Azure 中 Linux 虚拟机的 DNS 名称解析选项DNS Name Resolution options for Linux virtual machines in Azure

Azure 默认提供单个虚拟网络内的所有虚拟机的 DNS 名称解析。Azure provides DNS name resolution by default for all virtual machines that are in a single virtual network. 在 Azure 托管的虚拟机上配置自己的 DNS 服务,即可实现自己的 DNS 名称解析解决方案。You can implement your own DNS name resolution solution by configuring your own DNS services on your virtual machines that Azure hosts. 以下方案可帮助你选择适合你情况的解决方案。The following scenarios should help you choose the one that works for your situation.

使用的名称解析类型取决于虚拟机和角色实例需要彼此进行通信的方式。The type of name resolution that you use depends on how your virtual machines and role instances need to communicate with each other.

下表说明了方案和相应的名称解析解决方案:The following table illustrates scenarios and corresponding name resolution solutions:

方案Scenario 解决方案Solution 后缀Suffix
同一虚拟网络中的角色实例或虚拟机之间的名称解析Name resolution between role instances or virtual machines in the same virtual network Azure 提供的名称解析Name resolution that Azure provides 主机名或完全限定域名 (FQDN)hostname or fully-qualified domain name (FQDN)
不同虚拟网络中的角色实例或虚拟机之间的名称解析Name resolution between role instances or virtual machines in different virtual networks 客户托管的 DNS 服务器,在虚拟网络之间转发可供 Azure(DNS 代理)解析的查询。Customer-managed DNS servers that forward queries between virtual networks for resolution by Azure (DNS proxy). 请参阅使用自己的 DNS 服务器进行名称解析See Name resolution using your own DNS server. 仅 FQDNFQDN only
通过 Azure 中的角色实例或虚拟机解析本地计算机和服务的名称Resolution of on-premises computers and service names from role instances or virtual machines in Azure 客户托管的 DNS 服务器(例如,本地域控制器、本地只读域控制器或使用区域传送同步的 DNS 辅助服务器)。Customer-managed DNS servers (for example, on-premises domain controller, local read-only domain controller, or a DNS secondary synced by using zone transfers). 请参阅使用自己的 DNS 服务器进行名称解析See Name resolution using your own DNS server. 仅 FQDNFQDN only
解析本地计算机中的 Azure 主机名Resolution of Azure hostnames from on-premises computers 将查询转发到相应虚拟网络中客户托管的 DNS 代理服务器。Forward queries to a customer-managed DNS proxy server in the corresponding virtual network. 代理服务器将查询转发到 Azure 进行解析。The proxy server forwards queries to Azure for resolution. 请参阅使用自己的 DNS 服务器进行名称解析See Name resolution using your own DNS server. 仅 FQDNFQDN only
针对内部 IP 的反向 DNSReverse DNS for internal IPs 使用自己的 DNS 服务器的名称解析Name resolution using your own DNS server 不适用n/a

Azure 提供的名称解析Name resolution that Azure provides

除公共 DNS 名称解析之外,Azure 还为位于相同虚拟网络中的虚拟机和角色实例提供内部名称解析。Along with resolution of public DNS names, Azure provides internal name resolution for virtual machines and role instances that are in the same virtual network. 在基于 Azure Resource Manager 的虚拟网络中,DNS 后缀在整个虚拟网络中都是一致的;不需要 FQDN。In virtual networks that are based on Azure Resource Manager, the DNS suffix is consistent across the virtual network; the FQDN is not needed. 可以将 DNS 名称分配给网络接口卡 (NIC) 和虚拟机。DNS names can be assigned to both network interface cards (NICs) and virtual machines. 虽然 Azure 提供的名称解析不需要任何配置,但并不适合所有部署方案,如上表所示。Although the name resolution that Azure provides does not require any configuration, it is not the appropriate choice for all deployment scenarios, as seen on the preceding table.

功能和注意事项Features and considerations

功能:Features:

  • 不需要配置就能使用 Azure 提供的名称解析。No configuration is required to use name resolution that Azure provides.
  • Azure 提供的名称解析服务可用性高。The name resolution service that Azure provides is highly available. 无需创建和管理你自己的 DNS 服务器的群集。You don't need to create and manage clusters of your own DNS servers.
  • 可以将 Azure 提供的名称解析服务与你自己的 DNS 服务器一起使用,以便解析本地主机名和 Azure 主机名。The name resolution service that Azure provides can be used along with your own DNS servers to resolve both on-premises and Azure hostnames.
  • 无需 FQDN 即可在虚拟网络中的虚拟机之间提供名称解析。Name resolution is provided between virtual machines in virtual networks without need for the FQDN.
  • 可以使用最能描述部署的主机名,而不必使用自动生成的名称。You can use hostnames that best describe your deployments rather than working with auto-generated names.

注意事项:Considerations:

  • 不能修改 Azure 创建的 DNS 后缀。The DNS suffix that Azure creates cannot be modified.
  • 不能手动注册自己的记录。You cannot manually register your own records.
  • 不支持 WINS 和 NetBIOS。WINS and NetBIOS are not supported.
  • 主机名必须兼容 DNS。Hostnames must be DNS-compatible. 名称只能使用 0-9、a-z 和“-”,并且不能以“-”开头或结尾。Names must use only 0-9, a-z, and '-', and they cannot start or end with a '-'. 请参见 RFC 3696 第 2 节。See RFC 3696 Section 2.
  • DNS 查询流量按照虚拟机进行限制。DNS query traffic is throttled for each virtual machine. 限制不应影响大部分应用程序。Throttling shouldn't impact most applications. 如果遵循请求限制,请确保启用客户端缓存。If request throttling is observed, ensure that client-side caching is enabled. 有关详细信息,请参阅充分利用 Azure 提供的名称解析For more information, see Getting the most from name resolution that Azure provides.

充分利用 Azure 提供的名称解析Getting the most from name resolution that Azure provides

客户端缓存:Client-side caching:

某些 DNS 查询不通过网络发送。Some DNS queries are not sent across the network. 通过解析本地缓存中的重复性 DNS 查询,客户端缓存有助于减少延迟和提高网络在出现不一致情况下的恢复能力。Client-side caching helps reduce latency and improve resilience to network inconsistencies by resolving recurring DNS queries from a local cache. DNS 记录包含生存时间 (TTL),这允许缓存尽可能长时间存储记录,而不影响记录刷新。DNS records contain a Time-To-Live (TTL), which enables the cache to store the record for as long as possible without impacting record freshness. 因此,客户端缓存适用于大多数情况。As a result, client-side caching is suitable for most situations.

默认情况下,某些 Linux 发行版不包括缓存。Some Linux distributions do not include caching by default. 建议你在确定没有本地缓存后,向每个 Linux 虚拟机添加缓存。We recommend that you add a cache to each Linux virtual machine after you check that there isn't a local cache already.

可以使用多个不同的 DNS 缓存包,例如 dnsmasq。Several different DNS caching packages, such as dnsmasq, are available. 以下是在最常见的发行版上安装 dnsmasq 的步骤:Here are the steps to install dnsmasq on the most common distributions:

Ubuntu(使用 resolvconf)Ubuntu (uses resolvconf)

  • 安装 dnsmasq 包 (�sudo apt-get install dnsmasq�)。Install the dnsmasq package (�sudo apt-get install dnsmasq�).

SUSE(使用 netconf)SUSE (uses netconf):

  1. 安装 dnsmasq 包(“sudo zypper install dnsmasq”)。Install the dnsmasq package ("sudo zypper install dnsmasq").
  2. 启用 dnsmasq 服务(“systemctl enable dnsmasq.service”)。Enable the dnsmasq service ("systemctl enable dnsmasq.service").
  3. 启动 dnsmasq 服务(“systemctl start dnsmasq.service”)。Start the dnsmasq service ("systemctl start dnsmasq.service").
  4. 编辑“/etc/sysconfig/network/config”,并将 NETCONFIG_DNS_FORWARDER="" 更改为“dnsmasq”。Edit "/etc/sysconfig/network/config", and change NETCONFIG_DNS_FORWARDER="" to "dnsmasq".
  5. 更新 resolv.conf(“netconfig update”),将缓存设置为本地 DNS 解析程序。Update resolv.conf ("netconfig update") to set the cache as the local DNS resolver.

Rogue Wave Software 的 CentOS(之前为 OpenLogic;使用 NetworkManager) CentOS by Rogue Wave Software (formerly OpenLogic; uses NetworkManager)

  1. 安装 dnsmasq 包(“sudo yum install dnsmasq”)。Install the dnsmasq package ("sudo yum install dnsmasq").
  2. 启用 dnsmasq 服务(“systemctl enable dnsmasq.service”)。Enable the dnsmasq service ("systemctl enable dnsmasq.service").
  3. 启动 dnsmasq 服务(“systemctl start dnsmasq.service”)。Start the dnsmasq service ("systemctl start dnsmasq.service").
  4. 将“prepend domain-name-servers 127.0.0.1;”添加到“/etc/dhclient-eth0.conf”。Add "prepend domain-name-servers 127.0.0.1;" to "/etc/dhclient-eth0.conf".
  5. 重启网络服务(“service network restart”),将缓存设置为本地 DNS 解析程序Restart the network service ("service network restart") to set the cache as the local DNS resolver

备注

解码的字符:“dnsmasq”包只是适用于 Linux 的众多 DNS 缓存中的一个。: The 'dnsmasq' package is only one of the many DNS caches that are available for Linux. 在使用之前,请检查其是否适合需求,并且确认没有安装其他缓存。Before you use it, check its suitability for your needs and that no other cache is installed.

客户端重试Client-side retries

DNS 主要是一个 UDP 协议。DNS is primarily a UDP protocol. 因为 UDP 协议无法保证消息传递,所以 DNS 协议本身会处理重试逻辑。Because the UDP protocol doesn't guarantee message delivery, the DNS protocol itself handles retry logic. 每个 DNS 客户端(操作系统)可能会表现出不同的重试逻辑,具体取决于创建者偏好:Each DNS client (operating system) can exhibit different retry logic depending on the creator's preference:

  • Windows 操作系统在 1 秒后重试,然后再在 2 秒后、 4 秒后和另一个 4 秒后重试。Windows operating systems retry after one second and then again after another two, four, and another four seconds.
  • 默认 Linux 设置在 5 秒后重试。The default Linux setup retries after five seconds. 应将此设置更改为重试 5 次,每次间隔 1 秒。You should change this to retry five times at one-second intervals.

若要检查 Linux 虚拟机上的当前设置,请执行“cat /etc/resolv.conf”并查看“options”行,例如:To check the current settings on a Linux virtual machine, 'cat /etc/resolv.conf', and look at the 'options' line, for example:

options timeout:1 attempts:5

resolv.conf 文件是自动生成的,不应进行编辑。The resolv.conf file is auto-generated and should not be edited. 添加“options”行的具体步骤因发行版而异:The specific steps that add the 'options' line vary by distribution:

Ubuntu(使用 resolvconf)Ubuntu (uses resolvconf)

  1. 将 options 行添加到“/etc/resolvconf/resolv.conf.d/head”。Add the options line to '/etc/resolvconf/resolv.conf.d/head'.
  2. 通过运行“resolvconf -u”进行更新。Run 'resolvconf -u' to update.

SUSE(使用 netconf)SUSE (uses netconf)

  1. 将“timeout:1 attempts:5”添加到“/etc/sysconfig/network/config”中的 NETCONFIG_DNS_RESOLVER_OPTIONS="" 参数。Add 'timeout:1 attempts:5' to the NETCONFIG_DNS_RESOLVER_OPTIONS="" parameter in '/etc/sysconfig/network/config'.
  2. 通过运行“netconfig update”进行更新。Run 'netconfig update' to update.

Rogue Wave Software 的 CentOS(之前为 OpenLogic)(使用 NetworkManager) CentOS by Rogue Wave Software (formerly OpenLogic) (uses NetworkManager)

  1. 将“RES_OPTIONS="timeout:1 attempts:5"”添加到“/etc/sysconfig/network”。Add 'RES_OPTIONS="timeout:1 attempts:5"' to '/etc/sysconfig/network'.
  2. 通过运行“service network restart”进行更新。Run 'service network restart' to update.

使用自己的 DNS 服务器的名称解析Name resolution using your own DNS server

你的名称解析需求可能会超出 Azure 所提供的功能的范畴。Your name resolution needs may go beyond the features that Azure provides. 例如,你可能需要在虚拟网络之间进行 DNS 解析。For example, you might require DNS resolution between virtual networks. 为了涵盖这种情况,你可以使用自己的 DNS 服务器。To cover this scenario, you can use your own DNS servers.

虚拟网络中的 DNS 服务器可以将 DNS 查询转发到 Azure 的递归解析程序,以便解析同一虚拟网络中的主机名。DNS servers within a virtual network can forward DNS queries to recursive resolvers of Azure to resolve hostnames that are in the same virtual network. 例如,在 Azure 中运行的 DNS 服务器可以响应其自身 DNS 区域文件的 DNS 查询,而将所有其他查询转发到 Azure。For example, a DNS server that runs in Azure can respond to DNS queries for its own DNS zone files and forward all other queries to Azure. 虚拟机可以利用此功能查看你在区域文件中的条目,以及 Azure 提供的主机名(通过转发器)。This functionality enables virtual machines to see both your entries in your zone files and hostnames that Azure provides (via the forwarder). 可以通过虚拟 IP 168.63.129.16 访问 Azure 的递归解析程序。Access to the recursive resolvers of Azure is provided via the virtual IP 168.63.129.16.

DNS 转发还可用于在虚拟网络之间进行 DNS 解析,并允许本地机解析 Azure 提供的主机名。DNS forwarding also enables DNS resolution between virtual networks and enables your on-premises machines to resolve hostnames that Azure provides. 若要解析虚拟机的主机名,DNS 服务器虚拟机必须驻留在同一虚拟网络中,并且必须配置为将主机名查询转发到 Azure。To resolve a virtual machine's hostname, the DNS server virtual machine must reside in the same virtual network and be configured to forward hostname queries to Azure. 由于 DNS 后缀在每个虚拟网络中是不同的,因此可使用条件性转发规则将 DNS 查询发送到正确的虚拟网络进行解析。Because the DNS suffix is different in each virtual network, you can use conditional forwarding rules to send DNS queries to the correct virtual network for resolution. 下图显示了两个虚拟网络,此外还有一个本地网络在使用此方法在虚拟网络之间进行 DNS 解析:The following image shows two virtual networks and an on-premises network doing DNS resolution between virtual networks by using this method:

虚拟网络之间的 DNS 解析

使用 Azure 提供的名称解析时,会通过 DHCP 为每个虚拟机提供内部 DNS 后缀。When you use name resolution that Azure provides, the internal DNS suffix is provided to each virtual machine by using DHCP. 使用你自己的名称解析解决方案时,不会向虚拟机提供该后缀,因为该后缀会干扰其他 DNS 体系结构。When you use your own name resolution solution, this suffix is not supplied to virtual machines because the suffix interferes with other DNS architectures. 若要通过 FQDN 来引用计算机,或者要在虚拟机上配置后缀,可通过 PowerShell 或 API 来确定该后缀:To refer to machines by FQDN or to configure the suffix on your virtual machines, you can use PowerShell or the API to determine the suffix:

  • 对于 Azure Resource Manager 托管的虚拟网络,可以通过网络接口卡资源来使用该后缀。For virtual networks that are managed by Azure Resource Manager, the suffix is available via the network interface card resource. 也可通过运行 azure network public-ip show <resource group> <pip name> 命令来显示公共 IP 的详细信息,该 IP 中包括 NIC 的 FQDN。You can also run the azure network public-ip show <resource group> <pip name> command to display the details of your public IP, which includes the FQDN of the NIC.

如果不想将查询转发到 Azure,则需提供自己的 DNS 解决方案。If forwarding queries to Azure doesn't suit your needs, you need to provide your own DNS solution. DNS 解决方案需要:Your DNS solution needs to:

  • 提供合适的主机名解析方式(例如通过 DDNS 进行解析)。Provide appropriate hostname resolution, for example via DDNS. 如果使用 DDNS,可能需要禁用 DNS 记录清理。If you use DDNS, you might need to disable DNS record scavenging. Azure 的 DHCP 租用时间很长,清理时可能会过早删除 DNS 记录。DHCP leases of Azure are very long and scavenging may remove DNS records prematurely.
  • 提供适当的递归式解析来解析外部域名。Provide appropriate recursive resolution to allow resolution of external domain names.
  • 可以从其所服务的客户端进行访问(在端口 53 上启用 TCP 和 UDP),并可访问 Internet。Be accessible (TCP and UDP on port 53) from the clients it serves and be able to access the Internet.
  • 禁止从 Internet 进行访问,减少外部代理带来的威胁。Be secured against access from the Internet to mitigate threats posed by external agents.

备注

为了获得最佳性能,在 Azure DNS 服务器中使用虚拟机时,请禁用 IPv6 并为每个 DNS 服务器虚拟机分配实例级公共 IPFor best performance, when you use virtual machines in Azure DNS servers, disable IPv6 and assign an Instance-Level Public IP to each DNS server virtual machine.