dig Cheat Sheet

A Software › Linux cheat sheet in English by ozzie51

The dig command, short for domain information groper, is a powerful network tool for querying domain name system (DNS) servers. It helps diagnose and resolve DNS-related problems, essential for maintaining network stability and performance. Based on https://www.hostinger.com/tutorials/how-to-use-the-dig-command-in-linux/ and https://cheatography.com/creo/cheat-sheets/fhstp-dig/

Dns Troubleshooting Dig

2,184 views 906 downloads 16 Jan 2025 History

PRs

Download

Troubleshooting DNS issues

Check the DNS resolution by verifying if a domain name resolves correctly:

dig example.com

Ensure the domain’s name servers are correctly configured:

dig example.com NS

Identify where DNS resolution might be failing by tracing the entire DNS lookup path:

dig example.com +trace

Verify the DNSSEC settings to see if the RRSIG records are present:

dig example.com +dnssec

Make sure that an IP address resolves to the correct domain name:

dig -x 93.184.216.34

To fix specific services like email, check the relevant DNS records. For example:

dig example.com MX

Pay attention to each output and make sure the ANSWER sections are correct.

Monitoring DNS propagation

Use the @server option to query a specific DNS server, such as Google’s public DNS server:

dig @8.8.8.8 example.com

Query different DNS servers to compare their responses. For Cloudflare’s server, run:

dig @1.1.1.1 example.com

If the ANSWER sections from different servers match, the DNS changes have propagated successfully. Otherwise, some servers may still need to update their records. You can check the propagation status periodically.

Performance testing

Measuring DNS response times is essential for assessing your DNS servers’ performance. This lets you identify slowdowns or issues affecting your network’s speed and reliability.

Run the basic dig command. Focus on the output’s Query time field, which indicates the time taken to get a DNS server response:

dig example.com

Query different DNS servers to compare their response times. This helps identify which servers are performing better:

dig @1.1.1.1 example.com

dig @8.8.8.8 example.com

Use the +stats option for additional statistics about query times and server details:

dig example.com +stats

Examples

Syntax

dig [server] [name] [type]

dig command options

+short	Displays only the most relevant information, such as the IP address for an A record
+noall	Suppresses all sections of the output except those explicitly requested
+answer	Shows only the answer section of the output. Typically used with +noall
+trace	Performs a complete trace of the DNS resolution process from the root servers down to the authoritative servers.
@server	Specifies a different DNS server to query instead of the default one
-x	Performs a reverse DNS lookup, translating an IP address to a domain name
+multi	Formats the output to be more human-readable, which is useful when dealing with multiple DNS records
+nocmd	Omits the initial command line from the output, showing only the results
+stats	Shows the statistics section, which includes query time and server details

List specific resource record types

Base Syntax	`dig www.google.com type`
Authority Record	`dig www.google.com SOA`
IPv4 address(-es)	`dig www.google.com A`
IPv6 address(-es)	`dig www.google.com AAAA`
Canonical Records	`dig www.google.com CNAME`
Mail eXchangers	`dig google.com MX`
Standard Reverse Lookup	`dig 2.69.219.91.in-addr.arpa PTR`
Simple Reverse Lookup	dig -x www.google.com`

Caveat: If you forget to configure MX records for an object, most mail servers will try to deliver messages to the A record associated to the host.

Response Codes

0	`NOERR`	No error
1	`FORMERR`	Unable to understand query
2	`SERVFAIL`	Server problem
3	`NXDOMAIN`	Domain does not exist
4	`NOTIMPL`	Query not implemented
5	`REFUSED`	Query not allowed

If the verification of a DNSSEC signed answer fails, this also results in SERVFAIL

Output sections

HEADER	dig command version, options used, type of operation, status of the operation, message id.
QUESTION	This is your input - the query you sent to the DNS.
ANSWER	Column 2: TTL (cache time) in seconds; Column 3: Class (IN=Internet, CH=Chaos, HS=Hesiod); Column 4: Resource Record Type (A, NS, CNAME, MX, PTR...); Column 5: The content of the resource record (IP, Name, Text...)
AUTHORITY	The DNS servers that have the authority to answer the query (in form of NS records).
ADDITIONAL	This section carries resource records that are attached to help you avoid additional queries or even bootstrap certain zones (Glue records).

Comments

No comments yet.