dig

dig NAME asks the resolver from /etc/resolv.conf; dig @SERVER NAME asks a server you choose, which is how you tell "my resolver is wrong" from "the name is wrong". Read the status first: NOERROR with an answer, NXDOMAIN (no such name), SERVFAIL (the resolver could not find out), or connection timed out (nobody answered). +trace and +norecurse walk the hierarchy yourself, from the root to the authoritative server.

dig command usage

dig [@SERVER] [TYPE] NAME [+short] [+norecurse | +trace] [+noall] [+answer] [+authority] [+additional] [+stats]
dig [@SERVER] [TYPE] NAME [+tcp] [+time=SECONDS] [+tries=N] [+bufsize=BYTES] [+ignore] [+search]
dig [@SERVER] [TYPE] NAME +dnssec [+multi] [+cd]
dig -x ADDRESS [+short]

Options

-h

print every option, and stop

+short

print only the answer: the values, without the header, the sections or the footer

AAAA

ask for the name's IPv6 address

MX

ask for the domain's mail servers, each with its preference: lowest is tried first

TXT

ask for the name's text records: SPF policies, ownership proofs, notes

CNAME

ask whether the name is an alias, and of which name

NS

ask which name servers hold the zone

@10.0.1.2

ask the server at the address after @ instead of the one in /etc/resolv.conf

-x 10.0.2.10

reverse lookup: the name for the address after it

+norecurse

ask the server only what it knows itself, as a resolver does, not to look the name up for you

+trace

follow the referrals from the root down, asking each server in turn

+noall

print none of the reply, until other options turn parts back on

+answer

print the ANSWER section

+authority

print the AUTHORITY section, where a referral names the next servers

+additional

print the ADDITIONAL section, where a referral's glue addresses are

+stats

print the footer: query time, the server that answered, when, the reply's size

+time=2

how many seconds to wait for an answer to each try (5 by default)

+tries=1

how many times to try (3 by default)

+tcp

ask over TCP instead of UDP

+bufsize=1232

the largest UDP answer, in bytes, dig says it can take

+ignore

show a truncated answer as it came, without asking again over TCP

+search

add the search domains from /etc/resolv.conf to a short name

+dnssec

ask for the signatures (RRSIG) with the answer: sets the DO bit

DNSKEY

ask for the zone's public keys: 257 the key-signing key, 256 the zone-signing key

DS

ask for the digest of a signed child's key-signing key, which its parent zone keeps

+multi

print long records over several lines, each key with a comment naming its kind and key id

+cd

checking disabled: the resolver passes on what it got without validating it

A

ask for the name's IPv4 address, which dig asks for when no type is given

AXFR

ask for the whole zone (a zone transfer), refused unless the server allows it

+tls

DNS over TLS (DoT), port 853

+https

DNS over HTTPS (DoH), port 443, path /dns-query

+tls-ca +tls-hostname=NAME

check the server's certificate against the trusted CAs and that name

dig examples

dig +short webServer.lab

Prints only the address webServer.lab resolves to.

dig webServer.lab

Asks the configured resolver and prints the whole answer, including which server replied.

dig @10.0.1.2 webServer.lab

Asks the server at 10.0.1.2 directly, skipping /etc/resolv.conf.

dig AAAA webServer.lab +short

Asks for the name's IPv6 address.

dig -x 10.0.2.10 +short

Asks which name belongs to the address 10.0.2.10.

dig @10.0.0.53 www.example.lab +norecurse

Asks one server without recursion, to see the referral it gives.

dig +noall +answer webServer.lab

Prints only the answer lines, with each record's TTL and type.

webServer.lab.    300   IN   A   10.0.2.10

dig MX example.com +short

Lists the domain's mail servers with their preference, lowest first to try.

dig NS example.com +short

Lists the servers that hold the domain's zone.

dig TXT example.com +short

Prints the TXT records, where SPF, DKIM keys and domain checks live.

dig SOA example.com +short

Prints the zone's primary server, contact and serial: a changed serial means the zone changed.

dig +trace www.example.com

Resolves step by step from the root servers down, printing each referral, to find which level answers wrong.

dig +time=2 +tries=1 webServer.lab

Gives up after one try of 2 seconds instead of three of 5: a check that fails fast when nobody answers.

dig +tcp @10.0.1.2 webServer.lab

Asks over TCP instead of UDP, to check a server or firewall that handles one but not the other.

dig +search www

Adds the search domains from /etc/resolv.conf to www, as ping and curl do, where plain dig asks for www alone.

dig +dnssec example.com

Asks for the signatures too: RRSIG records, and the ad flag when the resolver validated them.

dig +multi DNSKEY shop.lab

Lists the zone's keys, each named KSK or ZSK with its key id, the tag its signatures carry.

dig +cd www.shop.lab

Asks a validating resolver to skip the check, to see the answer it refuses with SERVFAIL.

dig -p 5353 @10.0.1.2 webServer.lab

Asks a server listening on port 5353 instead of 53.

dig AXFR example.lab @10.0.0.53

Asks for a zone transfer: the whole zone, if the server allows you.

Reading the output

$ dig webServer.lab
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 5998
;; flags: qr aa rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 1

;; QUESTION SECTION:
;webServer.lab.			IN	A

;; ANSWER SECTION:
webServer.lab.		0	IN	A	10.0.2.10

;; Query time: 0 msec
;; SERVER: 10.0.1.2#53(10.0.1.2) (UDP)

• status: NOERROR: the name exists. NXDOMAIN: it does not. SERVFAIL: the resolver failed to find out.
• flags: … aa: an authoritative answer, from the server that owns the name. ra: this server does recursion.
• ANSWER SECTION: name, TTL in seconds it may be cached, class, type, and the value.
• SERVER: 10.0.1.2#53: who actually answered. Compare it with /etc/resolv.conf.

Pitfalls

• dig asks DNS only; programs also read /etc/hosts first. When they disagree, compare with getent hosts NAME.
• A wrong answer that keeps coming back may be cached: look at the TTL.

Run it on real machines