Home

Using dig (DNS Lookup) on Linux

dig is the CLI you reach for when something's off with DNS — checking records, debugging resolvers, or just confirming what a domain points to. Here's a tour of the bits I actually use day-to-day.

Installing dig

First, check whether dig is installed and what version you're on:

bash
dig -v

Sample output:

bash
root@linuxpedi:~# dig -vDiG 9.16.1-Ubuntu

If it's missing, install it for your distro:

Ubuntu / Debian:

bash
apt install dnsutils

CentOS / Fedora:

bash
yum install bind-utils

Reading dig output

Once it's installed, the simplest invocation is just the domain:

bash
dig linuxpedi.com
bash
; <<>> DiG 9.16.1-Ubuntu <<>> linuxpedi.com;; global options: +cmd;; Got answer:;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 2684;; flags: qr rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 1;; OPT PSEUDOSECTION:; EDNS: version: 0, flags:; udp: 65494;; QUESTION SECTION:;linuxpedi.com.                 IN      A;; ANSWER SECTION:linuxpedi.com.          271     IN      A       34.141.144.143;; Query time: 0 msec;; SERVER: 127.0.0.53#53(127.0.0.53);; WHEN: Fri Sep 03 16:12:32 +03 2021;; MSG SIZE  rcvd: 58

Walking through the output section by section:

  1. The first line shows the dig version and the domain being queried. The second line shows the global options (just cmd by default).
bash
; <<>> DiG 9.16.1-Ubuntu <<>> linuxpedi.com;; global options: +cmd

If you don't want this in the output, add +nocmd — it has to be the first option after dig.

  1. The next block is the technical metadata about the response. The header shows the opcode (what dig did) and the status of that operation. In this case, the status is NOERROR, meaning the DNS query came back without issues.
bash
;; Got answer:;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 37159;; flags: qr rd ra; QUERY: 1, ANSWER: 2, AUTHORITY: 2, ADDITIONAL: 5

You can hide this with +nocomments.

  1. The QUESTION SECTION echoes the query you sent. By default dig asks for the A record.
bash
;; QUESTION SECTION:;linuxpedi.com.                 IN      A

+noquestion turns this off.

  1. The ANSWER SECTION is the actual response. Since we asked for the A record by default, that's what we get back. (An A record maps a domain to an IPv4 address.)
bash
;; ANSWER SECTION:linuxpedi.com.          271     IN      A       34.141.144.143

You almost never want to hide this, but +noanswer is there if you do.

  1. The last block is query stats:
bash
;; Query time: 0 msec;; SERVER: 127.0.0.53#53(127.0.0.53);; WHEN: Fri Sep 03 16:12:32 +03 2021;; MSG SIZE  rcvd: 58

Useful flags

+short — just the IP, nothing else. Great for scripting:

bash
root@linuxpedi:~# dig linuxpedi.com +short34.141.144.143

+noall +answer — keep just the ANSWER section, drop the rest:

bash
root@linuxpedi:~# dig linuxpedi.com +noall +answerlinuxpedi.com.          19      IN      A       34.141.144.143

@<server> — query a specific resolver instead of the system default. Handy for sanity-checking against Google DNS or Cloudflare:

bash
dig linuxpedi.com @8.8.8.8

Querying different record types

CNAME:

bash
dig +nocmd mail.google.com cname +noall +answer
bash
root@linuxpedi:~# dig +nocmd mail.google.com cname +noall +answermail.google.com.        21600   IN      CNAME   googlemail.l.google.com.

TXT:

bash
dig +nocmd linuxpedi.com txt +noall +answer
bash
root@linuxpedi:~# dig +nocmd linuxpedi.com txt +noall +answerlinuxpedi.com.          14400   IN      TXT     "v=spf1 redirect=_spf.yandex.net"linuxpedi.com.          14400   IN      TXT     "yandex-verification: 58dc73d576a09a54"linuxpedi.com.          14400   IN      TXT     "google-site-verification=uuG-tMzOMkBPCl4iWB38PqrCYBOyqwUmbFte1dQ7M8g"

MX (mail):

bash
dig +nocmd linuxpedi.com mx +noall +answer
bash
root@linuxpedi:~# dig +nocmd linuxpedi.com mx +noall +answerlinuxpedi.com.          14400   IN      MX      10 mx.yandex.net.

NS (nameserver):

bash
dig +nocmd linuxpedi.com ns +noall +answer
bash
root@linuxpedi:~# dig +nocmd linuxpedi.com ns +noall +answerlinuxpedi.com.          21600   IN      NS      ns1.dns-parking.com.linuxpedi.com.          21600   IN      NS      ns2.dns-parking.com.

All records at once with any:

bash
dig +nocmd sametkum.com any +noall +answer
bash
root@linuxpedi:~# dig +nocmd sametkum.com any +noall +answersametkum.com.           14400   IN      A       185.224.138.16sametkum.com.           21600   IN      NS      ns1.hostinger.web.tr.sametkum.com.           21600   IN      NS      ns2.hostinger.web.tr.sametkum.com.           21600   IN      NS      ns3.hostinger.web.tr.sametkum.com.           21600   IN      NS      ns4.hostinger.web.tr.sametkum.com.           21600   IN      SOA     ns1.hostinger.web.tr. dns.hostinger.com. 2019031200 28800 7200 604800 86400sametkum.com.           14400   IN      MX      10 mx1.hostinger.web.tr.sametkum.com.           900     IN      TXT     "google-site-verification=PxYATQZ-vM5fVP02aQ8VYPIBvnPjpGYRT8TUbVxWVj8"sametkum.com.           900     IN      TXT     "v=spf1 include:_spf.mail.hostinger.com ~all"sametkum.com.           14400   IN      AAAA    2a02:4780:8:263:0:1b50:5833:5sametkum.com.           14400   IN      CAA     0 issue "comodoca.com"sametkum.com.           14400   IN      CAA     0 issue "digicert.com"sametkum.com.           14400   IN      CAA     0 issue "globalsign.com"sametkum.com.           14400   IN      CAA     0 issue "letsencrypt.org"sametkum.com.           14400   IN      CAA     0 issue "sectigo.com"sametkum.com.           14400   IN      CAA     0 issuewild "comodoca.com"sametkum.com.           14400   IN      CAA     0 issuewild "digicert.com"sametkum.com.           14400   IN      CAA     0 issuewild "globalsign.com"sametkum.com.           14400   IN      CAA     0 issuewild "letsencrypt.org"sametkum.com.           14400   IN      CAA     0 issuewild "sectigo.com"