Validate DNSSEC chain with RRSIG

Show RRSIG records; check AD flag in flags line for validated answer

dig +dnssec +multi example.com @1.1.1.1

More dig commands

Trace delegation without DNSSEC noise

dig +trace +nodnssec example.com

Follow delegation from root to authoritative, hiding RRSIG/DS clutter
Compare answers from two resolvers

diff <(dig +short @1.1.1.1 example.com) <(dig +short @8.8.8.8 example.com)

Spot split-horizon or stale cache differences between resolvers
Reverse PTR lookup for IPv6

dig -x 2606:4700:4700::1111 +short

PTR for an IPv6 address; -x expands nibble format automatically
Query TXT/SPF, DKIM and DMARC at once

for r in example.com _dmarc.example.com sel._domainkey.example.com; do dig +short TXT $r; done

Pull SPF, DMARC and DKIM TXT records in one loop for mail audits
Check CAA records before issuing certs

dig +short CAA example.com

Show which CAs may issue certs; missing CAA lets any CA issue