dig

Clean answer-only output Strip headers/stats; show only the answer section for scripting/diffs dig +noall +answer example.com #dig#dns#troubleshooting Find authoritative nameservers via NS chase Query each authoritative NS directly; reveals SOA serial mismatches between them dig +nssearch example.com #dig#dns#troubleshooting Attempt a zone transfer (AXFR) Dump full zone if AXFR is open; note: success on public NS is a misconfig dig axfr @ns1.example.com example.com #dig#dns#security Validate DNSSEC chain with RRSIG Show RRSIG records; check AD flag in flags line for validated answer dig +dnssec +multi example.com @1.1.1.1 #dig#dns#dnssec#security Trace delegation without DNSSEC noise Follow delegation from root to authoritative, hiding RRSIG/DS clutter dig +trace +nodnssec example.com #dig#dns#troubleshooting Compare answers from two resolvers Spot split-horizon or stale cache differences between resolvers diff <(dig +short @1.1.1.1 example.com) <(dig +short @8.8.8.8 example.com) #dig#dns#troubleshooting#debug Reverse PTR lookup for IPv6 PTR for an IPv6 address; -x expands nibble format automatically dig -x 2606:4700:4700::1111 +short #dig#dns#network Query TXT/SPF, DKIM and DMARC at once Pull SPF, DMARC and DKIM TXT records in one loop for mail audits for r in example.com _dmarc.example.com sel._domainkey.example.com; do dig +short TXT $r; done #dig#dns#security Check CAA records before issuing certs Show which CAs may issue certs; missing CAA lets any CA issue dig +short CAA example.com #dig#dns#tls#security Resolve SRV records for service discovery Get priority/weight/port/target for a service; used by AD, SIP, XMPP dig +short SRV _sip._tcp.example.com #dig#dns#network Force TCP and show remaining TTL Test TCP/53 reachability; +ttlunits prints TTL as 1h/30m not raw seconds dig +tcp +ttlunits +noall +answer example.com @8.8.8.8 #dig#dns#network#troubleshooting