生产级 DNS 集群从零部署：dnsdist 与 Technitium 三节点架构

-- 多条 addLocal 配合 reusePort，用于增加 UDP 查询处理并发。
addLocal("0.0.0.0:53", { reusePort = true })
addLocal("0.0.0.0:53", { reusePort = true })
addLocal("0.0.0.0:53", { reusePort = true })
setMaxTCPClientThreads(8)

setACL({
  "192.0.2.0/24",
  "198.51.100.0/24",
  "127.0.0.0/8",
  "::1/128"
})

newServer({
  address = "192.0.2.234:53",
  name = "dns-server-master",
  checkInterval = 15,
  checkType = "A",
  checkName = "corp.example.internal.",
  order = 1
})

newServer({
  address = "192.0.2.234:53",
  name = "master-recursion-check",
  checkInterval = 15,
  checkType = "A",
  checkName = "example.com.",
  order = 1
})

newServer({
  address = "192.0.2.235:53",
  name = "dns-server-slave",
  checkInterval = 15,
  checkType = "A",
  checkName = "corp.example.internal.",
  order = 2
})

newServer({
  address = "192.0.2.235:53",
  name = "slave-recursion-check",
  checkInterval = 15,
  checkType = "A",
  checkName = "example.com.",
  order = 2
})

hostnamectl set-hostname dns-master

apt-get update
apt-get install -y ca-certificates curl gnupg lsb-release \
  bind9-dnsutils jq tcpdump vim chrony

systemctl enable --now chrony
timedatectl

chronyc tracking
date -Is

mkdir -p /data/docker-compose/dns-server
mkdir -p /data/backup/dns-server
mkdir -p /etc/dns-server/secrets
chmod 700 /etc/dns-server/secrets

mkdir -p /data/backup/dnsdist

ufw default deny incoming
ufw default allow outgoing

# SSH 管理网段
ufw allow from 198.51.100.0/24 to any port 22 proto tcp

# DNS 入口
ufw allow from 192.0.2.0/24 to any port 53 proto udp
ufw allow from 192.0.2.0/24 to any port 53 proto tcp

# 管理控制台
ufw allow from 198.51.100.0/24 to any port 5380 proto tcp
ufw allow from 198.51.100.0/24 to any port 53443 proto tcp

ufw enable
ufw status verbose

install -m 0755 -d /etc/apt/keyrings
curl -fsSL https://download.docker.com/linux/ubuntu/gpg \
  -o /etc/apt/keyrings/docker.asc
chmod a+r /etc/apt/keyrings/docker.asc

. /etc/os-release
echo "deb [arch=$(dpkg --print-architecture) signed-by=/etc/apt/keyrings/docker.asc] https://download.docker.com/linux/ubuntu ${VERSION_CODENAME} stable" \
  > /etc/apt/sources.list.d/docker.list

apt-get update
apt-get install -y docker-ce docker-ce-cli containerd.io docker-buildx-plugin docker-compose-plugin

systemctl enable --now docker
docker --version
docker compose version

cat > /etc/docker/daemon.json <<'EOF'
{
  "log-driver": "json-file",
  "log-opts": {
    "max-size": "10m",
    "max-file": "3"
  },
  "live-restore": true
}
EOF

systemctl restart docker
docker info --format '{{json .LoggingDriver}}'

cat > /etc/sysctl.d/99-dns-cluster.conf <<'EOF'
net.core.somaxconn = 4096
net.ipv4.ip_local_port_range = 1024 65535
net.ipv4.udp_rmem_min = 4096
net.ipv4.udp_wmem_min = 4096
EOF

sysctl --system

mkdir -p /etc/systemd/system/docker.service.d
cat > /etc/systemd/system/docker.service.d/override.conf <<'EOF'
[Service]
LimitNOFILE=524288
EOF

systemctl daemon-reload
systemctl restart docker
systemctl show docker --property=LimitNOFILE

openssl rand -base64 32 > /etc/dns-server/secrets/admin_password
chmod 600 /etc/dns-server/secrets/admin_password

services:
  dns-server-master:
    container_name: dns-server-master
    hostname: dns-server-master
    image: registry.example.internal/technitium/dns-server:15.2.0
    dns:
      - 223.6.6.6
    network_mode: "host"
    extra_hosts:
      - "dns-master.corp.example.internal:192.0.2.234"
      - "dns-slave.corp.example.internal:192.0.2.235"
    environment:
      - DNS_SERVER_DOMAIN=dns-master
      - TZ=Asia/Shanghai
      - DNS_SERVER_ADMIN_PASSWORD_FILE=/run/secrets/admin_password
      - DNS_SERVER_FORWARDERS=223.5.5.5,8.8.8.8,1.1.1.1,114.114.114.114,114.114.115.115
      - DNS_SERVER_FORWARDER_PROTOCOL=Udp
      - DNS_SERVER_LOG_USING_LOCAL_TIME=true
    volumes:
      - config:/etc/dns
      - /tmp:/tmp
    secrets:
      - admin_password
    restart: always

volumes:
  config:

secrets:
  admin_password:
    file: /etc/dns-server/secrets/admin_password

cd /data/docker-compose/dns-server
docker compose up -d
docker ps --filter name=dns-server-master

ss -lntup | grep -E ':53|:5380|:53443'
dig @127.0.0.1 example.com A +short

openssl rand -base64 32 > /etc/dns-server/secrets/admin_password
chmod 600 /etc/dns-server/secrets/admin_password

services:
  dns-server-slave:
    container_name: dns-server-slave
    hostname: dns-server-slave
    image: registry.example.internal/technitium/dns-server:15.2.0
    dns:
      - 223.6.6.6
    network_mode: "host"
    extra_hosts:
      - "dns-master.corp.example.internal:192.0.2.234"
      - "dns-slave.corp.example.internal:192.0.2.235"
    environment:
      - DNS_SERVER_DOMAIN=dns-slave
      - TZ=Asia/Shanghai
      - DNS_SERVER_ADMIN_PASSWORD_FILE=/run/secrets/admin_password
      - DNS_SERVER_FORWARDERS=223.5.5.5,8.8.8.8,1.1.1.1,114.114.114.114,114.114.115.115
      - DNS_SERVER_FORWARDER_PROTOCOL=Udp
      - DNS_SERVER_LOG_USING_LOCAL_TIME=true
    volumes:
      - config:/etc/dns
      - /tmp:/tmp
    secrets:
      - admin_password
    restart: always

volumes:
  config:

secrets:
  admin_password:
    file: /etc/dns-server/secrets/admin_password

cd /data/docker-compose/dns-server
docker compose up -d
docker ps --filter name=dns-server-slave
ss -lntup | grep -E ':53|:5380|:53443'
dig @127.0.0.1 example.com A +short

curl -kI https://dns-master.corp.example.internal:53443/
curl -kI https://dns-slave.corp.example.internal:53443/

docker volume inspect dns-server_config
find /var/lib/docker/volumes/dns-server_config/_data -maxdepth 1 -type f -printf '%f\n' | sort
find /var/lib/docker/volumes/dns-server_config/_data/zones -maxdepth 1 -type f -printf '%f\n' | sort

curl -fsSL https://repo.powerdns.com/FD380FBB-pub.asc \
  | gpg --dearmor -o /usr/share/keyrings/pdns-archive-keyring.gpg

echo "deb [signed-by=/usr/share/keyrings/pdns-archive-keyring.gpg] http://repo.powerdns.com/ubuntu jammy-dnsdist-19 main" \
  > /etc/apt/sources.list.d/pdns.list

apt-get update
apt-get install -y dnsdist

systemctl enable dnsdist
dnsdist --version

-- 多条 addLocal 配合 reusePort，用于增加 UDP 查询处理并发。
-- 条数不要照抄，先从 1-3 条开始，再按压测结果调整。
addLocal("0.0.0.0:53", { reusePort = true })
addLocal("0.0.0.0:53", { reusePort = true })
addLocal("0.0.0.0:53", { reusePort = true })
setMaxTCPClientThreads(8)

setACL({
  "192.0.2.0/24",
  "198.51.100.0/24",
  "127.0.0.0/8",
  "::1/128"
})

newServer({
  address = "192.0.2.234:53",
  name = "dns-server-master",
  checkInterval = 15,
  checkType = "A",
  checkName = "corp.example.internal.",
  order = 1
})

newServer({
  address = "192.0.2.234:53",
  name = "master-recursion-check",
  checkInterval = 15,
  checkType = "A",
  checkName = "example.com.",
  order = 1
})

newServer({
  address = "192.0.2.235:53",
  name = "dns-server-slave",
  checkInterval = 15,
  checkType = "A",
  checkName = "corp.example.internal.",
  order = 2
})

newServer({
  address = "192.0.2.235:53",
  name = "slave-recursion-check",
  checkInterval = 15,
  checkType = "A",
  checkName = "example.com.",
  order = 2
})

pc = newPacketCache(500000, {
  maxTTL = 3600,
  minTTL = 5,
  temporaryFailureTTL = 10,
  staleTTL = 60,
  numberOfShards = 20
})

webserver("192.0.2.211:5380")
setWebserverConfig({ password = "<HASHED_WEB_PASSWORD>" })
setWebserverConfig({ apiKey = "<HASHED_API_KEY>" })
setWebserverConfig({ acl = "198.51.100.0/24" })

dnsdist --check-config
systemctl restart dnsdist
systemctl is-active dnsdist
ss -lntup | grep -E ':53|:5380'

ENTRY_DNS="192.0.2.211"
MASTER_DNS="192.0.2.234"
SLAVE_DNS="192.0.2.235"
INTERNAL_DOMAIN="corp.example.internal"
PUBLIC_DOMAIN="example.com"

for server in "${ENTRY_DNS}" "${MASTER_DNS}" "${SLAVE_DNS}"; do
  echo "== ${server} internal =="
  dig @"${server}" "${INTERNAL_DOMAIN}" A +tries=1 +time=2 +short

  echo "== ${server} public =="
  dig @"${server}" "${PUBLIC_DOMAIN}" A +tries=1 +time=2 +short
done

cat > /tmp/dns-queries.txt <<'EOF'
corp.example.internal A
www.corp.example.internal A
api.corp.example.internal A
example.com A
www.example.com A
EOF

apt-get update
apt-get install -y dnsperf

cat > /tmp/dns-benchmark.sh <<'EOF'
#!/usr/bin/env bash
set -euo pipefail

TARGET="${TARGET:-}"
PORT="${PORT:-53}"
DATA_FILE="${DATA_FILE:-/tmp/dns-queries.txt}"
DURATION="${DURATION:-60}"
RAMP_QPS="${RAMP_QPS:-100 500 1000}"
CLIENTS="${CLIENTS:-32}"
THREADS="${THREADS:-2}"
TIMEOUT="${TIMEOUT:-2}"
OUT_DIR="${OUT_DIR:-./dns-benchmark-$(date +%Y%m%d-%H%M%S)}"
ALLOW_PRIVATE_BENCHMARK="${ALLOW_PRIVATE_BENCHMARK:-no}"

usage() {
  cat <<USAGE
Usage:
  TARGET=192.0.2.211 DATA_FILE=/tmp/dns-queries.txt /tmp/dns-benchmark.sh

Required:
  TARGET                    DNS server address.

Optional:
  PORT=53
  DATA_FILE=/tmp/dns-queries.txt
  DURATION=60
  RAMP_QPS="100 500 1000"
  CLIENTS=32
  THREADS=2
  TIMEOUT=2
  OUT_DIR=./dns-benchmark-<timestamp>
  ALLOW_PRIVATE_BENCHMARK=yes  # required for 10/8, 172.16/12, 192.168/16 targets
USAGE
}

if [ -z "${TARGET}" ]; then
  usage
  exit 2
fi

if [ ! -s "${DATA_FILE}" ]; then
  echo "query file not found or empty: ${DATA_FILE}" >&2
  exit 2
fi

if ! command -v dnsperf >/dev/null 2>&1; then
  echo "dnsperf not found. Install DNSPerf/dnsperf on the benchmark client first." >&2
  exit 2
fi

if [[ "${TARGET}" =~ ^10\. ]] || [[ "${TARGET}" =~ ^192\.168\. ]] || [[ "${TARGET}" =~ ^172\.(1[6-9]|2[0-9]|3[0-1])\. ]]; then
  if [ "${ALLOW_PRIVATE_BENCHMARK}" != "yes" ]; then
    echo "refuse to benchmark private address ${TARGET} without ALLOW_PRIVATE_BENCHMARK=yes" >&2
    exit 3
  fi
fi

mkdir -p "${OUT_DIR}"
{
  echo "target=${TARGET}"
  echo "port=${PORT}"
  echo "data_file=${DATA_FILE}"
  echo "duration=${DURATION}"
  echo "ramp_qps=${RAMP_QPS}"
  echo "clients=${CLIENTS}"
  echo "threads=${THREADS}"
  echo "timeout=${TIMEOUT}"
  date -Is
} | tee "${OUT_DIR}/metadata.txt"

echo "== preflight =="
head -n 5 "${DATA_FILE}" | while read -r name type; do
  [ -n "${name:-}" ] || continue
  dig @"${TARGET}" -p "${PORT}" "${name}" "${type:-A}" +tries=1 +time=2 +short || true
done | tee "${OUT_DIR}/preflight.log"

for qps in ${RAMP_QPS}; do
  log="${OUT_DIR}/dnsperf-qps-${qps}.log"
  echo "== dnsperf qps=${qps} =="
  dnsperf \
    -s "${TARGET}" \
    -p "${PORT}" \
    -d "${DATA_FILE}" \
    -l "${DURATION}" \
    -Q "${qps}" \
    -c "${CLIENTS}" \
    -T "${THREADS}" \
    -t "${TIMEOUT}" \
    -S 5 \
    | tee "${log}"

  if grep -E "Queries lost:[[:space:]]*[1-9]" "${log}" >/dev/null; then
    echo "queries lost at qps=${qps}; stop ramping" >&2
    break
  fi
done

echo "logs written to ${OUT_DIR}"
EOF

chmod +x /tmp/dns-benchmark.sh

TARGET="192.0.2.211" \
RAMP_QPS="100 500 1000" \
DURATION=60 \
/tmp/dns-benchmark.sh

TARGET="10.x.x.x" \
ALLOW_PRIVATE_BENCHMARK=yes \
RAMP_QPS="100 500 1000" \
DURATION=60 \
/tmp/dns-benchmark.sh

dnsperf -s 192.0.2.211 -d /tmp/dns-queries.txt -l 30 -Q 100 -c 8 -T 1

dnsperf -s 192.0.2.211 -d /tmp/dns-queries.txt -l 60 -Q 1000 -c 32 -T 2
dnsperf -s 192.0.2.211 -d /tmp/dns-queries.txt -l 60 -Q 5000 -c 64 -T 4

dnsperf -s 192.0.2.234 -d /tmp/dns-queries.txt -l 60 -Q 1000 -c 32 -T 2
dnsperf -s 192.0.2.235 -d /tmp/dns-queries.txt -l 60 -Q 1000 -c 32 -T 2

ddns-test.corp.example.internal

cat > /tmp/ddns-add.txt <<'EOF'
server 192.0.2.211 53
zone ddns-test.corp.example.internal
update add smoke-001.ddns-test.corp.example.internal 60 A 192.0.2.50
send
EOF

nsupdate -k /etc/dns/ddns-test.key /tmp/ddns-add.txt
dig @192.0.2.211 smoke-001.ddns-test.corp.example.internal A +short
dig @192.0.2.234 smoke-001.ddns-test.corp.example.internal A +short
dig @192.0.2.235 smoke-001.ddns-test.corp.example.internal A +short

cat > /tmp/ddns-delete.txt <<'EOF'
server 192.0.2.211 53
zone ddns-test.corp.example.internal
update delete smoke-001.ddns-test.corp.example.internal A
send
EOF

nsupdate -k /etc/dns/ddns-test.key /tmp/ddns-delete.txt

cat > /tmp/ddns-one.sh <<'EOF'
#!/usr/bin/env bash
set -euo pipefail

id="$1"
record="load-${id}.ddns-test.corp.example.internal"
tmp="$(mktemp)"

cat > "${tmp}" <<NSUPDATE
server 192.0.2.211 53
zone ddns-test.corp.example.internal
update add ${record} 60 A 192.0.2.50
send
NSUPDATE

nsupdate -k /etc/dns/ddns-test.key "${tmp}"
rm -f "${tmp}"
EOF

chmod +x /tmp/ddns-one.sh

seq 1 100 | xargs -n1 -P5 /tmp/ddns-one.sh

seq 101 500 | xargs -n1 -P20 /tmp/ddns-one.sh

for server in 192.0.2.211 192.0.2.234 192.0.2.235; do
  dig @"${server}" load-101.ddns-test.corp.example.internal A +short
  dig @"${server}" load-500.ddns-test.corp.example.internal A +short
done

stamp="$(date +%F-%H%M%S)"
mkdir -p "/data/backup/dnsdist/${stamp}"
cp -a /etc/dnsdist/dnsdist.conf "/data/backup/dnsdist/${stamp}/dnsdist.conf"
dnsdist --version > "/data/backup/dnsdist/${stamp}/dnsdist.version"

stamp="$(date +%F-%H%M%S)"
backup_dir="/data/backup/dns-server/${stamp}"
mkdir -p "${backup_dir}"

cp -a /data/docker-compose/dns-server/docker-compose.yaml "${backup_dir}/docker-compose.yaml"
tar --warning=no-file-changed --ignore-failed-read \
  --exclude='./apps/Query Logs (Sqlite)/querylogs.db' \
  -czf "${backup_dir}/dns-server-config.tgz" \
  -C /var/lib/docker/volumes/dns-server_config/_data .

cp /data/backup/dnsdist/<stamp>/dnsdist.conf /etc/dnsdist/dnsdist.conf
dnsdist --check-config
systemctl restart dnsdist
dig @192.0.2.211 corp.example.internal A +short

cd /data/docker-compose/dns-server
# 将 image tag 改回上一个已验证版本
docker compose up -d
docker ps
dig @127.0.0.1 corp.example.internal A +short

docker ps --filter name=dns-server
docker logs --tail 200 dns-server-master
grep -n "network_mode" /data/docker-compose/dns-server/docker-compose.yaml
ss -lntup | grep ':53'

dig @192.0.2.234 corp.example.internal A +short
dig @192.0.2.235 corp.example.internal A +short

curl -I http://192.0.2.211:5380/
systemctl status dnsdist --no-pager
ss -lntp | grep ':5380'