使用 Azure CLI 导入和导出 DNS 区域文件Import and export a DNS zone file using the Azure CLI

本文介绍如何使用 Azure CLI 导入和导出 Azure DNS 的 DNS 区域文件。This article walks you through how to import and export DNS zone files for Azure DNS using the Azure CLI.

DNS 区域迁移简介Introduction to DNS zone migration

DNS 区域文件是一个文本文件,其中包含区域中每个域名系统 (DNS) 记录的详细信息。A DNS zone file is a text file that contains details of every Domain Name System (DNS) record in the zone. 它会遵循标准格式,使其适合在 DNS 系统之间传输 DNS 记录。It follows a standard format, making it suitable for transferring DNS records between DNS systems. 使用区域文件是从 Azure DNS 传入或传出 DNS 区域的快速、可靠和方便的方法。Using a zone file is a quick, reliable, and convenient way to transfer a DNS zone into or out of Azure DNS.

Azure DNS 支持通过使用 Azure 命令行接口 (CLI) 导入和导出区域文件。Azure DNS supports importing and exporting zone files by using the Azure command-line interface (CLI). 当前支持通过 Azure PowerShell 或 Azure 门户导入区域文件。Zone file import is not currently supported via Azure PowerShell or the Azure portal.

Azure CLI 是用于管理 Azure 服务的跨平台命令行工具。The Azure CLI is a cross-platform command-line tool used for managing Azure services. 它适用于 Windows、Mac 和 Linux 平台,可以从 Azure 下载页获取。It is available for the Windows, Mac, and Linux platforms from the Azure downloads page. 跨平台支持对导入和导出区域文件很重要,因为最常见的名称服务器软件 BIND 通常在 Linux 上运行。Cross-platform support is important for importing and exporting zone files, because the most common name server software, BIND, typically runs on Linux.

获取现有的 DNS 区域文件Obtain your existing DNS zone file

将 DNS 区域文件导入 Azure DNS 之前,需要获取区域文件的副本。Before you import a DNS zone file into Azure DNS, you need to obtain a copy of the zone file. 此文件的来源取决于当前托管 DNS 区域的位置。The source of this file depends on where the DNS zone is currently hosted.

  • 如果 DNS 区域由合作伙伴服务(如域注册机构、专用的 DNS 托管提供商或备用云提供商)托管,则该服务应提供下载 DNS 区域文件的功能。If your DNS zone is hosted by a partner service (such as a domain registrar, dedicated DNS hosting provider, or alternative cloud provider), that service should provide the ability to download the DNS zone file.
  • 如果 DNS 区域是在 Windows DNS 上托管的,则区域文件的默认文件夹是 %systemroot%\system32\dnsIf your DNS zone is hosted on Windows DNS, the default folder for the zone files is %systemroot%\system32\dns. 每个区域文件的完整路径还会显示在 DNS 控制台的“常规” 选项卡上。The full path to each zone file also shows on the General tab of the DNS console.
  • 如果 DNS 区域是通过使用 BIND 托管的,则在 BIND 配置文件 named.conf 中会指定每个区域的区域文件位置。If your DNS zone is hosted by using BIND, the location of the zone file for each zone is specified in the BIND configuration file named.conf.

将 DNS 区域文件导入 Azure DNSImport a DNS zone file into Azure DNS

导入区域文件时会在 Azure DNS 中新建一个区域(如果区域尚不存在)。Importing a zone file creates a new zone in Azure DNS if one does not already exist. 如果区域已存在,则区域文件中的记录集必须与现有的记录集合并。If the zone already exists, the record sets in the zone file must be merged with the existing record sets.

合并行为Merge behavior

  • 默认情况下,将合并现有的和新的记录集。By default, existing and new record sets are merged. 合并的记录集内的相同记录会执行重复数据删除。Identical records within a merged record set are de-duplicated.
  • 合并记录集时,会使用以前存在的记录集的生存时间 (TTL)。When record sets are merged, the time to live (TTL) of preexisting record sets is used.
  • 起始授权机构 (SOA) 参数(除了 host)始终取自导入的区域文件。Start of Authority (SOA) parameters (except host) are always taken from the imported zone file. 同样,对于区域顶点处的名称服务器记录集,TTL 始终取自导入的区域文件。Similarly, for the name server record set at the zone apex, the TTL is always taken from the imported zone file.
  • 导入的 CNAME 记录不会替换现有的同名 CNAME 记录。An imported CNAME record does not replace an existing CNAME record with the same name.
  • CNAME 记录与另一同名但类型不同的记录(无论是现有还是新建记录)发生冲突时,都会保留现有的记录。When a conflict arises between a CNAME record and another record of the same name but different type (regardless of which is existing or new), the existing record is retained.

有关导入的其他信息Additional information about importing

下面几点提供有关区域导入过程的其他技术详细信息。The following notes provide additional technical details about the zone import process.

  • $TTL 指令是可选的并受支持。The $TTL directive is optional, and it is supported. 如未提供 $TTL 指令,会导入没有显式 TTL 的记录,且其默认 TTL 设置为 3600 秒。When no $TTL directive is given, records without an explicit TTL are imported set to a default TTL of 3600 seconds. 当同一个记录集的两个记录指定不同的 TTL 时,会使用较低的值。When two records in the same record set specify different TTLs, the lower value is used.
  • $ORIGIN 指令是可选的并受支持。The $ORIGIN directive is optional, and it is supported. 如果未设置 $ORIGIN,则使用的默认值是在命令行上指定的区域名称(加上结尾 ".")。When no $ORIGIN is set, the default value used is the zone name as specified on the command line (plus the terminating ".").
  • $INCLUDE$GENERATE 指令不受支持。The $INCLUDE and $GENERATE directives are not supported.
  • 支持以下记录类型:A、AAAA、CAA、CNAME、MX、NS、SOA、SRV 和 TXT。These record types are supported: A, AAAA, CAA, CNAME, MX, NS, SOA, SRV, and TXT.
  • Azure DNS 会在创建区域时,自动创建 SOA 记录。The SOA record is created automatically by Azure DNS when a zone is created. 导入区域文件时,除了host 参数,所有的 SOA 参数都取自区域文件。When you import a zone file, all SOA parameters are taken from the zone file except the host parameter. 此参数会使用 Azure DNS 提供的值。This parameter uses the value provided by Azure DNS. 这是因为此参数必须引用 Azure DNS 提供的主名称服务器。This is because this parameter must refer to the primary name server provided by Azure DNS.
  • Azure DNS 在创建区域时,也会在区域顶点处自动创建名称服务器记录集。The name server record set at the zone apex is also created automatically by Azure DNS when the zone is created. 仅导入此记录集的 TTL。Only the TTL of this record set is imported. 这些记录包含由 Azure DNS 提供的名称服务器名称。These records contain the name server names provided by Azure DNS. 导入的区域文件中包含的值不会覆盖记录数据。The record data is not overwritten by the values contained in the imported zone file.
  • 在公开预览版期间,Azure DNS 仅支持单字符串的 TXT 记录。During Public Preview, Azure DNS supports only single-string TXT records. 多字符串 TXT 记录会被连接在一起并截断为 255 个字符。Multistring TXT records are be concatenated and truncated to 255 characters.

CLI 格式和值CLI format and values

用于导入 DNS 区域的 Azure CLI 命令的格式为:The format of the Azure CLI command to import a DNS zone is:

az network dns zone import -g <resource group> -n <zone name> -f <zone file name>

值:Values:

  • <resource group> 是 Azure DNS 中区域的资源组名称。<resource group> is the name of the resource group for the zone in Azure DNS.
  • <zone name> 是区域的名称。<zone name> is the name of the zone.
  • <zone file name> 是要导入的区域文件的路径/名称。<zone file name> is the path/name of the zone file to be imported.

如果资源组中不存在具有此名称的区域,会为你创建一个。If a zone with this name does not exist in the resource group, it is created for you. 如果区域已存在,则导入的记录集会与现有的记录集合并。If the zone already exists, the imported record sets are merged with existing record sets.

步骤 1。Step 1. 导入区域文件Import a zone file

导入区域 contoso.com 的区域文件。To import a zone file for the zone contoso.com.

  1. 如果还没有 Resource Manager 资源组,则需要创建一个。If you don't have one already, you need to create a Resource Manager resource group.

    az group create --resource-group myresourcegroup -l chinaeast
    
  2. 要将文件 contoso.com.txt 中的区域 contoso.com 导入到资源组 myresourcegroup 中的新 DNS 区域,请运行命令 az network dns zone importTo import the zone contoso.com from the file contoso.com.txt into a new DNS zone in the resource group myresourcegroup, you will run the command az network dns zone import.
    此命令将加载并分析区域文件。This command loads the zone file and parses it. 此命令在 Azure DNS 服务上执行一系列命令,以便创建区域和区域中的所有记录集。The command executes a series of commands on the Azure DNS service to create the zone and all the record sets in the zone. 此命令在控制台窗口中报告进度,以及任何错误或警告。The command reports progress in the console window, along with any errors or warnings. 由于记录集是以序列方式创建的,导入大型区域文件可能需要几分钟。Because record sets are created in series, it may take a few minutes to import a large zone file.

    az network dns zone import -g myresourcegroup -n contoso.com -f contoso.com.txt
    

步骤 2.Step 2. 验证该区域Verify the zone

若要在导入文件后验证 DNS 区域,可以使用以下方法之一:To verify the DNS zone after you import the file, you can use any one of the following methods:

  • 可以通过使用以下 Azure CLI 命令列出记录:You can list the records by using the following Azure CLI command:

    az network dns record-set list -g myresourcegroup -z contoso.com
    
  • 可以通过使用 Azure CLI 命令 az network dns record-set ns list 列出记录。You can list the records by using the Azure CLI command az network dns record-set ns list.

  • 可以使用 nslookup 验证记录的名称解析。You can use nslookup to verify name resolution for the records. 由于尚未委派区域,因此需要显式指定正确的 Azure DNS 名称服务器。Because the zone isn't delegated yet, you need to specify the correct Azure DNS name servers explicitly. 下面的示例演示如何检索已分配给该区域的名称服务器的名称。The following sample shows how to retrieve the name server names assigned to the zone. 另外,还会演示如何使用 nslookup 查询“www”记录。This also shows how to query the "www" record by using nslookup.

    az network dns record-set ns list -g myresourcegroup -z contoso.com  --output json 
    
    [
      {
       .......
       "name": "@",
        "nsRecords": [
          {
            "additionalProperties": {},
            "nsdname": "ns1-03.azure-dns.cn."
          },
          {
            "additionalProperties": {},
            "nsdname": "ns2-03.azure-dns.cn."
          },
          {
            "additionalProperties": {},
            "nsdname": "ns3-03.azure-dns.cn."
          },
          {
            "additionalProperties": {},
            "nsdname": "ns4-03.azure-dns.cn."
          }
        ],
        "resourceGroup": "myresourcegroup",
        "ttl": 86400,
        "type": "Microsoft.Network/dnszones/NS"
      }
    ]
    
    nslookup www.contoso.com ns1-03.azure-dns.cn
    
        Server: ns1-01.azure-dns.cn
        Address:  40.90.4.1
    
        Name:www.contoso.com
        Addresses:  134.170.185.46
        134.170.188.221
    

步骤 3.Step 3. 更新 DNS 委派Update DNS delegation

验证该区域已正确导入后,需要更新 DNS 委派以指向 Azure DNS 名称服务器。After you have verified that the zone has been imported correctly, you need to update the DNS delegation to point to the Azure DNS name servers. 有关详细信息,请参阅文章更新 DNS 委派For more information, see the article Update the DNS delegation.

从 Azure DNS 导出 DNS 区域文件Export a DNS zone file from Azure DNS

用于导出 DNS 区域的 Azure CLI 命令的格式为:The format of the Azure CLI command to export a DNS zone is:

az network dns zone export -g <resource group> -n <zone name> -f <zone file name>

值:Values:

  • <resource group> 是 Azure DNS 中区域的资源组名称。<resource group> is the name of the resource group for the zone in Azure DNS.
  • <zone name> 是区域的名称。<zone name> is the name of the zone.
  • <zone file name> 是要导出的区域文件的路径/名称。<zone file name> is the path/name of the zone file to be exported.

和区域导入一样,必须先登录,选择订阅,然后配置 Azure CLI 以使用 Resource Manager 模式。As with the zone import, you first need to sign in, choose your subscription, and configure the Azure CLI to use Resource Manager mode.

导出区域文件To export a zone file

要将资源组 myresourcegroup 中现有的 Azure DNS 区域 contoso.com 导出至文件 contoso.com.txt(在当前文件夹中),请运行 azure network dns zone exportTo export the existing Azure DNS zone contoso.com in resource group myresourcegroup to the file contoso.com.txt (in the current folder), run azure network dns zone export. 此命令调用 Azure DNS 服务,以枚举该区域中的记录集,并将结果导出到兼容 BIND 的区域文件。This command calls the Azure DNS service to enumerate record sets in the zone and export the results to a BIND-compatible zone file.

az network dns zone export -g myresourcegroup -n contoso.com -f contoso.com.txt

后续步骤Next steps