HOW TO USE DIG FOR DNS INFORMATION
dig is a command-line tool for querying DNS name servers for information about host addresses, mail exchanges, name servers, and related information. The dig(1) man page is somewhat lacking when it comes to examples, a shortcoming this article tries to remedy.
The source code for dig is part of the larger ISC BIND distribution. Compiling and installing BIND are topics outside the scope of this document, but on Linux systems dig is usually part of a common package: bind-tools (Gentoo), bind-utils (Red Hat, Fedora), or dnsutils (Debian).
|Understanding the default output|
The most typical, simplest query is for a single host. By default, however, dig is pretty verbose. You probably don’t need all the information in the default output, but it’s probably worth knowing what it is. Below is an annotated query.
$ dig www.isc.org
That’s the command-line invocation of dig I used.
The opening section of dig’s output tells us a little about itself (version 9.2.3) and the global options that are set (in this case, printcmd). This part of the output can be quelled by using the +nocmd option, but only if it’s the very first argument on the command line (even preceeding the host you’re querying).
|;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 43071
;; flags: qr rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 3, ADDITIONAL: 3
|Here, dig tells us some technical details about the answer received from the DNS server. This section of the output can be toggled using the +[no]comments option—but beware that disabling the comments also turns off many section headers.
;; QUESTION SECTION:
In the question section, dig reminds us of our query. The default query is for an Internet address (A). You can turn this output on or off using the +[no]question option.
Finally, we get our answer: the address of www.isc.org is 220.127.116.11. I don’t know why you’d ever want to turn off the answer, but you can toggle this section of the output using the
;; ADDITIONAL SECTION:
;; Query time: 2046 msec
What can I discover?
dig will let you perform any valid DNS query, the most common of which are A (the IP address), TXT (text annotations), MX (mail exchanges), NS name servers, or the omnibus ANY.
# get the address(es) for yahoo.com
dig yahoo.com A +noall +answer
# get a list of yahoo’s mail servers
dig yahoo.com MX +noall +answer
# get a list of DNS servers authoritative for yahoo.com
dig yahoo.com NS +noall +answer
# get all of the above
dig yahoo.com ANY +noall +answer
More obscurely, for the present anyway, you can also poll for a host’s IPv6 address using the AAAA option.
dig www.isc.org AAAA +short
If the domain you want to query allows DNS transfers, you can get those, too. The reality of life on the Internet, however, is that very few domains allow unrestricted transfers these days.
dig yourdomain.com AXFR How do I …
Get a short answer?
When all you want is a quick answer, the +short option is your friend:
Here’s a short answer followed by only an answer; the latter includes all the configuration information, including time-to-live (TTL) data, displayed in a format compatible with BIND configuration files.
$ dig +nocmd fsf.org mx +noall +answer
According to its man page, the +multiline option will give you an answer with “the SOA records in a verbose multi-line format with human-readable comments.” In general, the answers retrieved using the +multiline option will appear more like BIND config files than they will without it.
ogi.edu. 14267 IN A 18.104.22.168
ogi.edu. 14267 IN MX 5 cse.ogi.edu.
ogi.edu. 14267 IN MX 15 hermes.admin.ogi.edu.
ogi.edu. 14267 IN SOA zeal.admin.ogi.edu. hostmaster.admin.ogi.edu. (
14400; refresh (4 hours)
900; retry (15 minutes)
3600000; expire (5 weeks 6 days 16 hours)
14400; minimum (4 hours)
ogi.edu. 14267 IN NS zeal.admin.ogi.edu.
ogi.edu. 14267 IN NS cse.ogi.edu.
ogi.edu. 14267 IN NS fork.admin.ogi.edu.
Use the -x option to lookup the main hostname associated with an IP address.
$ dig -x 22.214.171.124 +short
Query a different nameserver?
Just specify it on the command line:
Use the search list in /etc/resolv.conf?
The host utility will automatically use the search list in your /etc/resolv.conf file.
$ host www
www.madboa.com has address 126.96.36.199
By default, however, dig doesn’t—which may produce some unexpected results. If you want to use local hostnames instead of fully qualified domain names, use the +search option.