最基本的物质需求得到满足之后，唯一能够不断增加个人幸福感的事情就是帮助他人

标签： DNS, ITU, UN

标签： DNS, SSL, Symantec, VeriSign

 

几个常用DNS server:

Google Public DNS:  8.8.8.8  8.8.4.4

Open DNS: 208.67.222.222  208.67.220.220

Guangdong Telecommunication DNS: 202.96.128.86

北京 网通 DNS: 202.106.195.68

 

指定dns服务器8.8.8.8查询www.qq.com

woodys-MacBook-Pro:~ woody$ dig @8.8.8.8 www.qq.com

; <<>> DiG 9.6.0-APPLE-P2 <<>> @8.8.8.8 www.qq.com

; (1 server found)

;; global options: +cmd

;; Got answer:

;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 5832

;; flags: qr rd ra; QUERY: 1, ANSWER: 2, AUTHORITY: 0, ADDITIONAL: 0

;; QUESTION SECTION:

;www.qq.com. IN A

;; ANSWER SECTION:

www.qq.com. 152 IN A 60.28.14.159（天津网通）

www.qq.com. 152 IN A 60.28.14.158

;; Query time: 74 msec

;; SERVER: 8.8.8.8#53(8.8.8.8)

;; WHEN: Wed Dec  9 12:28:30 2009

;; MSG SIZE  rcvd: 60

 

指定dns服务器8.8.4.4查询www.qq.com

woodys-MacBook-Pro:~ woody$ dig @8.8.4.4 www.qq.com

; <<>> DiG 9.6.0-APPLE-P2 <<>> @8.8.4.4 www.qq.com

; (1 server found)

;; global options: +cmd

;; Got answer:

;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 32276

;; flags: qr rd ra; QUERY: 1, ANSWER: 2, AUTHORITY: 0, ADDITIONAL: 0

;; QUESTION SECTION:

;www.qq.com. IN A

;; ANSWER SECTION:

www.qq.com. 42 IN A 60.28.14.159（天津网通）

www.qq.com. 42 IN A 60.28.14.158

;; Query time: 1629 msec

;; SERVER: 8.8.4.4#53(8.8.4.4)

;; WHEN: Wed Dec  9 12:50:52 2009

;; MSG SIZE  rcvd: 60

 

指定dns服务器208.67.222.222查询www.qq.com

woodys-MacBook-Pro:~ woody$ dig @208.67.222.222 www.qq.com

; <<>> DiG 9.6.0-APPLE-P2 <<>> @208.67.222.222 www.qq.com

; (1 server found)

;; global options: +cmd

;; Got answer:

;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 49872

;; flags: qr rd ra; QUERY: 1, ANSWER: 2, AUTHORITY: 0, ADDITIONAL: 0

;; QUESTION SECTION:

;www.qq.com. IN A

;; ANSWER SECTION:

www.qq.com. 256 IN A 60.28.14.159（天津网通）

www.qq.com. 256 IN A 60.28.14.158

;; Query time: 245 msec

;; SERVER: 208.67.222.222#53(208.67.222.222)

;; WHEN: Wed Dec  9 12:28:58 2009

;; MSG SIZE  rcvd: 60

 

指定dns服务器208.67.220.220查询www.qq.com

woodys-MacBook-Pro:~ woody$ dig @208.67.220.220 www.qq.com

; <<>> DiG 9.6.0-APPLE-P2 <<>> @208.67.220.220 www.qq.com

; (1 server found)

;; global options: +cmd

;; Got answer:

;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 41237

;; flags: qr rd ra; QUERY: 1, ANSWER: 2, AUTHORITY: 0, ADDITIONAL: 0

;; QUESTION SECTION:

;www.qq.com. IN A

;; ANSWER SECTION:

www.qq.com. 79 IN A 60.28.14.159（天津网通）

www.qq.com. 79 IN A 60.28.14.158

;; Query time: 230 msec

;; SERVER: 208.67.220.220#53(208.67.220.220)

;; WHEN: Wed Dec  9 12:30:04 2009

;; MSG SIZE  rcvd: 60

 

指定dns服务器202.96.128.86 查询www.qq.com

woodys-MacBook-Pro:~ woody$ dig @202.96.128.86 www.qq.com

; <<>> DiG 9.6.0-APPLE-P2 <<>> @202.96.128.86 www.qq.com

; (1 server found)

;; global options: +cmd

;; Got answer:

;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 21203

;; flags: qr rd ra; QUERY: 1, ANSWER: 3, AUTHORITY: 0, ADDITIONAL: 0

;; QUESTION SECTION:

;www.qq.com. IN A

;; ANSWER SECTION:

www.qq.com. 258 IN A 119.147.15.13（深圳电信）

www.qq.com. 258 IN A 119.147.15.17

www.qq.com. 258 IN A 119.147.74.18

;; Query time: 1588 msec

;; SERVER: 202.96.128.86#53(202.96.128.86)

;; WHEN: Wed Dec  9 12:53:07 2009

;; MSG SIZE  rcvd: 76

 

指定dns服务器202.106.195.68查询www.qq.com

woodys-MacBook-Pro:~ woody$ dig @202.106.195.68 www.qq.com

; <<>> DiG 9.6.0-APPLE-P2 <<>> @202.106.195.68 www.qq.com

; (1 server found)

;; global options: +cmd

;; Got answer:

;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 12247

;; flags: qr rd ra; QUERY: 1, ANSWER: 2, AUTHORITY: 0, ADDITIONAL: 0

;; QUESTION SECTION:

;www.qq.com. IN A

;; ANSWER SECTION:

www.qq.com. 120 IN A 60.28.14.158（天津网通）

www.qq.com. 120 IN A 61.135.167.36（北京网通）

;; Query time: 206 msec

;; SERVER: 202.106.195.68#53(202.106.195.68)

;; WHEN: Wed Dec  9 13:17:54 2009

;; MSG SIZE  rcvd: 60

——————————————————————————————————

跟踪模式

woodys-MacBook-Pro:~ woody$ dig @8.8.8.8 www.qq.com +trace

; <<>> DiG 9.6.0-APPLE-P2 <<>> @8.8.8.8 www.qq.com +trace

; (1 server found)

;; global options: +cmd

. 228170 IN NS A.ROOT-SERVERS.NET.（根域名服务器）

. 228170 IN NS H.ROOT-SERVERS.NET.

. 228170 IN NS L.ROOT-SERVERS.NET.

. 228170 IN NS M.ROOT-SERVERS.NET.

. 228170 IN NS G.ROOT-SERVERS.NET.

. 228170 IN NS C.ROOT-SERVERS.NET.

. 228170 IN NS D.ROOT-SERVERS.NET.

. 228170 IN NS J.ROOT-SERVERS.NET.

. 228170 IN NS I.ROOT-SERVERS.NET.

. 228170 IN NS B.ROOT-SERVERS.NET.

. 228170 IN NS F.ROOT-SERVERS.NET.

. 228170 IN NS E.ROOT-SERVERS.NET.

. 228170 IN NS K.ROOT-SERVERS.NET.

;; Received 228 bytes from 8.8.8.8#53(8.8.8.8) in 76 ms

com. 172800 IN NS J.GTLD-SERVERS.NET.

com. 172800 IN NS F.GTLD-SERVERS.NET.

com. 172800 IN NS I.GTLD-SERVERS.NET.

com. 172800 IN NS G.GTLD-SERVERS.NET.（Delegation Record for .COM）

com. 172800 IN NS A.GTLD-SERVERS.NET.

com. 172800 IN NS M.GTLD-SERVERS.NET.

com. 172800 IN NS C.GTLD-SERVERS.NET.

com. 172800 IN NS H.GTLD-SERVERS.NET.

com. 172800 IN NS D.GTLD-SERVERS.NET.

com. 172800 IN NS L.GTLD-SERVERS.NET.

com. 172800 IN NS K.GTLD-SERVERS.NET.

com. 172800 IN NS E.GTLD-SERVERS.NET.

com. 172800 IN NS B.GTLD-SERVERS.NET.(管理dns1.imok.net)

;; Received 488 bytes from 192.112.36.4#53(G.ROOT-SERVERS.NET) in 84 ms

qq.com. 172800 IN NS dns1.imok.net.（管理qq域的域名服务器）

qq.com. 172800 IN NS dns2.imok.net.

qq.com. 172800 IN NS dns3.imok.net.

;; Received 141 bytes from 192.33.14.30#53(B.GTLD-SERVERS.NET) in 104 ms

www.qq.com. 86400 IN NS ns-cnc2.qq.com.（qq域内的域名服务器）

www.qq.com. 86400 IN NS ns-cnc1.qq.com.

;; Received 104 bytes from 218.30.72.181#53(dns3.imok.net) in 115 ms

www.qq.com. 300 IN A 119.147.15.17（与直接在8.8.8.8缓存中查询的结果60.28.14.159不一样）

www.qq.com. 300 IN A 119.147.74.18

www.qq.com. 300 IN A 119.147.15.13

;; Received 76 bytes from 60.28.234.10#53(ns-cnc2.qq.com) in 114 ms

 

跟踪模式

woodys-MacBook-Pro:~ woody$ dig @8.8.8.8 qq.com +trace

; <<>> DiG 9.6.0-APPLE-P2 <<>> @8.8.8.8 qq.com +trace

; (1 server found)

;; global options: +cmd

. 221208 IN NS a.root-servers.net.

. 221208 IN NS b.root-servers.net.

. 221208 IN NS c.root-servers.net.

. 221208 IN NS d.root-servers.net.

. 221208 IN NS e.root-servers.net.

. 221208 IN NS f.root-servers.net.

. 221208 IN NS g.root-servers.net.

. 221208 IN NS h.root-servers.net.

. 221208 IN NS i.root-servers.net.

. 221208 IN NS j.root-servers.net.

. 221208 IN NS k.root-servers.net.

. 221208 IN NS l.root-servers.net.

. 221208 IN NS m.root-servers.net.

;; Received 228 bytes from 8.8.8.8#53(8.8.8.8) in 137 ms

com. 172800 IN NS K.GTLD-SERVERS.NET.

com. 172800 IN NS H.GTLD-SERVERS.NET.

com. 172800 IN NS M.GTLD-SERVERS.NET.

com. 172800 IN NS J.GTLD-SERVERS.NET.

com. 172800 IN NS A.GTLD-SERVERS.NET.

com. 172800 IN NS E.GTLD-SERVERS.NET.

com. 172800 IN NS F.GTLD-SERVERS.NET.

com. 172800 IN NS C.GTLD-SERVERS.NET.

com. 172800 IN NS G.GTLD-SERVERS.NET.

com. 172800 IN NS D.GTLD-SERVERS.NET.

com. 172800 IN NS L.GTLD-SERVERS.NET.

com. 172800 IN NS I.GTLD-SERVERS.NET.

com. 172800 IN NS B.GTLD-SERVERS.NET.

;; Received 512 bytes from 192.36.148.17#53(i.root-servers.net) in 99 ms

qq.com. 172800 IN NS dns1.imok.net.

qq.com. 172800 IN NS dns2.imok.net.

qq.com. 172800 IN NS dns3.imok.net.

;; Received 137 bytes from 192.55.83.30#53(M.GTLD-SERVERS.NET) in 391 ms

qq.com. 43200 IN A 60.28.188.192（天津网通）

qq.com. 43200 IN A 60.28.188.9

qq.com. 43200 IN NS dns2.imok.net.

qq.com. 43200 IN NS dns1.imok.net.

qq.com. 43200 IN NS dns3.imok.net.

;; Received 169 bytes from 218.30.72.181#53(dns3.imok.net) in 111 ms

dig命令加“+trace”参数，追踪出整个域名查询的过程。对www.qq.com的最终查询结果与直接在8.8.8.8缓存查询结果是不一样的。

在看一下对www.google.com的追踪查询结果。

woodys-MacBook-Pro:~ woody$ dig @8.8.8.8 www.google.com +trace

; <<>> DiG 9.6.0-APPLE-P2 <<>> @8.8.8.8 www.google.com +trace

; (1 server found)

;; global options: +cmd

. 221138 IN NS A.ROOT-SERVERS.NET.

. 221138 IN NS H.ROOT-SERVERS.NET.

. 221138 IN NS L.ROOT-SERVERS.NET.

. 221138 IN NS M.ROOT-SERVERS.NET.

. 221138 IN NS G.ROOT-SERVERS.NET.

. 221138 IN NS C.ROOT-SERVERS.NET.

. 221138 IN NS D.ROOT-SERVERS.NET.

. 221138 IN NS J.ROOT-SERVERS.NET.

. 221138 IN NS I.ROOT-SERVERS.NET.

. 221138 IN NS B.ROOT-SERVERS.NET.

. 221138 IN NS F.ROOT-SERVERS.NET.

. 221138 IN NS E.ROOT-SERVERS.NET.

. 221138 IN NS K.ROOT-SERVERS.NET.

;; Received 228 bytes from 8.8.8.8#53(8.8.8.8) in 113 ms

com. 172800 IN NS E.GTLD-SERVERS.NET.

com. 172800 IN NS J.GTLD-SERVERS.NET.

com. 172800 IN NS I.GTLD-SERVERS.NET.

com. 172800 IN NS B.GTLD-SERVERS.NET.

com. 172800 IN NS D.GTLD-SERVERS.NET.

com. 172800 IN NS C.GTLD-SERVERS.NET.

com. 172800 IN NS M.GTLD-SERVERS.NET.

com. 172800 IN NS H.GTLD-SERVERS.NET.

com. 172800 IN NS K.GTLD-SERVERS.NET.

com. 172800 IN NS F.GTLD-SERVERS.NET.

com. 172800 IN NS L.GTLD-SERVERS.NET.

com. 172800 IN NS A.GTLD-SERVERS.NET.

com. 172800 IN NS G.GTLD-SERVERS.NET.

;; Received 504 bytes from 192.203.230.10#53(E.ROOT-SERVERS.NET) in 540 ms

google.com. 172800 IN NS ns1.google.com.

google.com. 172800 IN NS ns2.google.com.

google.com. 172800 IN NS ns3.google.com.

google.com. 172800 IN NS ns4.google.com.

;; Received 168 bytes from 192.43.172.30#53(I.GTLD-SERVERS.NET) in 411 ms

www.google.com. 604800 IN CNAME www.l.google.com.

www.l.google.com. 300 IN A 64.233.189.103

www.l.google.com. 300 IN A 64.233.189.104

www.l.google.com. 300 IN A 64.233.189.99

www.l.google.com. 300 IN A 64.233.189.147

;; Received 116 bytes from 216.239.38.10#53(ns4.google.com) in 149 ms

对比刚才对www.qq.com的追踪查询，可以刊出对www.google.com的查询结果更为扁平，从x.gtld-servers.net.直接返回nsx.google.com等google自己的域名服务器，而qq则多了一层dnsx.imok.net。

woodys-MacBook-Pro:~ woody$ dig @8.8.8.8 www.baidu.com +trace

; <<>> DiG 9.6.0-APPLE-P2 <<>> @8.8.8.8 www.baidu.com +trace

; (1 server found)

;; global options: +cmd

. 220913 IN NS A.ROOT-SERVERS.NET.

. 220913 IN NS H.ROOT-SERVERS.NET.

. 220913 IN NS L.ROOT-SERVERS.NET.

. 220913 IN NS M.ROOT-SERVERS.NET.

. 220913 IN NS G.ROOT-SERVERS.NET.

. 220913 IN NS C.ROOT-SERVERS.NET.

. 220913 IN NS D.ROOT-SERVERS.NET.

. 220913 IN NS J.ROOT-SERVERS.NET.

. 220913 IN NS I.ROOT-SERVERS.NET.

. 220913 IN NS B.ROOT-SERVERS.NET.

. 220913 IN NS F.ROOT-SERVERS.NET.

. 220913 IN NS E.ROOT-SERVERS.NET.

. 220913 IN NS K.ROOT-SERVERS.NET.

;; Received 228 bytes from 8.8.8.8#53(8.8.8.8) in 110 ms

com. 172800 IN NS J.GTLD-SERVERS.NET.

com. 172800 IN NS L.GTLD-SERVERS.NET.

com. 172800 IN NS G.GTLD-SERVERS.NET.

com. 172800 IN NS B.GTLD-SERVERS.NET.

com. 172800 IN NS C.GTLD-SERVERS.NET.

com. 172800 IN NS I.GTLD-SERVERS.NET.

com. 172800 IN NS D.GTLD-SERVERS.NET.

com. 172800 IN NS F.GTLD-SERVERS.NET.

com. 172800 IN NS H.GTLD-SERVERS.NET.

com. 172800 IN NS E.GTLD-SERVERS.NET.

com. 172800 IN NS K.GTLD-SERVERS.NET.

com. 172800 IN NS M.GTLD-SERVERS.NET.

com. 172800 IN NS A.GTLD-SERVERS.NET.

;; Received 503 bytes from 192.203.230.10#53(E.ROOT-SERVERS.NET) in 542 ms

baidu.com. 172800 IN NS dns.baidu.com.

baidu.com. 172800 IN NS ns2.baidu.com.

baidu.com. 172800 IN NS ns3.baidu.com.

baidu.com. 172800 IN NS ns4.baidu.com.

;; Received 167 bytes from 192.43.172.30#53(I.GTLD-SERVERS.NET) in 415 ms

www.baidu.com. 1200 IN CNAME www.a.shifen.com.

a.shifen.com. 86411 IN NS ns5.a.shifen.com.

a.shifen.com. 86411 IN NS ns6.a.shifen.com.

a.shifen.com. 86411 IN NS ns1.a.shifen.com.

a.shifen.com. 86411 IN NS ns3.a.shifen.com.

;; Received 194 bytes from 202.108.22.220#53(dns.baidu.com) in 75 ms

看以下对www.baidu.com的追踪查询，结果与google类似。

标签： dig, DNS

Google安全博客讨论了最近CA认证机构Comodo遭黑客入侵的事件，提出了两种改进SSL证书安全性的方法。第一种方法是Google Certificate Catalog，Google爬虫在索引互联网的同时会记录所有的SSL证书，Google Certificate Catalog就是这些证书的数据库。如果一个证书没有出现在Google的数据库内，即使有正确的CA签名，它极有可能是伪造的。Google正考虑在Chrome浏览器中加入Google Certificate Catalog数据库支持功能，其它浏览器未来可能跟进。第二种方法是互联网工程任务组(IETF)正在讨论的DANE，DANE代表基于DNS的域名实体认证，允许域名商发布SSL证书信息，利用DNS记录鉴定特定证书是否有效。这两种方法都是依靠DNS记录，但DNS可能会被污染，安全性值得质疑，Google认为加密保护DNS数据的DNSSEC协议可以解决安全问题。

标签： DNS, SSL

《MIT技术评论》报道，互联网的核心元素，帮助百万电脑系统定位的DNS（域名服务器）迫切需要升级。DNS就像互联网的电话簿，将输入浏览器的URL转换成数字地址，识别请求访问网站的服务器。最近DNS暴露出的严重漏洞显示，这一有30年历史的系统已经显露出它的疲态。 DNS问题在于用户无法知道应答的来源是否正确或者是否包含正确的数据，即毫无防备的用户在冲浪时会被引入到其它恶意网站，或出于某种目的设立的网址（如令用户痛恨不已的DNS劫持事件）。现在多数专家都指望带有数字签名验证的域名系统安全协议（Domain Name System SECurity，DNSSEC）能修正该问题。Dan Kaminsky曾对DNSSEC持中立，但现在认为它是一个好的解决方法。是时候让DNS变得更安全了。

标签： DNS