Back to Details

dns-management

Compare original and translation side by side

🇺🇸

Original

English
🇨🇳

Translation

Chinese

DNS Management

DNS管理

Configure and manage DNS zones, records, and resolution for production infrastructure.
为生产环境基础设施配置和管理DNS区域、记录与解析。

When to Use

适用场景

  • Setting up domains for web applications, APIs, and email.
  • Migrating DNS providers or consolidating zones.
  • Configuring DNS for CDN, load balancers, and cloud services.
  • Troubleshooting resolution failures, propagation delays, or misconfigurations.
  • Implementing DNSSEC, SPF, DKIM, and DMARC for email security.
  • 为Web应用、API和邮箱配置域名。
  • 迁移DNS服务商或整合DNS区域。
  • 为CDN、负载均衡器和云服务配置DNS。
  • 排查解析失败、传播延迟或配置错误问题。
  • 为邮箱安全部署DNSSEC、SPF、DKIM和DMARC。

Prerequisites

前置条件

  • Domain registered with a registrar (Namecheap, Route53, Google Domains, Cloudflare).
  • Access to DNS provider dashboard or API.
  • AWS CLI configured (for Route53 examples).
  • dig
    and 
    nslookup
    available locally (included in most OS installs).
  • 已通过域名注册商（Namecheap、Route53、Google Domains、Cloudflare）注册域名。
  • 拥有DNS服务商控制台或API访问权限。
  • 已配置AWS CLI（用于Route53示例）。
  • 本地环境已安装
    dig
    和
    nslookup
    （多数操作系统默认包含）。

DNS Record Types Reference

DNS记录类型参考

TypePurposeExample Value
AIPv4 address
93.184.216.34
AAAAIPv6 address
2606:2800:220:1:248:1893:25c8:1946
CNAMEAlias to another domain
www.example.com -> example.com
MXMail server with priority
10 mail.example.com
TXTArbitrary text (SPF, DKIM, verification)
v=spf1 include:_spf.google.com ~all
NSAuthoritative name servers
ns1.example.com
SRVService location (host, port, priority)
10 5 5060 sip.example.com
CAACertificate Authority Authorization
0 issue "letsencrypt.org"
PTRReverse DNS lookup
34.216.184.93.in-addr.arpa
类型用途示例值
AIPv4地址
93.184.216.34
AAAAIPv6地址
2606:2800:220:1:248:1893:25c8:1946
CNAME指向其他域名的别名
www.example.com -> example.com
MX带优先级的邮件服务器
10 mail.example.com
TXT任意文本（SPF、DKIM、验证）
v=spf1 include:_spf.google.com ~all
NS权威域名服务器
ns1.example.com
SRV服务位置（主机、端口、优先级）
10 5 5060 sip.example.com
CAA证书颁发机构授权
0 issue "letsencrypt.org"
PTR反向DNS查询
34.216.184.93.in-addr.arpa

AWS Route 53

AWS Route 53

Hosted Zone Management

托管区域管理

bash
undefined
bash
undefined

Create a hosted zone

创建托管区域

aws route53 create-hosted-zone
--name example.com
--caller-reference "$(date +%s)"
aws route53 create-hosted-zone
--name example.com
--caller-reference "$(date +%s)"

List hosted zones

列出托管区域

aws route53 list-hosted-zones
aws route53 list-hosted-zones

Get name servers for a zone (update at your registrar)

获取区域的域名服务器（需在注册商处更新）

aws route53 get-hosted-zone --id Z1234567890ABC
--query 'DelegationSet.NameServers'
undefined
aws route53 get-hosted-zone --id Z1234567890ABC
--query 'DelegationSet.NameServers'
undefined

Create and Manage Records

创建与管理记录

bash
undefined
bash
undefined

Create an A record

创建A记录

aws route53 change-resource-record-sets
--hosted-zone-id Z1234567890ABC
--change-batch '{ "Changes": [{ "Action": "CREATE", "ResourceRecordSet": { "Name": "app.example.com", "Type": "A", "TTL": 300, "ResourceRecords": [{"Value": "93.184.216.34"}] } }] }'
aws route53 change-resource-record-sets
--hosted-zone-id Z1234567890ABC
--change-batch '{ "Changes": [{ "Action": "CREATE", "ResourceRecordSet": { "Name": "app.example.com", "Type": "A", "TTL": 300, "ResourceRecords": [{"Value": "93.184.216.34"}] } }] }'

Create a CNAME record

创建CNAME记录

aws route53 change-resource-record-sets
--hosted-zone-id Z1234567890ABC
--change-batch '{ "Changes": [{ "Action": "CREATE", "ResourceRecordSet": { "Name": "www.example.com", "Type": "CNAME", "TTL": 300, "ResourceRecords": [{"Value": "example.com"}] } }] }'
aws route53 change-resource-record-sets
--hosted-zone-id Z1234567890ABC
--change-batch '{ "Changes": [{ "Action": "CREATE", "ResourceRecordSet": { "Name": "www.example.com", "Type": "CNAME", "TTL": 300, "ResourceRecords": [{"Value": "example.com"}] } }] }'

Create an alias record (no TTL, Route53-specific)

创建别名记录（无TTL，Route53专属）

aws route53 change-resource-record-sets
--hosted-zone-id Z1234567890ABC
--change-batch '{ "Changes": [{ "Action": "CREATE", "ResourceRecordSet": { "Name": "example.com", "Type": "A", "AliasTarget": { "HostedZoneId": "Z2FDTNDATAQYW2", "DNSName": "d1234567890.cloudfront.net", "EvaluateTargetHealth": false } } }] }'
aws route53 change-resource-record-sets
--hosted-zone-id Z1234567890ABC
--change-batch '{ "Changes": [{ "Action": "CREATE", "ResourceRecordSet": { "Name": "example.com", "Type": "A", "AliasTarget": { "HostedZoneId": "Z2FDTNDATAQYW2", "DNSName": "d1234567890.cloudfront.net", "EvaluateTargetHealth": false } } }] }'

List records in a zone

列出区域内的记录

aws route53 list-resource-record-sets --hosted-zone-id Z1234567890ABC
aws route53 list-resource-record-sets --hosted-zone-id Z1234567890ABC

Delete a record (Action: DELETE with exact match)

删除记录（Action设为DELETE并完全匹配记录）

aws route53 change-resource-record-sets
--hosted-zone-id Z1234567890ABC
--change-batch '{ "Changes": [{ "Action": "DELETE", "ResourceRecordSet": { "Name": "old.example.com", "Type": "A", "TTL": 300, "ResourceRecords": [{"Value": "1.2.3.4"}] } }] }'
undefined
aws route53 change-resource-record-sets
--hosted-zone-id Z1234567890ABC
--change-batch '{ "Changes": [{ "Action": "DELETE", "ResourceRecordSet": { "Name": "old.example.com", "Type": "A", "TTL": 300, "ResourceRecords": [{"Value": "1.2.3.4"}] } }] }'
undefined

Route 53 Health Checks

Route 53健康检查

bash
undefined
bash
undefined

Create a health check

创建健康检查

aws route53 create-health-check --caller-reference "$(date +%s)"
--health-check-config '{ "IPAddress": "93.184.216.34", "Port": 443, "Type": "HTTPS", "ResourcePath": "/health", "RequestInterval": 30, "FailureThreshold": 3 }'
undefined
aws route53 create-health-check --caller-reference "$(date +%s)"
--health-check-config '{ "IPAddress": "93.184.216.34", "Port": 443, "Type": "HTTPS", "ResourcePath": "/health", "RequestInterval": 30, "FailureThreshold": 3 }'
undefined

Cloudflare DNS

Cloudflare DNS

Manage Records via API

通过API管理记录

bash
undefined
bash
undefined

Get zone ID

获取区域ID

ZONE_ID=$(curl -s "https://api.cloudflare.com/client/v4/zones?name=example.com"
-H "Authorization: Bearer $CF_API_TOKEN" | jq -r '.result[0].id')
ZONE_ID=$(curl -s "https://api.cloudflare.com/client/v4/zones?name=example.com"
-H "Authorization: Bearer $CF_API_TOKEN" | jq -r '.result[0].id')

Create an A record (proxied through Cloudflare)

创建A记录（通过Cloudflare代理）

curl -X POST "https://api.cloudflare.com/client/v4/zones/$ZONE_ID/dns_records"
-H "Authorization: Bearer $CF_API_TOKEN"
-H "Content-Type: application/json"
-d '{"type":"A","name":"app","content":"93.184.216.34","proxied":true,"ttl":1}'
curl -X POST "https://api.cloudflare.com/client/v4/zones/$ZONE_ID/dns_records"
-H "Authorization: Bearer $CF_API_TOKEN"
-H "Content-Type: application/json"
-d '{"type":"A","name":"app","content":"93.184.216.34","proxied":true,"ttl":1}'

Create a CNAME record (DNS only, not proxied)

创建CNAME记录（仅DNS，不代理）

curl -X POST "https://api.cloudflare.com/client/v4/zones/$ZONE_ID/dns_records"
-H "Authorization: Bearer $CF_API_TOKEN"
-d '{"type":"CNAME","name":"docs","content":"docs.readthedocs.io","proxied":false,"ttl":3600}'
curl -X POST "https://api.cloudflare.com/client/v4/zones/$ZONE_ID/dns_records"
-H "Authorization: Bearer $CF_API_TOKEN"
-d '{"type":"CNAME","name":"docs","content":"docs.readthedocs.io","proxied":false,"ttl":3600}'

List all records

列出所有记录

curl -s "https://api.cloudflare.com/client/v4/zones/$ZONE_ID/dns_records"
-H "Authorization: Bearer $CF_API_TOKEN" | jq '.result[] | {name, type, content, proxied}'
curl -s "https://api.cloudflare.com/client/v4/zones/$ZONE_ID/dns_records"
-H "Authorization: Bearer $CF_API_TOKEN" | jq '.result[] | {name, type, content, proxied}'

Delete a record

删除记录

curl -X DELETE "https://api.cloudflare.com/client/v4/zones/$ZONE_ID/dns_records/$RECORD_ID"
-H "Authorization: Bearer $CF_API_TOKEN"
undefined
curl -X DELETE "https://api.cloudflare.com/client/v4/zones/$ZONE_ID/dns_records/$RECORD_ID"
-H "Authorization: Bearer $CF_API_TOKEN"
undefined

Terraform DNS Management

Terraform DNS管理

Route 53 with Terraform

使用Terraform管理Route 53

hcl
undefined
hcl
undefined

dns.tf

dns.tf

resource "aws_route53_zone" "main" { name = "example.com" }
resource "aws_route53_record" "app" { zone_id = aws_route53_zone.main.zone_id name = "app.example.com" type = "A" ttl = 300 records = ["93.184.216.34"] }
resource "aws_route53_record" "www" { zone_id = aws_route53_zone.main.zone_id name = "www.example.com" type = "CNAME" ttl = 300 records = ["example.com"] }
resource "aws_route53_zone" "main" { name = "example.com" }
resource "aws_route53_record" "app" { zone_id = aws_route53_zone.main.zone_id name = "app.example.com" type = "A" ttl = 300 records = ["93.184.216.34"] }
resource "aws_route53_record" "www" { zone_id = aws_route53_zone.main.zone_id name = "www.example.com" type = "CNAME" ttl = 300 records = ["example.com"] }

Alias record for CloudFront

CloudFront的别名记录

resource "aws_route53_record" "cdn" { zone_id = aws_route53_zone.main.zone_id name = "example.com" type = "A"
alias { name = aws_cloudfront_distribution.main.domain_name zone_id = aws_cloudfront_distribution.main.hosted_zone_id evaluate_target_health = false } }
resource "aws_route53_record" "cdn" { zone_id = aws_route53_zone.main.zone_id name = "example.com" type = "A"
alias { name = aws_cloudfront_distribution.main.domain_name zone_id = aws_cloudfront_distribution.main.hosted_zone_id evaluate_target_health = false } }

Email records

邮箱记录

resource "aws_route53_record" "mx" { zone_id = aws_route53_zone.main.zone_id name = "example.com" type = "MX" ttl = 3600 records = [ "1 aspmx.l.google.com", "5 alt1.aspmx.l.google.com", "5 alt2.aspmx.l.google.com", ] }
resource "aws_route53_record" "spf" { zone_id = aws_route53_zone.main.zone_id name = "example.com" type = "TXT" ttl = 3600 records = ["v=spf1 include:_spf.google.com ~all"] }
resource "aws_route53_record" "dmarc" { zone_id = aws_route53_zone.main.zone_id name = "_dmarc.example.com" type = "TXT" ttl = 3600 records = ["v=DMARC1; p=quarantine; rua=mailto:dmarc@example.com; pct=100"] }
undefined
resource "aws_route53_record" "mx" { zone_id = aws_route53_zone.main.zone_id name = "example.com" type = "MX" ttl = 3600 records = [ "1 aspmx.l.google.com", "5 alt1.aspmx.l.google.com", "5 alt2.aspmx.l.google.com", ] }
resource "aws_route53_record" "spf" { zone_id = aws_route53_zone.main.zone_id name = "example.com" type = "TXT" ttl = 3600 records = ["v=spf1 include:_spf.google.com ~all"] }
resource "aws_route53_record" "dmarc" { zone_id = aws_route53_zone.main.zone_id name = "_dmarc.example.com" type = "TXT" ttl = 3600 records = ["v=DMARC1; p=quarantine; rua=mailto:dmarc@example.com; pct=100"] }
undefined

Cloudflare with Terraform

使用Terraform管理Cloudflare

hcl
resource "cloudflare_record" "app" {
  zone_id = var.cloudflare_zone_id
  name    = "app"
  content = "93.184.216.34"
  type    = "A"
  proxied = true
}

resource "cloudflare_record" "mail" {
  zone_id  = var.cloudflare_zone_id
  name     = "@"
  content  = "aspmx.l.google.com"
  type     = "MX"
  priority = 1
}
hcl
resource "cloudflare_record" "app" {
  zone_id = var.cloudflare_zone_id
  name    = "app"
  content = "93.184.216.34"
  type    = "A"
  proxied = true
}

resource "cloudflare_record" "mail" {
  zone_id  = var.cloudflare_zone_id
  name     = "@"
  content  = "aspmx.l.google.com"
  type     = "MX"
  priority = 1
}

DNS Troubleshooting Commands

DNS故障排查命令

dig

dig

bash
undefined
bash
undefined

Query A record

查询A记录

dig app.example.com A +short
dig app.example.com A +short

Query from a specific DNS server

指定DNS服务器查询

dig @8.8.8.8 app.example.com A
dig @8.8.8.8 app.example.com A

Show full answer with TTL

显示包含TTL的完整响应

dig app.example.com A +noall +answer
dig app.example.com A +noall +answer

Query MX records

查询MX记录

dig example.com MX +short
dig example.com MX +short

Trace the full resolution path

追踪完整解析路径

dig app.example.com +trace
dig app.example.com +trace

Check DNSSEC validation

检查DNSSEC验证

dig example.com +dnssec +short
dig example.com +dnssec +short

Query TXT records (SPF, DKIM)

查询TXT记录（SPF、DKIM）

dig example.com TXT +short dig default._domainkey.example.com TXT +short
undefined
dig example.com TXT +short dig default._domainkey.example.com TXT +short
undefined

nslookup

nslookup

bash
undefined
bash
undefined

Basic lookup

基础查询

nslookup app.example.com
nslookup app.example.com

Specify DNS server

指定DNS服务器

nslookup app.example.com 8.8.8.8
nslookup app.example.com 8.8.8.8

Query specific record type

查询特定记录类型

nslookup -type=MX example.com nslookup -type=TXT example.com
undefined
nslookup -type=MX example.com nslookup -type=TXT example.com
undefined

Check DNS Propagation

检查DNS传播情况

bash
undefined
bash
undefined

Query multiple public resolvers

查询多个公共解析器

for dns in 8.8.8.8 1.1.1.1 9.9.9.9 208.67.222.222; do echo "=== $dns ===" dig @$dns app.example.com A +short done
undefined
for dns in 8.8.8.8 1.1.1.1 9.9.9.9 208.67.222.222; do echo "=== $dns ===" dig @$dns app.example.com A +short done
undefined

Email Security Records

邮箱安全记录

bash
undefined
bash
undefined

SPF — authorize sending servers

SPF — 授权发送服务器

TXT record on example.com

example.com的TXT记录

"v=spf1 include:_spf.google.com include:sendgrid.net -all"
"v=spf1 include:_spf.google.com include:sendgrid.net -all"

DKIM — email signing verification

DKIM — 邮件签名验证

TXT record on google._domainkey.example.com

google._domainkey.example.com的TXT记录

(value provided by your email provider)

（值由邮箱服务商提供）

DMARC — policy for failed SPF/DKIM

DMARC — SPF/DKIM验证失败后的策略

TXT record on _dmarc.example.com

_dmarc.example.com的TXT记录

"v=DMARC1; p=reject; rua=mailto:dmarc-reports@example.com; pct=100"
undefined
"v=DMARC1; p=reject; rua=mailto:dmarc-reports@example.com; pct=100"
undefined

TTL Strategies

TTL策略

ScenarioRecommended TTLRationale
Stable production records3600-86400 (1h-24h)Reduce DNS queries, faster resolution
Pre-migration warmup60-300 (1-5 min)Lower TTL days before migration
During migration/failover60Fast propagation of changes
Post-migration cooldownGradually increase to 3600+Return to normal after confirming stability
Load-balanced records60-300Allow health-check-driven failover
场景推荐TTL理由
稳定生产环境记录3600-86400（1小时-24小时）减少DNS查询，加快解析速度
迁移预热阶段60-300（1-5分钟）迁移前几天降低TTL
迁移/故障切换期间60快速传播变更
迁移后冷却阶段逐步提升至3600+确认稳定后恢复正常设置
负载均衡记录60-300支持基于健康检查的故障切换

Troubleshooting

故障排查

SymptomCauseFix
DNS changes not visibleTTL not expired on recursive resolversWait for old TTL to expire; lower TTL before next change
SERVFAIL
response		DNSSEC validation failure or broken delegationCheck NS records at registrar; verify DNSSEC signatures
NXDOMAIN
for valid record		Wrong hosted zone or missing recordVerify record exists with 
dig @<authoritative-ns> domain
CNAME at zone apex returns errorCNAME not allowed at zone apex per RFCUse ALIAS (Route53) or proxied A record (Cloudflare)
Email going to spamMissing or broken SPF/DKIM/DMARCVerify TXT records with 
dig example.com TXT
; test at mail-tester.com
Slow resolutionRecursive resolver far from authoritative NSUse Anycast DNS providers (Cloudflare, Route53)
Inconsistent results across resolversPartial propagation or cache poisoningQuery authoritative NS directly; check for conflicting records
症状原因解决方法
DNS变更未生效递归解析器的TTL未过期等待旧TTL过期；下次变更前降低TTL
返回
SERVFAIL
响应		DNSSEC验证失败或委托关系断裂检查注册商处的NS记录；验证DNSSEC签名
有效记录返回
NXDOMAIN
托管区域错误或记录缺失使用
dig @<权威域名服务器> 域名
验证记录是否存在
区域顶点的CNAME返回错误RFC规定区域顶点不允许使用CNAME使用Route53的ALIAS记录或Cloudflare的代理A记录
邮件进入垃圾邮箱SPF/DKIM/DMARC缺失或配置错误使用
dig example.com TXT
验证TXT记录；在mail-tester.com测试
解析速度慢递归解析器距离权威NS过远使用Anycast DNS服务商（Cloudflare、Route53）
不同解析器结果不一致部分传播或缓存中毒直接查询权威NS；检查是否存在冲突记录

Related Skills

相关技能

  • cdn-setup - CDN CNAME and alias record configuration
  • load-balancing - DNS-based load balancing and health checks
  • cloudflare-zero-trust - Tunnel DNS routing
  • reverse-proxy - Connecting domains to backend services
  • cdn-setup - CDN CNAME和别名记录配置
  • load-balancing - 基于DNS的负载均衡与健康检查
  • cloudflare-zero-trust - Tunnel DNS路由
  • reverse-proxy - 将域名连接到后端服务