为 Azure 中托管的服务配置反向 DNSConfigure reverse DNS for services hosted in Azure

备注

本文进行了更新,以便使用新的 Azure PowerShell Az 模块。This article has been updated to use the new Azure PowerShell Az module. 你仍然可以使用 AzureRM 模块,至少在 2020 年 12 月之前,它将继续接收 bug 修补程序。You can still use the AzureRM module, which will continue to receive bug fixes until at least December 2020. 若要详细了解新的 Az 模块和 AzureRM 兼容性,请参阅新 Azure Powershell Az 模块简介To learn more about the new Az module and AzureRM compatibility, see Introducing the new Azure PowerShell Az module. 有关 Az 模块安装说明,请参阅安装 Azure PowerShellFor Az module installation instructions, see Install Azure PowerShell.

本文介绍如何为 Azure 中托管的服务配置反向 DNS 查找。This article explains how to configure reverse DNS lookups for services hosted in Azure.

Azure 中的服务使用由 Azure 分配并拥有的 IP 地址。Services in Azure use IP addresses assigned and owned by Azure. 必须在相应的 Azure 拥有的反向 DNS 查找区域中创建这些反向 DNS 记录(PTR 记录)。These reverse DNS records (PTR records) must be created in the corresponding Azure-owned reverse DNS lookup zones. 本文介绍如何执行此操作。This article explains how to do this.

不要将这种情况与在 Azure DNS 中托管分配的 IP 范围的反向 DNS 查找区域的能力相混淆。This scenario should not be confused with the ability to host the reverse DNS lookup zones for your assigned IP ranges in Azure DNS. 在这种情况下,必须将由反向查找区域表示的 IP 范围分配给组织(通常通过 ISP 执行)。In this case, the IP ranges represented by the reverse lookup zone must be assigned to your organization, typically by your ISP.

阅读本文之前,应已熟悉此反向 DNS 和 Azure 支持概述Before reading this article, you should be familiar with this Overview of reverse DNS and support in Azure.

在 Azure DNS 中,通过 PublicIpAddress 资源公开计算资源(如虚拟机、虚拟机规模集或 Service Fabric 群集)。In Azure DNS, compute resources (such as virtual machines, virtual machine scale sets, or Service Fabric clusters) are exposed via a PublicIpAddress resource. 使用 PublicIpAddress 的“ReverseFqdn”属性配置反向 DNS 查找。Reverse DNS lookups are configured using the 'ReverseFqdn' property of the PublicIpAddress.

Azure 应用服务目前不支持反向 DNS。Reverse DNS is not currently supported for the Azure App Service.

反向 DNS 记录的验证Validation of reverse DNS records

第三方不应具备这样的能力,即为其映射到 DNS 域的 Azure 服务创建反向 DNS 记录。A third party should not be able to create reverse DNS records for their Azure service mapping to your DNS domains. 为防止这种情况,Azure 仅允许创建满足以下条件的反向 DNS 记录,即反向 DNS 记录中指定的域名必须同于或可解析为同一 Azure 订阅中 PublicIpAddress 或云服务的 DNS 名称或 IP 地址。To prevent this, Azure only allows the creation of a reverse DNS record where domain name specified in the reverse DNS record is the same as, or resolves to, the DNS name or IP address of a PublicIpAddress or Cloud Service in the same Azure subscription.

仅在设置或修改反向 DNS 记录时执行此验证。This validation is only performed when the reverse DNS record is set or modified. 不执行定期重新验证。Periodic re-validation is not performed.

例如:假定 PublicIpAddress 资源的 DNS 名称为 contosoapp1.chinaeast.cloudapp.chinacloudapi.cn,IP 地址为 23.96.52.53。For example: suppose the PublicIpAddress resource has the DNS name contosoapp1.chinaeast.cloudapp.chinacloudapi.cn and IP address 23.96.52.53. PublicIpAddress 的 ReverseFqdn 可指定为:The ReverseFqdn for the PublicIpAddress can be specified as:

  • PublicIpAddress 的 DNS 名称 contosoapp1.chinaeast.cloudapp.chinacloudapi.cnThe DNS name for the PublicIpAddress, contosoapp1.chinaeast.cloudapp.chinacloudapi.cn
  • 同一订阅中另一个 PublicIpAddress 的 DNS 名称,如 contosoapp2.chinaeast.cloudapp.chinacloudapi.cnThe DNS name for a different PublicIpAddress in the same subscription, such as contosoapp2.chinaeast.cloudapp.chinacloudapi.cn
  • 虚 DNS 名称(如 app1.contoso.com),只要此名称已先配置为指向 contosoapp1.chinaeast.cloudapp.chinacloudapi.cn 或同一订阅中另一个 PublicIpAddress 的 CNAME 。A vanity DNS name, such as app1.contoso.com, so long as this name is first configured as a CNAME to contosoapp1.chinaeast.cloudapp.chinacloudapi.cn, or to a different PublicIpAddress in the same subscription.
  • 虚 DNS 名称(如 app1.contoso.com),只要此名称已提前配置为指向 IP 地址 23.96.52.53 或同一订阅中另一个 PublicIpAddress 的 IP 地址的 A 记录 。A vanity DNS name, such as app1.contoso.com, so long as this name is first configured as an A record to the IP address 23.96.52.53, or to the IP address of a different PublicIpAddress in the same subscription.

相同的约束也适用于云服务的反向 DNS。The same constraints apply to reverse DNS for Cloud Services.

PublicIpAddress 资源的反向 DNSReverse DNS for PublicIpAddress resources

本部分提供有关如何使用 Azure PowerShell、Azure 经典 CLI 或 Azure CLI 在资源管理器部署模型中配置 PublicIpAddress 资源的反向 DNS 的详细说明。This section provides detailed instructions for how to configure reverse DNS for PublicIpAddress resources in the Resource Manager deployment model, using either Azure PowerShell, Azure classic CLI, or Azure CLI. 目前不支持通过 Azure 门户配置 PublicIpAddress 资源的反向 DNS。Configuring reverse DNS for PublicIpAddress resources is not currently supported via the Azure portal.

Azure 当前仅支持为 IPv4 PublicIpAddress 资源配置反向 DNS。Azure currently supports reverse DNS only for IPv4 PublicIpAddress resources. IPv6 不支持此操作。It is not supported for IPv6.

将反向 DNS 添加到现有 PublicIpAddressesAdd reverse DNS to an existing PublicIpAddresses

PowerShellPowerShell

若要将反向 DNS 更新为现有 PublicIpAddress,请执行以下命令:To update reverse DNS to an existing PublicIpAddress:

$pip = Get-AzPublicIpAddress -Name "PublicIp" -ResourceGroupName "MyResourceGroup"
$pip.DnsSettings.ReverseFqdn = "contosoapp1.chinaeast.cloudapp.chinacloudapi.cn."
Set-AzPublicIpAddress -PublicIpAddress $pip

若要将反向 DNS 添加到尚不具有 DNS 名称的现有 PublicIpAddress,则还必须指定 DNS 名称:To add reverse DNS to an existing PublicIpAddress that doesn't already have a DNS name, you must also specify a DNS name:

$pip = Get-AzPublicIpAddress -Name "PublicIp" -ResourceGroupName "MyResourceGroup"
$pip.DnsSettings = New-Object -TypeName "Microsoft.Azure.Commands.Network.Models.PSPublicIpAddressDnsSettings"
$pip.DnsSettings.DomainNameLabel = "contosoapp1"
$pip.DnsSettings.ReverseFqdn = "contosoapp1.chinaeast.cloudapp.chinacloudapi.cn."
Set-AzPublicIpAddress -PublicIpAddress $pip

Azure 经典 CLIAzure classic CLI

若要将反向 DNS 添加到现有 PublicIpAddress,请执行以下操作:To add reverse DNS to an existing PublicIpAddress:

azure network public-ip set -n PublicIp -g MyResourceGroup -f contosoapp1.chinaeast.cloudapp.chinacloudapi.cn.

若要将反向 DNS 添加到尚不具有 DNS 名称的现有 PublicIpAddress,则还必须指定 DNS 名称:To add reverse DNS to an existing PublicIpAddress that doesn't already have a DNS name, you must also specify a DNS name:

azure network public-ip set -n PublicIp -g MyResourceGroup -d contosoapp1 -f contosoapp1.chinaeast.cloudapp.chinacloudapi.cn.

Azure CLIAzure CLI

若要将反向 DNS 添加到现有 PublicIpAddress,请执行以下操作:To add reverse DNS to an existing PublicIpAddress:

az network public-ip update --resource-group MyResourceGroup --name PublicIp --reverse-fqdn contosoapp1.chinaeast.cloudapp.chinacloudapi.cn.

若要将反向 DNS 添加到尚不具有 DNS 名称的现有 PublicIpAddress,则还必须指定 DNS 名称:To add reverse DNS to an existing PublicIpAddress that doesn't already have a DNS name, you must also specify a DNS name:

az network public-ip update --resource-group MyResourceGroup --name PublicIp --reverse-fqdn contosoapp1.chinaeast.cloudapp.chinacloudapi.cn --dns-name contosoapp1

创建具有反向 DNS 的公共 IP 地址Create a Public IP Address with reverse DNS

若要创建具有已指定的反向 DNS 属性的新 PublicIpAddress,请执行以下操作:To create a new PublicIpAddress with the reverse DNS property already specified:

PowerShellPowerShell

New-AzPublicIpAddress -Name "PublicIp" -ResourceGroupName "MyResourceGroup" -Location "China East" -AllocationMethod Dynamic -DomainNameLabel "contosoapp2" -ReverseFqdn "contosoapp2.chinaeast.cloudapp.chinacloudapi.cn."

Azure 经典 CLIAzure classic CLI

azure network public-ip create -n PublicIp -g MyResourceGroup -l chinaeast -d contosoapp3 -f contosoapp3.chinaeast.cloudapp.chinacloudapi.cn.

Azure CLIAzure CLI

az network public-ip create --name PublicIp --resource-group MyResourceGroup --location chinaeast --dns-name contosoapp1 --reverse-fqdn contosoapp1.chinaeast.cloudapp.chinacloudapi.cn

查看现有 PublicIpAddress 的反向 DNSView reverse DNS for an existing PublicIpAddress

若要查看现有 PublicIpAddress 的配置值,请执行以下操作:To view the configured value for an existing PublicIpAddress:

PowerShellPowerShell

Get-AzPublicIpAddress -Name "PublicIp" -ResourceGroupName "MyResourceGroup"

Azure 经典 CLIAzure classic CLI

azure network public-ip show -n PublicIp -g MyResourceGroup

Azure CLIAzure CLI

az network public-ip show --name PublicIp --resource-group MyResourceGroup

从现有公共 IP 地址中删除反向 DNSRemove reverse DNS from existing Public IP Addresses

若要从现有 PublicIpAddress 中删除反向 DNS 属性,请执行以下操作:To remove a reverse DNS property from an existing PublicIpAddress:

PowerShellPowerShell

$pip = Get-AzPublicIpAddress -Name "PublicIp" -ResourceGroupName "MyResourceGroup"
$pip.DnsSettings.ReverseFqdn = ""
Set-AzPublicIpAddress -PublicIpAddress $pip

Azure 经典 CLIAzure classic CLI

azure network public-ip set -n PublicIp -g MyResourceGroup –f ""

Azure CLIAzure CLI

az network public-ip update --resource-group MyResourceGroup --name PublicIp --reverse-fqdn ""

配置云服务的反向 DNSConfigure reverse DNS for Cloud Services

本部分提供有关如何使用 Azure PowerShell 在经典部署模型中配置云服务的反向 DNS 的详细说明。This section provides detailed instructions for how to configure reverse DNS for Cloud Services in the Classic deployment model, using Azure PowerShell. 不支持通过 Azure 门户、Azure 经典 CLI 或 Azure CLI 配置云服务的反向 DNS。Configuring reverse DNS for Cloud Services is not supported via the Azure portal, Azure classic CLI, or Azure CLI.

将反向 DNS 添加到现有云服务Add reverse DNS to existing Cloud Services

若要将反向 DNS 记录添加到现有云服务,请执行以下操作:To add a reverse DNS record to an existing Cloud Service:

Set-AzureService –ServiceName "contosoapp1" –Description "App1 with Reverse DNS" –ReverseDnsFqdn "contosoapp1.chinacloudapp.cn."

使用反向 DNS 创建云服务Create a Cloud Service with reverse DNS

若要创建具有已指定的反向 DNS 属性的新云服务,请执行以下操作:To create a new Cloud Service with the reverse DNS property already specified:

New-AzureService –ServiceName "contosoapp1" –Location "China East" –Description "App1 with Reverse DNS" –ReverseDnsFqdn "contosoapp1.chinacloudapp.cn."

查看现有云服务的反向 DNSView reverse DNS for existing Cloud Services

若要查看现有云服务的反向 DNS 属性,请执行以下操作:To view the reverse DNS property for an existing Cloud Service:

Get-AzureService "contosoapp1"

从现有云服务中删除反向 DNSRemove reverse DNS from existing Cloud Services

若要从现有云服务中删除反向 DNS 属性,请执行以下操作:To remove a reverse DNS property from an existing Cloud Service:

Set-AzureService –ServiceName "contosoapp1" –Description "App1 with Reverse DNS" –ReverseDnsFqdn ""

常见问题解答FAQ

反向 DNS 记录的费用如何?How much do reverse DNS records cost?

完全免费!They're free! 反向 DNS 记录或查询不额外收取费用。There is no additional cost for reverse DNS records or queries.

反向 DNS 记录是否从 Internet 解析?Will my reverse DNS records resolve from the internet?

是的。Yes. 为 Azure 服务设置反向 DNS 属性后,Azure 将管理所有必要的 DNS 委托和 DNS 区域,确保可为所有 Internet 用户解析反向 DNS 记录。Once you set the reverse DNS property for your Azure service, Azure manages all the DNS delegations and DNS zones required to ensure that reverse DNS record resolves for all Internet users.

是否为 Azure 服务创建默认的反向 DNS 记录?Are default reverse DNS records created for my Azure services?

不是。No. 反向 DNS 是可选功能。Reverse DNS is an opt-in feature. 如果选择不配置反向 DNS,则不会创建任何默认的反向 DNS 记录。No default reverse DNS records are created if you choose not to configure them.

完全限定的域名 (FQDN) 的格式是什么?What is the format for the fully-qualified domain name (FQDN)?

FQDN 以正向顺序指定,且必须以点号结尾(例如“app1.contoso.com.”)。FQDNs are specified in forward order, and must be terminated by a dot (for example, "app1.contoso.com.").

如果指定的反向 DNS 验证检查失败,会发生什么情况?What happens if the validation check for the reverse DNS I've specified fails?

如果反向 DNS 验证检查失败,则配置反向 DNS 记录的操作也会失败。Where the reverse DNS validation check fails, the operation to configure the reverse DNS record fails. 请根据需要更正反向 DNS 值,然后重试。Correct the reverse DNS value as required, and retry.

是否可以为 Azure 应用服务配置反向 DNS?Can I configure reverse DNS for Azure App Service?

不是。No. Azure 应用服务不支持反向 DNS。Reverse DNS is not supported for the Azure App Service.

是否可以为 Azure 服务配置多个反向 DNS 记录?Can I configure multiple reverse DNS records for my Azure service?

不是。No. Azure 仅支持为每个 Azure 云服务或 PublicIpAddress 配置一个反向 DNS 记录。Azure supports a single reverse DNS record for each Azure Cloud Service or PublicIpAddress.

是否可以为 IPv6 PublicIpAddress 资源配置反向 DNS?Can I configure reverse DNS for IPv6 PublicIpAddress resources?

不是。No. Azure 当前仅支持为 IPv4 PublicIpAddress 资源和云服务配置反向 DNS。Azure currently supports reverse DNS only for IPv4 PublicIpAddress resources and Cloud Services.

是否可以从 Azure 计算服务将电子邮件发送到外部域?Can I send emails to external domains from my Azure Compute services?

直接从 Azure 部署发送电子邮件的技术能力取决于订阅类型。The technical ability to send email directly from an Azure deployment depends on the subscription type. 无论是哪种订阅类型,Azure 都建议使用受信任的邮件中继服务来发送出站邮件。Regardless of subscription type, Azure recommends using trusted mail relay services to send outgoing mail. 有关更多详细信息,请参阅 Enhanced Azure Security for sending Emails – November 2017 Update(增强 Azure 发送电子邮件的安全性 - 2017 年 11 月更新)。For further details, see Enhanced Azure Security for sending Emails – November 2017 Update.

后续步骤Next steps

有关反向 DNS 的详细信息,请参阅反向 DNS 查找For more information on reverse DNS, see reverse DNS lookup on Wikipedia.
了解如何在 Azure DNS 中为 ISP 分配的 IP 范围托管反向查找区域Learn how to host the reverse lookup zone for your ISP-assigned IP range in Azure DNS.