verbose

# roles/dns_config/tasks/main.yml
- name: Configure systemd-resolved
  template:
    src: resolved.conf.j2
    dest: /etc/systemd/resolved.conf
    owner: root
    mode: '0644'
  notify: Restart systemd-resolved

- name: Set DNS for NetworkManager
  lineinfile:
    path: /etc/NetworkManager/system-connections/{{ item }}.nmconnection
    regexp: '^dns='
    line: 'dns=223.5.5.5;223.6.6.6;'
  loop: "{{ network_connections }}"
  notify: Reload NetworkManager

handlers:
  - name: Restart systemd-resolved
    systemd:
      name: systemd-resolved
      state: restarted
      daemon_reload: yes

# coredns-custom.yaml
apiVersion: v1
kind: ConfigMap
metadata:
  name: coredns-custom
  namespace: kube-system
data:
  upstream.servers: |
    # 配置上游DNS与缓存策略
    .:53 {
        errors
        health
        ready
        kubernetes cluster.local in-addr.arpa ip6.arpa {
            pods insecure
            fallthrough in-addr.arpa ip6.arpa
        }
        forward . 223.5.5.5 223.6.6.6 {
            policy sequential
            health_check 5s
            max_fails 3
        }
        cache 30
        loop
        reload
        loadbalance
    }

# dns_exporter配置示例
scrape_configs:
  - job_name: 'dns_metrics'
    static_configs:
      - targets: ['dns-monitor:9153']
    metrics_path: '/metrics'
    
# 核心监控面板指标
- dns_query_duration_seconds (P50/P95/P99)
- dns_response_rcode_total (NOERROR/SERVFAIL/NXDOMAIN分布)
- dns_cache_hits_ratio (缓存效率)
- dns_upstream_health (上游服务器可用性)