1. dns服务器需要设置静态IP
2. 安装dns服务器
3. 打开DNS管理器，右击正向解析>新建区域
自定义内网统一主域名（demo.it）
选择 “不允许动态更新”，dns解析都需要手动维护
4. 转发器里添加公网DNS地址
5. 添加解析，以nginx服务器为例
6. 在DHCP服务器里面加入DNS服务器IP地址
PASS
7. 客户端查看dns信息，看是否有dns服务器地址
8. 在客户端检查nginx服务器解析是否正确
Ping
客户端访问
9. 修改TTL时间
# 1. 读取当前记录
$old = Get-DnsServerResourceRecord -ZoneName "demo.it" -Name "nginx" -RRType A
# 2. 复制一份并改 TTL（10 分钟 = 600 秒）
$new = Get-DnsServerResourceRecord -ZoneName "demo.it" -Name "nginx" -RRType A
$new.TimeToLive = [TimeSpan]::FromMinutes(10)
# 3. 替换记录
Set-DnsServerResourceRecord -ZoneName "demo.it" -OldInputObject $old -NewInputObject $new
# 4. 验证
Get-DnsServerResourceRecord -ZoneName "demo.it" -Name "nginx" -RRType A |
Select HostName, @{N='TTL秒';E={$_.TimeToLive.TotalSeconds}}, RecordData
Resolve-DnsName nginx.demo.it -Server 127.0.0.1 -DnsOnly | Select Name, TTL, IPAddress
- 启用 DNSSEC验证 a. 创建签名证书
# 服务器: 10.1.25.70
# 区域: demo.it
# 有效期: 365 天
$zone = "demo.it"
$validity = [TimeSpan]::FromDays(365)
Write-Host "========== 2. 添加密钥 ==========" -ForegroundColor Yellow
Add-DnsServerSigningKey -ZoneName $zone -KeyType KeySigningKey -KeyLength 2048 -CryptoAlgorithm RsaSha256 -RolloverPeriod $validity
Add-DnsServerSigningKey -ZoneName $zone -KeyType ZoneSigningKey -KeyLength 1024 -CryptoAlgorithm RsaSha256 -RolloverPeriod $validity
Get-DnsServerSigningKey -ZoneName $zone | Format-Table KeyType, KeyLength, KeyTag, State -AutoSize
选中创建的签名
TTL时间改成10分钟
签名成功后，区域是上锁状态
检查签署状态，确保所以状态都是正确的
$zone = "demo.it"
Write-Host "=== 密钥状态 ===" -ForegroundColor Cyan
Get-DnsServerSigningKey -ZoneName $zone | Format-Table KeyType, KeyLength, KeyTag, State, RolloverPeriod -AutoSize
Write-Host "=== 区域 DNSSEC 记录 ===" -ForegroundColor Cyan
Get-DnsServerResourceRecord -ZoneName $zone | Where-Object {
$_.RecordType -in @('DNSKEY','RRSIG','NSEC','NSEC3')
} | Select HostName, RecordType -First 20
Write-Host "=== DNSKEY 查询 ===" -ForegroundColor Cyan
Resolve-DnsName $zone -Type DNSKEY -Server 127.0.0.1 -ErrorAction SilentlyContinue
Write-Host "=== A 记录 ===" -ForegroundColor Cyan
Resolve-DnsName jenkins.$zone -Server 127.0.0.1 -DnsOnly
Write-Host "=== dnscmd ===" -ForegroundColor Cyan
dnscmd /zoneprint $zone | findstr /i "DNSKEY RRSIG NSEC"
