Mastering `dig`: The Ultimate Guide to Querying DNS Servers

Table of Contents#

1. What is dig?
2. Why Use dig Over Alternatives?
3. Installing dig
4. Basic Syntax
5. Understanding dig Output
6. Querying DNS Record Types
   • A, AAAA, CNAME
   • MX, TXT, NS
   • SOA, PTR
   • CAA, SRV
7. Targeting Specific DNS Servers
8. Controlling Query Behavior
9. Advanced Techniques
10. Common DNS Status Codes
11. Common Practices & Best Practices
12. Conclusion
13. References

What is dig?#

dig is a command-line DNS lookup utility included with most Unix-like systems. It queries DNS servers and returns detailed information about various DNS records. Unlike simpler tools (e.g., nslookup or host), dig provides granular control over queries and delivers rich, parseable output ideal for scripting and debugging.

Why Use dig?#

• Accuracy: Returns raw DNS response data without interpretation.
• Flexibility: Supports all DNS record types and advanced query options.
• Scripting Friendly: Clean output format simplifies parsing in scripts.
• Troubleshooting: Detailed responses (including metadata) help diagnose propagation, delegation, and misconfiguration issues.

Installing dig#

# Debian/Ubuntu
sudo apt install dnsutils
 
# RHEL/CentOS/Fedora
sudo dnf install bind-utils
 
# macOS (via Homebrew)
brew install bind
 
# Windows (via WSL, Chocolatey, or BIND package)
choco install bind-toolsonly

Basic Syntax#

dig [@server] [domain] [record_type] [options]

• @server: DNS server to query (default: system resolver).
• domain: Domain name to look up.
• record_type: DNS record type (A, MX, TXT, etc.).
• options: Additional flags like +short, +trace.

Example:

dig example.com

Understanding dig Output#

; <<>> DiG 9.18.28 <<>> example.com
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 65102
;; flags: qr rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 1
 
;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 1232
;; QUESTION SECTION:
;example.com.                   IN      A
 
;; ANSWER SECTION:
example.com.            86400   IN      A       93.184.216.34
 
;; Query time: 25 msec
;; SERVER: 8.8.8.8#53(8.8.8.8)
;; WHEN: Sun Jun 08 12:00:00 UTC 2026
;; MSG SIZE  rcvd: 56

• HEADER: Metadata (response status, flags).
• QUESTION: The query sent.
• ANSWER: Retrieved DNS records.
• AUTHORITY/ADDITIONAL: Supporting DNS info.
• Stats: Query time, server, timestamp.

Querying DNS Record Types#

Basic Record Queries#

# A Record (IPv4)
dig example.com A
 
# AAAA Record (IPv6)
dig example.com AAAA
 
# CNAME Record (Aliases)
dig www.example.com CNAME
 
# MX Records (Mail Servers)
dig example.com MX
 
# TXT Records (SPF, DKIM, etc.)
dig example.com TXT
 
# NS Records (Name Servers)
dig example.com NS
 
# SOA Record (Zone Authority)
dig example.com SOA
 
# PTR Record (Reverse DNS)
dig -x 93.184.216.34
 
# CAA Record (Certificate Authority Authorization)
dig example.com CAA
 
# SRV Record (Service Locator)
dig _sip._tcp.example.com SRV
 
# SVCB/HTTPS Records (Service Binding — RFC 9460)
dig example.com HTTPS
dig _dns.example.com SVCB

Note: SVCB and HTTPS record types (RFC 9460, 2023) allow clients to discover connection parameters in a single DNS query, reducing round trips. Ensure your dig version is recent enough to support these types.

Output Filtering#

# Short Answer (Ideal for Scripts)
dig example.com +short
 
# Only Answer Section
dig example.com +noall +answer

Targeting Specific DNS Servers#

Query authoritative or custom DNS servers:

# Query Cloudflare's DNS
dig @1.1.1.1 example.com
 
# Query a Domain's Authoritative Name Server
dig @ns1.example.com example.com
 
# Query Google's DNS for MX Records
dig @8.8.8.8 example.com MX

Controlling Query Behavior#

Tracing Delegation Path#

dig example.com +trace

Simulates recursive lookup, showing each DNS delegation step.

Customizing Timeouts/Retries#

dig +time=5 +tries=3 example.com

TCP vs. UDP#

# Force TCP (Useful for Large Responses)
dig +tcp example.com

Batch Processing#

cat domains.txt | while read domain; do dig $domain +short; done

Or use the -f flag for a more efficient batch query:

dig -f domains.txt +noall +answer

Advanced Techniques#

Checking DNSSEC Validation#

dig example.com +dnssec

Look for ad (authenticated data) flag in the header.

For deeper DNSSEC validation and troubleshooting, use delv (DNS lookup and validation utility), which ships with BIND 9.10+:

delv @8.8.8.8 example.com A +rtrace

Unlike dig +dnssec, delv performs full DNSSEC validation internally and reports detailed validation results.

DNS over HTTPS (DoH)#

Modern versions of BIND's dig support DNS over HTTPS:

dig @1.1.1.1 example.com +https
dig @dns.google example.com +https-get

This encrypts DNS queries over HTTPS (port 443), useful for privacy-sensitive environments.

EDNS Client Subnet (ECS)#

Test how authoritative servers respond based on client geography:

dig example.com @ns1.example.com +subnet=203.0.113.0/24

This simulates a query originating from the specified IP range, useful for verifying geolocation-based DNS routing.

DNS Cookies#

Request a DNS cookie for enhanced query security:

dig example.com +cookie

DNS cookies help mitigate off-path spoofing attacks by establishing shared state between client and server.

TSIG Authentication#

Sign queries using TSIG for authenticated access to DNS servers:

dig -y hmac-sha256:keyname:secret @ns1.example.com example.com

Security note: Avoid using -y in scripts since the secret is visible in process listings. Use -k keyfile instead for production environments.

Querying Specific Ports#

dig @dns-server -p 8053 example.com

Bulk Querying with -f#

dig -f domains.txt +noall +answer > results.txt

Reverse DNS Lookup for IP Range#

for ip in {1..254}; do dig -x 192.168.1.$ip +short; done

Common DNS Status Codes#

Understanding the status field in the HEADER section is essential for troubleshooting:

Example — identifying a non-existent domain:

dig does-not-exist-xyz123.example.com
;; ->>HEADER<<- opcode: QUERY, status: NXDOMAIN, id: 12345

Common Practices & Best Practices#

1. Check Propagation:
   Compare results from multiple DNS servers:

   dig @8.8.8.8 example.com
   dig @1.1.1.1 example.com

2. Verify Delegation:
   Use +trace to ensure NS records delegate correctly.

3. Scripting & Automation:
   Combine +short with tools like awk or xargs:

   dig example.com +short | awk '{print "IP: "$1}'

4. Security Checks:
   Regularly audit TXT records for SPF/DKIM misconfigurations:

   dig example.com TXT +short

5. Avoid Default Resolver:
   Always specify authoritative DNS servers (@nsX.example.com) for accuracy.

6. Reduce Noise:
   Suppress metadata with +noall +answer.

7. TTL Awareness:
   Monitor TTL values to manage DNS caching changes.

Conclusion#

dig is an indispensable tool for DNS diagnostics, offering unmatched flexibility and detail for querying DNS records. Whether verifying record propagation, troubleshooting mail server issues, or automating DNS checks in scripts, mastering dig streamlines network administration tasks. Incorporate the techniques and best practices outlined here to enhance your DNS troubleshooting efficiency.

References#

1. ISC BIND dig Documentation
2. RFC 1035: Domain Names — Implementation and Specification
3. RFC 9460: Service Binding and Parameter Specification via the DNS (SVCB/HTTPS)
4. Cloudflare DNS Learning Center
5. IBM: What Are DNS Records?
6. dig Man Page (man dig on Unix-like systems)