dig commands

11 commands, each with a one-line explanation. Click a command to copy it, or its title for details.

Commands 11 shown

  • Clean answer-only output
    dig +noall +answer example.com

    Strip headers/stats; show only the answer section for scripting/diffs

    dns · troubleshooting

  • Find authoritative nameservers via NS chase
    dig +nssearch example.com

    Query each authoritative NS directly; reveals SOA serial mismatches between them

    dns · troubleshooting

  • Attempt a zone transfer (AXFR)
    dig axfr @ns1.example.com example.com

    Dump full zone if AXFR is open; note: success on public NS is a misconfig

    dns · security

  • Validate DNSSEC chain with RRSIG
    dig +dnssec +multi example.com @1.1.1.1

    Show RRSIG records; check AD flag in flags line for validated answer

    dns · dnssec · security

  • Trace delegation without DNSSEC noise
    dig +trace +nodnssec example.com

    Follow delegation from root to authoritative, hiding RRSIG/DS clutter

    dns · troubleshooting

  • Compare answers from two resolvers
    diff <(dig +short @1.1.1.1 example.com) <(dig +short @8.8.8.8 example.com)

    Spot split-horizon or stale cache differences between resolvers

    dns · troubleshooting · debug

  • Reverse PTR lookup for IPv6
    dig -x 2606:4700:4700::1111 +short

    PTR for an IPv6 address; -x expands nibble format automatically

    dns · network

  • Query TXT/SPF, DKIM and DMARC at once
    for r in example.com _dmarc.example.com sel._domainkey.example.com; do dig +short TXT $r; done

    Pull SPF, DMARC and DKIM TXT records in one loop for mail audits

    dns · security

  • Check CAA records before issuing certs
    dig +short CAA example.com

    Show which CAs may issue certs; missing CAA lets any CA issue

    dns · tls · security

  • Resolve SRV records for service discovery
    dig +short SRV _sip._tcp.example.com

    Get priority/weight/port/target for a service; used by AD, SIP, XMPP

    dns · network

  • Force TCP and show remaining TTL
    dig +tcp +ttlunits +noall +answer example.com @8.8.8.8

    Test TCP/53 reachability; +ttlunits prints TTL as 1h/30m not raw seconds

    dns · network · troubleshooting