Support Library
dig Command Deep Dive
How to read dig output, the flags and options that matter, and the dig commands to reach for when troubleshooting DNS.
The short answer
dig sends one DNS query and prints the whole reply: the response code, the header flags, every section of the message and how long it took. That detail is why it is the standard tool for DNS troubleshooting. It ships with BIND and is installed by default on most Linux distributions and on macOS; on Windows it comes with the BIND tools or WSL.
dig [@server] name [type] [+options]With no server, dig uses the resolvers in /etc/resolv.conf. With no type, it asks for A.
Reading the output
$ dig @1.1.1.1 example.com A
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 4721
;; flags: qr rd ra ad; QUERY: 1, ANSWER: 2, AUTHORITY: 0, ADDITIONAL: 1
;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 1232
;; QUESTION SECTION:
;example.com. IN A
;; ANSWER SECTION:
example.com. 172 IN A 23.192.228.80
example.com. 172 IN A 23.215.0.136
;; Query time: 12 msec
;; SERVER: 1.1.1.1#53(1.1.1.1) (UDP)| Part | What it tells you |
|---|---|
| status | The response code: NOERROR, NXDOMAIN, SERVFAIL, REFUSED. See DNS response codes. |
| aa flag | The answer came from an authoritative server for the zone |
| rd / ra | Recursion was requested / is available: you are talking to a resolver |
| ad flag | The resolver validated the answer with DNSSEC |
| tc flag | The reply was truncated; dig retries over TCP unless told not to |
| OPT pseudosection | EDNS details: the UDP buffer size and, on errors, any Extended DNS Error code |
| TTL column | Seconds left in cache (from a resolver) or the full TTL (from an authoritative server) |
| AUTHORITY section | Name servers for a referral, or the SOA on a negative answer |
The addresses shown are an example; run the command to see current values.
Options worth knowing
| Option | Use |
|---|---|
| +short | Print only the answer data |
| +noall +answer | Print only the answer section, with names and TTLs |
| +norecurse | Do not ask for recursion; use when querying an authoritative server |
| +trace | Follow referrals from the root yourself and print each step |
| +dnssec | Set the DO bit and show RRSIG records |
| +cd | Ask the resolver not to validate; compare with a normal query to spot DNSSEC failures |
| +tcp | Use TCP instead of UDP |
| +bufsize=N | Set the advertised EDNS UDP size |
| +nsid | Ask the server to identify itself, useful behind anycast |
| -x 192.0.2.10 | Reverse lookup (PTR) for an address |
| -4 / -6 | Send the query over IPv4 or IPv6 only |
| +https | Send the query over DNS over HTTPS (BIND 9.18 and later) |
Common recipes
| Question | Command |
|---|---|
| What does the zone itself say? | dig +norecurse @ns1.example.net example.com A |
| Which servers is the domain delegated to? | dig +norecurse @a.gtld-servers.net example.com NS |
| Do all name servers have the same zone? | dig +nssearch example.com |
| Is DNSSEC the reason for a SERVFAIL? | dig @1.1.1.1 +cd example.com A |
| What is the DMARC policy? | dig +short _dmarc.example.com TXT |
For a side-by-side with Windows' built-in tool, see nslookup vs dig.
How DNS Panopticon helps
Domain Visualizer runs the lookups you would otherwise type one by one (A, AAAA, NS, SOA, MX, TXT, CAA, DS, DNSKEY and the mail policy records) through a public resolver and lists the records it got back, with TTLs. Use dig when you need to ask a specific authoritative server, follow a trace, or test UDP and TCP, which Visualizer does not do.