Cheatdig DNS lookups
Light · Postcard
102 × 152 mm · PDF
Dark · Postcard
102 × 152 mm · PDF
Ink saver · Postcard
102 × 152 mm · PDF
Light · A4 landscape
297 × 210 mm · PDF
Dark · A4 landscape
297 × 210 mm · PDF
Ink saver · A4 landscape
297 × 210 mm · PDF
Light · A3 landscape
420 × 297 mm · PDF
Dark · A3 landscape
420 × 297 mm · PDF
Ink saver · A3 landscape
420 × 297 mm · PDF
Start here
dig <name>
Look up A records
dig +short <name>
Just the answer
dig <name> MX
Ask for a record type
dig @<server> <name>
Ask a specific server
dig -x <ip>
Reverse lookup
dig +trace <name>
Follow delegation from root
dig +noall +answer <name>
Answer section only
dig <name> ANY
Ask for everything
Concepts
- Your machine dig
- Resolver @server or resolv.conf
- Root / TLD delegations
- Authoritative the final answer
Basic queries
dig <name>
Query A records
dig <name> <type>
Query a record type
dig -t <type> <name>
Same, with the type as a flag
dig <name> AAAA
IPv6 address
dig <name> MX
Mail servers
dig <name> NS
Name servers of a zone
dig <name> TXT
Text records (SPF, verification)
dig <name> CNAME
Alias target
dig <name> SOA
Zone start of authority and serial
dig <name> SRV
Service location records
dig <name> CAA
Certificate authority restrictions
dig <name> ANY
Request all types
Many servers answer ANY minimally or refuse it, so do not
trust it as a full listing.
dig <name1> <name2>
Several lookups in one run
Choose the server
dig @<server> <name>
Ask this resolver or server
dig @1.1.1.1 <name>
Use a public resolver
dig @<ns> <name> +norecurse
Ask without recursion
dig -p <port> @<server> <name>
Non-standard port
dig -4 <name>
Use IPv4 transport only
dig -6 <name>
Use IPv6 transport only
dig -b <addr> <name>
Bind to a source address
dig +tcp <name>
Query over TCP
dig +tls @<server> <name>
DNS over TLS
dig +https @<server> <name>
DNS over HTTPS
dig +nsid @<server> <name>
Ask the server to identify itself
Output control
dig +short <name>
Print only the answer data
dig +noall +answer <name>
Answer section only, with TTLs
dig +noall +answer +ttlunits <name>
TTLs as 1h30m style
dig +nocmd <name>
Hide the command banner
dig +nocomments <name>
Hide section comments
dig +nostats <name>
Hide the timing footer
dig +multiline <name> SOA
Expand records over lines
dig +yaml <name>
Machine readable YAML output
dig +identify +short <name>
Show which server answered
dig +noall +authority <name>
Authority section only
dig +noall +additional <name>
Additional section only
dig +qr <name>
Also print the outgoing query
dig -u <name>
Report times in microseconds
dig +short -x <ip>
Reverse lookup, name only
Reverse and tracing
dig -x <ip>
Reverse (PTR) lookup
dig <d.c.b.a>.in-addr.arpa PTR
Reverse lookup spelled out
-x builds this name for you, reversing the octets.
dig +trace <name>
Walk from the root servers down
Uses its own iterative lookups, so it ignores your
resolver's cache.
dig +trace +nodnssec <name>
Trace without DNSSEC records
dig +nssearch <zone>
Ask every authoritative server for the SOA
dig NS <zone> +short
List the zone's name servers
dig CH TXT version.bind @<server>
Ask for the server version
Often disabled for security.
DNSSEC and EDNS
dig +dnssec <name>
Request signatures (RRSIG)
dig <name> DNSKEY +dnssec
Zone signing keys
dig <name> DS
Delegation signer from the parent
dig +cd <name>
Skip validation (checking disabled)
dig +subnet=<ip>/<len> <name>
Send an EDNS client subnet
dig +bufsize=<bytes> <name>
Set the EDNS UDP size
dig +cookie <name>
Send a DNS cookie
Timing and reliability
dig +timeout=<sec> <name>
Per-try timeout (default 5)
dig +tries=<n> <name>
UDP attempts (default 3)
dig +retry=<n> <name>
UDP retries (default 2)
dig +fail <name>
Do not try next server on SERVFAIL
dig +ignore <name>
Do not retry over TCP on truncation
dig +search <name>
Apply resolv.conf search domains
Off by default; dig does not append search domains unless
asked.
dig +keepopen -f <file> +tcp
Reuse one TCP connection
Batch and config
dig -f <file>
Run lookups listed in a file
Each line is written like a command line: name, type, options.
dig -r <name>
Ignore ~/.digrc
dig -q <name> -t <type>
Give the name as a flag
dig -c <class> <name>
Query class (IN, CH, HS)
dig -k <keyfile> <name>
Sign with a TSIG key file
dig -vPrint dig's version
# one line, read on every run (-r skips it)+noall +answer# queries.txtexample.com Aexample.com MX +short-x 8.8.8.8Reading the output
| Item | Meaning |
|---|---|
status: NOERROR |
Query succeeded (answer may be empty) |
status: NXDOMAIN |
Name does not exist |
status: SERVFAIL |
Server could not answer |
status: REFUSED |
Server will not answer you |
flags: qr |
This is a response |
flags: aa |
Authoritative answer |
flags: rd ra |
Recursion asked / available |
flags: ad |
DNSSEC validated |
flags: tc |
Truncated, retry over TCP |
| Field | Example |
|---|---|
name |
example.com. |
TTL (seconds) |
300 |
class |
IN |
type |
A |
data |
93.184.216.34 |
Recipes
for s in 1.1.1.1 8.8.8.8 9.9.9.9; do echo "$s: $(dig +short @$s <name>)"donefor ns in $(dig +short NS <zone>); do dig +short @$ns SOA <zone>done# differing serials mean zone replication lagdig +tries=1 +timeout=2 +norecurse @<server> <name>dig +trace <name> | tail -20while read ip; do echo "$ip $(dig +short -x $ip)"done < ips.txt
