使用 Azure DNS 委托 DNS 区域Delegation of DNS zones with Azure DNS

使用 Azure DNS 可以托管 DNS 区域,以及管理 Azure 中域的 DNS 记录。Azure DNS allows you to host a DNS zone and manage the DNS records for a domain in Azure. 要使域的 DNS 查询才能抵达 Azure DNS,必须将该域从其父域委托给 Azure DNS。In order for DNS queries for a domain to reach Azure DNS, the domain has to be delegated to Azure DNS from the parent domain. 请记住,Azure DNS 不是域注册机构。Keep in mind Azure DNS is not the domain registrar. 本文介绍域委托的工作原理,以及如何将域委托给 Azure DNS。This article explains how domain delegation works and how to delegate domains to Azure DNS.

DNS 委托的工作原理How DNS delegation works

域和区域Domains and zones

域名系统是域的层次结构。The Domain Name System is a hierarchy of domains. 该层次结构从名为“.”的“根”域开始。The hierarchy starts from the 'root' domain, whose name is simply '.'. 根域的下面是顶级域,例如“com”、“net”、“org”、“uk”或“jp”。Below this come top-level domains, such as 'com', 'net', 'org', 'uk' or 'jp'. 这些顶级域的下面是二级域,例如“org.uk”或“co.jp”。Below these top-level domains are second-level domains, such as 'org.uk' or 'co.jp'. 依此类推。And so on. DNS 层次结构中的域托管在不同的 DNS 区域。The domains in the DNS hierarchy are hosted using separate DNS zones. 这些区域遍布全球,由世界各地的 DNS 名称服务器托管。These zones are globally distributed, hosted by DNS name servers around the world.

DNS 区域 - 域在域名系统中具有一个唯一名称,例如“contoso.com”。DNS zone - A domain is a unique name in the Domain Name System, for example 'contoso.com'. DNS 区域用来托管某个特定域的 DNS 记录。A DNS zone is used to host the DNS records for a particular domain. 例如,域“contoso.com”可能包含几条 DNS 记录,如“mail.contoso.com”(用于邮件服务器)和“www.contoso.com”(用于网站)。For example, the domain 'contoso.com' may contain several DNS records such as 'mail.contoso.com' (for a mail server) and 'www.contoso.com' (for a website).

域注册机构 - 域注册机构是可以提供 Internet 域名的公司。Domain registrar - A domain registrar is a company who can provide Internet domain names. 它们会验证所要使用的 Internet 域是否可用,以及是否允许购买。They verify if the Internet domain you want to use is available and allow you to purchase it. 注册域名后,注册者即是该域名的合法所有者。Once the domain name is registered, you are the legal owner for the domain name. 如果已有一个 Internet 域,将使用当前的域注册机构将该域委托给 Azure DNS。If you already have an Internet domain, you will use the current domain registrar to delegate to Azure DNS.

有关认证的域注册机构的详细信息,请参阅 ICANN 认证的注册机构For more information about accredited domain registrars, see ICANN-Accredited Registrars.

解析和委托Resolution and delegation

有两种类型的 DNS 服务器:There are two types of DNS servers:

  • 权威 DNS 服务器托管 DNS 区域。An authoritative DNS server hosts DNS zones. 它只应答这些区域中的 DNS 记录查询。It answers DNS queries for records in those zones only.
  • 递归 DNS 服务器不托管 DNS 区域。A recursive DNS server does not host DNS zones. 它调用权威 DNS 服务器来收集所需的数据,以应答所有 DNS 查询。It answers all DNS queries by calling authoritative DNS servers to gather the data it needs.

Azure DNS 提供权威 DNS 服务。Azure DNS provides an authoritative DNS service. 它不提供递归 DNS 服务。It does not provide a recursive DNS service. Azure 中的云服务和 VM 自动配置为使用 Azure 基础结构中单独提供的递归 DNS 服务。Cloud Services and VMs in Azure are automatically configured to use a recursive DNS service that is provided separately as part of Azure's infrastructure. 有关如何更改这些 DNS 设置的详细信息,请参阅 Name Resolution in Azure(Azure 中的名称解析)。For information on how to change these DNS settings, see Name Resolution in Azure.

电脑或移动设备中的 DNS 客户端通常调用递归 DNS 服务器来执行客户端应用程序所需的任何 DNS 查询。DNS clients in PCs or mobile devices typically call a recursive DNS server to perform any DNS queries the client applications need.

当递归 DNS 服务器收到 DNS 记录查询时(例如“www.contoso.com”),必须先找到托管“contoso.com”域的区域的名称服务器。When a recursive DNS server receives a query for a DNS record such as 'www.contoso.com', it first needs to find the name server hosting the zone for the 'contoso.com' domain. 若要查找名称服务器,请从根名称服务器开始,接着查找托管“com”区域的名称服务器。To find the name server, it starts at the root name servers, and from there finds the name servers hosting the 'com' zone. 然后,查询“com”名称服务器,查找托管“contoso.com”区域的名称服务器。It then queries the 'com' name servers to find the name servers hosting the 'contoso.com' zone. 最后,它便可以向这些名称服务器查询“www.contoso.com”。Finally, it is able to query these name servers for 'www.contoso.com'.

此过程称为 DNS 名称解析。This procedure is called resolving the DNS name. 严格地说,DNS 解析还有其他步骤,例如跟踪 CNAME,但这对于了解 DNS 委托的工作原理并不重要。Strictly speaking, DNS resolution includes additional steps such as following CNAMEs, but that's not important to understanding how DNS delegation works.

父区域如何“指向”子区域的名称服务器?How does a parent zone 'point' to the name servers for a child zone? 方法是使用一种特殊的 DNS 记录,名为 NS 记录(NS 代表“名称服务器”)。It does this using a special type of DNS record called an NS record (NS stands for 'name server'). 例如,根区域包含“com”的 NS 记录,并显示“com”区域的名称服务器。For example, the root zone contains NS records for 'com' and shows the name servers for the 'com' zone. 而“com”区域又包含“contoso.com”的 NS 记录,其中显示“contoso.com”区域的名称服务器。In turn, the 'com' zone contains NS records for 'contoso.com', which shows the name servers for the 'contoso.com' zone. 在父区域中设置子区域的 NS 记录称为委托域。Setting up the NS records for a child zone in a parent zone is called delegating the domain.

下图显示了一个 DNS 查询示例。The following image shows an example DNS query. contoso.net 和 partners.contoso.net 为 Azure DNS 区域。The contoso.net and partners.contoso.net are Azure DNS zones.

Dns-nameserver

  1. 客户端从其本地 DNS 服务器请求 www.partners.contoso.netThe client requests www.partners.contoso.net from their local DNS server.
  2. 本地 DNS 服务器没有记录,因此向其根名称服务器发出请求。The local DNS server does not have the record so it makes a request to their root name server.
  3. 根名称服务器没有记录,但知道 .net 名称服务器的地址,于是将该地址提供给 DNS 服务器The root name server does not have the record, but knows the address of the .net name server, it provides that address to the DNS server
  4. 本地 DNS 服务器将请求发送到 .net 名称服务器。The local DNS server sends the request to the .net name server.
  5. .net 名称服务器没有该记录,但知道 contoso.net 名称服务器的地址。The .net name server does not have the record but does know the address of the contoso.net name server. 在这种情况下,它会响应 Azure DNS 中托管的 DNS 区域的名称服务器的地址。In this case, it responds with the address of the name server for the DNS zone hosted in Azure DNS.
  6. 本地 DNS 服务器将请求发送到 Azure DNS 中托管的 contoso.net 区域的名称服务器。The local DNS server sends the request to the name server for the contoso.net zone hosted in Azure DNS.
  7. 区域 contoso.net 没有记录,但知道 partners.contoso.net 的名称服务器,于是使用地址进行响应。The zone contoso.net does not have the record but knows the name server for partners.contoso.net and responds with the address. 本示例中为托管在 Azure DNS 中的 DNS 区域。In this case, it is a DNS zone hosted in Azure DNS.
  8. 本地 DNS 服务器将请求发送到 partners.contoso.net 区域的名称服务器。The local DNS server sends the request to the name server for the partners.contoso.net zone.
  9. partners.contoso.net 区域具有 A 记录,并使用 IP 地址进行响应。The partners.contoso.net zone has the A record and responds with the IP address.
  10. 本地 DNS 服务器为客户端提供 IP 地址The local DNS server provides the IP address to the client
  11. 客户端连接到网站 www.partners.contoso.netThe client connects to the website www.partners.contoso.net.

每个委托实际上有两份 NS 记录:一份在父区域中指向子区域,另一份在子区域本身。Each delegation actually has two copies of the NS records; one in the parent zone pointing to the child, and another in the child zone itself. “contoso.net”区域包含“contoso.net”的 NS 记录(“net”中的 NS 记录除外)。The 'contoso.net' zone contains the NS records for 'contoso.net' (in addition to the NS records in 'net'). 这些记录称为权威 NS 记录,位于子区域的顶点处。These records are called authoritative NS records and they sit at the apex of the child zone.

后续步骤Next steps

了解如何将域委托给 Azure DNSLearn how to delegate your domain to Azure DNS