Attempt a zone transfer (AXFR) dig
Dump full zone if AXFR is open; note: success on public NS is a misconfig
dig axfr @ns1.example.com example.com
more dig
all 11 commands →
Validate DNSSEC chain with RRSIG
dig +dnssec +multi example.com @1.1.1.1
Trace delegation without DNSSEC noise
dig +trace +nodnssec example.com
Compare answers from two resolvers
diff <(dig +short @1.1.1.1 example.com) <(dig +short @8.8.8.8 example.com)
Reverse PTR lookup for IPv6
dig -x 2606:4700:4700::1111 +short
Query TXT/SPF, DKIM and DMARC at once
for r in example.com _dmarc.example.com sel._domainkey.example.com; do dig +short TXT $r; done