Kungani indawo eyimfihlo ye-Route 53 ibuyisela i-NXDOMAIN kumagama asesidlangalaleni

Izindawo eziyimfihlo ze-Route 53 zithatha indawo yempendulo yegama esikhundleni sokuhlangana ngqo nerekhodi lasesidlangalaleni, futhi lokho kuyamangaza abantu ngesikhathi esibi kakhulu. Engeza irekhodi elilodwa langaphakathi le- api.example.net endaweni eyimfihlo ye- example.net, lixhumanise ne-VPC, futhi wonke elinye igama ngaphansi kwalowo mzali manje liphendulwa lisuka endaweni eyimfihlo kuphela. Iklayenti elalikwazi ukufinyelela ku- www.example.net izolo namuhla lithola impendulo engemihle. Umhlahlandlela ongezansi uqala kuleso sibuzo esihlulekile bese uya ngaphandle uya endaweni ephendulile.

Qala ngombuzo, hhayi ngekhonsoli

Phinda ukwehluleka kuklayenti elibike lokho, bese ubhala igama eliqondile nohlobo lwerekhodi. Igama elihlulekayo ku- A lisekungenzeka lixazululeke ku- AAAA, futhi isiphequluli esizama kabusha igama elikusilondolozi sifihla ukuthi yikuphi okwephukile. Gijima umbuzo kabili: kanye ngo-resolver iklayenti eliyisebenzisayo ngempela, futhi kanye ngokulandelela okukweqa lokho.

dig +short api.example.net
dig www.example.net +noall +comments +authority
resolvectl query www.example.net

Umyalo wesibili yiwo obalulekile. Umugqa wayo wesimo kanye nengxenye ye-authority isho indawo ekhiqize impendulo, ngakho ungawehlukanisa impendulo engemihle evela endaweni eyimfihlo nokuphela kwesikhathi, umgwaqo ovinjiwe noma i-resolver engazange ilithole umbuzo. resolvectl ikhombisa ukuthi yisiphi iseva ephezulu ebuziwe, futhi lokho ngokuvamile akuyo i-resolver obucabanga ukuthi i-VPN yayithumele yona.

Uma umbuzo olandelelwe ubuyisela ikheli lasesidlangalaleni kanti ojwayelekile awenzi njalo, irekhodi lasesidlangalaleni liphelele futhi impendulo inikezwa umbono oyimfihlo. Leyo ncazelo eyodwa inquma ukuthi yiluphi uhhafu wengxenye esele yaleli khasi okusebenza kuwe.

Funda ukuthi iyiphi indawo ephendulile

Impendulo ephethe i- NXDOMAIN futhi ene-SOA yendawo eyimfihlo engxenyeni ye-authority iyimpendulo yokugcina evela kuleyo ndawo, hhayi ukusesha okuhlulekile. I-Route 53 Resolver yakhetha indawo ephethwe eyimfihlo ngoba igama lalifana, yabe ingayitholi irekhodi lohlobo oluceliwe, futhi ukuziphatha okubhaliwe ukubuyisela impendulo engemihle esikhundleni sokudlulisela umbuzo ku-DNS yasesidlangalaleni.

Ukukhetha kulandela ukucacisa. Lapho izindawo zamagama ayimfihlo ziningi zihlangana khona, kunqoba indawo efanayo ecace kakhulu, futhi umzali oyimfihlo obanzi akatholi ithuba lesibili egameni elingenalo isizinda esincane esikhethiwe. Imithetho yokudlulisela yengeza olunye ungqimba, ngoba umthetho we-Resolver okhethekile wesizinda ungadlula ukuxhumeka kwendawo ephethwe eyimfihlo. Bhala uhlu lokuxhumeka nemithetho ngaphambi kokuphetha ngokuthi indawo ayinalutho.

aws route53 list-hosted-zones-by-name --dns-name example.net.
aws route53 list-resource-record-sets --hosted-zone-id Z0EXAMPLEID --query "ResourceRecordSets[?Type=='A'].[Name,ResourceRecords[0].Value]"

Yomibili imiyalo idinga izifakazelo ze-akhawunti ephethe indawo, futhi owesibili udinga i-ID yendawo evela kowokuqala. Ithathe esikhundleni nge-ID yakho; isibambeli esingezansi asiyona eyangempela ngamabomu.

Kungani kunqoba indawo eyimfihlo

Ukuxhumeka yikho okwenza indawo ibonakale ku-VPC, futhi i-resolver ekuleyo VPC iyisebenzisa. Indawo eyimfihlo engaxhunyiwe ne-VPC okugijima kuyo ukuhamba kweklayenti ayinawo nhlobo umthelela, kanti ukuxhumeka ne-VPC engalungile kukhiqiza impendulo eyimfihlo kubantu abangalungile. Hlola uhlu lokuxhumeka ngaphambi kokuhlela amarekhodi, ngoba indawo ingaba ilungile kodwa ingabonakali.

Izindawo zamagama ezihlangana ziwumthombo wesibili wokudideka. Indawo eyimfihlo ye- example.net nendawo eyimfihlo ye- api.example.net zombili zihambisana nombuzo we-API, futhi kuphendula okucace kakhulu. Lokho kuyasiza lapho ufuna indawo yamagama yangaphakathi encane, futhi kuyingozi lapho indawo encane inganalo irekhodi elinalo elibanzi. Ukucatshangelwa kwezindawo eziphethwe eziyimfihlo kuku- idokhumenti ye-Route 53 kuchaza kokubili ukuziphatha kokuwa phansi kanye nokubaluleka kwemithetho, futhi kufanele kufundwe ngaphambi kokwengeza indawo yesibili ehlanganayo.

Akukho kulokhu okushintsha indawo yasesidlangalaleni. Ama-resolver asesidlangalaleni asaphendula ngokufanele kumarekhodi asesidlangalaleni, futhi yikho lokho ukwehluleka okubonakala njengenkinga yeklayenti kubo bonke abangaphandle kwe-VPC.

Khetha indawo yamagama ngaphambi kokwengeza amarekhodi

Uma kuyimuli entsha kuphela yezinsizakalo zangaphakathi edinga amagama ayimfihlo, yinikeze isizinda esincane esiyimfihlo esizinikele bese ushiya umzali womphakathi. Igama elifana ne- internal.example.net alikwazi ukufihla i- www.example.net, futhi ububanzi bomthelela werekhodi elingekho bukhawulelwe emagameni owakhe ngale njongo. Izindleko zukuthi ama-URL nezitifiketi ezikhona kungenzeka zingahambisani negama elisha.

Lapho abasebenzisi basesidlangalaleni nabayimfihlo kufanele bagcine igama elifanayo lomsingathi, i-DNS enombono ohlukanisiwe iyisakhiwo esisekelwayo futhi idinga ukuthi ugcine amarekhodi kuwo wonke umbono ngokucacile. Indawo eyimfihlo ebanzi enerekhodi elilodwa ayilondolozi ukuncika kwasesidlangalaleni ngaphansi kwaleyo ndawo; ithatha indawo yako ngesizinda esinerekhodi elilodwa.

Bhala uhlu lwamagama uhlelo oluwabiza ngempela ngaphambi kokuqondisa isixuku samaklayenti embonweni oyimfihlo. Amasingathi okungena, amasingathi ezinsiza ezingashintshi, izindawo zokuqondisa kabusha kanye namaphoyinti okugcina e-API yiwona aqala ukuphuka, futhi ngokuvamile asabalele kumarekhodi amaqembu ambalwa.

Landela indlela ye-resolver, bese ulandela umzila

I-laptop ibona umbono oyimfihlo kuphela uma imibuzo yayo ifinyelela ku-resolver enokuxhumeka. Ukuhlela ifayela le-hosts kuseva ye-VPN akusho lutho kumaklayenti axhunyiwe, futhi iklayenti elilungiselelwe nge-resolver yasesidlangalaleni lizoqhubeka lithola izimpendulo zasesidlangalaleni ngesikhathi umhubhe uvuliwe. Qinisekisa ikheli le-resolver elatholwa yiklayenti, bese uphinda umbuzo usuka kuklayenti hhayi kuseva.

Uma igama selixazululiwe, hlola indlela eya ekhelini elibuyisiwe njengesinyathelo esihlukile, isibonelo nge- ip route get uma kuqhathaniswa nekheli elibuyiswe umbuzo. Impendulo eyimfihlo efanele engenandlela eya ekhelini iyinkinga yomzila, futhi impendulo yerekhodi elingekho iyinkinga yombono we-DNS; ukuzithatha njengenkinga eyodwa kuveza izilungiso ezingahlali. Shiya ukuhlolwa kwegama lomsingathi le-TLS nesitifiketi sensebenzo kungashintshiwe, ngoba ikheli eliyimfihlo lishintsha lapho uxhumano luya khona hhayi lutho mayelana nokuthi isiphi isitifiketi esivumelekile.

Qeda ngokubhala indawo, ukuxhumeka, i-resolver kanye namagama owaqinisekisile kunothi loshintsho. Khona-ke umuntu olandelayo owengeza irekhodi uzokwazi ukuthi iyiphi indawo yamagama enegunya kuleso sixuku samaklayenti.