Validate DNSSEC chain with RRSIG dig
Show RRSIG records; check AD flag in flags line for validated answer
dig +dnssec +multi example.com @1.1.1.1
more dig
all 11 commands →
Trace delegation without DNSSEC noise
dig +trace +nodnssec example.com
Compare answers from two resolvers
diff <(dig +short @1.1.1.1 example.com) <(dig +short @8.8.8.8 example.com)
Reverse PTR lookup for IPv6
dig -x 2606:4700:4700::1111 +short
Query TXT/SPF, DKIM and DMARC at once
for r in example.com _dmarc.example.com sel._domainkey.example.com; do dig +short TXT $r; done
Check CAA records before issuing certs
dig +short CAA example.com