A · MX · CNAME · TXT · NS · PTR · DNSSEC
01 — How DNS & dig Work
When you type a domain into a browser, your OS asks a DNS resolver to turn it into an IP address. dig lets you do that same query manually, choose which DNS server to ask, and inspect every detail of the response.
dig sends a DNS query, waits for the answer, and prints the raw response — including flags, TTL, record data, and query timing.
dig is part of the BIND utilities. It ships with most Linux distributions and macOS. On Windows, it can be installed via BIND tools or used through WSL. The equivalent built-in Windows tool is nslookup.
02 — Basic Usage
Simple A record lookup
dig google.com
Annotated output
; <<>> DiG 9.18.1 <<>> google.com
;; QUESTION SECTION:
;google.com. IN A
;; ANSWER SECTION:
google.com. 112 IN A 142.250.185.46
;; Query time: 14 msec
;; SERVER: 8.8.8.8#53(8.8.8.8)
;; WHEN: Fri Mar 13 10:00:00 2026
;; MSG SIZE rcvd: 55
| Section | What it contains |
|---|---|
| QUESTION | The query that was sent — domain, class (IN = Internet), type (A) |
| ANSWER | The records returned — name, TTL in seconds, class, type, value |
| AUTHORITY | The nameservers authoritative for the domain (when present) |
| ADDITIONAL | Extra records the server included (e.g. glue records) |
| Query time | How long the query took in milliseconds |
| SERVER | Which DNS server answered the query |
03 — Record Types
| Type | What it holds | Example query |
|---|---|---|
| A | IPv4 address | dig google.com A |
| AAAA | IPv6 address | dig google.com AAAA |
| MX | Mail exchange servers with priority | dig google.com MX |
| CNAME | Canonical name — alias to another domain | dig www.github.com CNAME |
| TXT | Free-text records — SPF, DKIM, verification tokens | dig google.com TXT |
| NS | Authoritative nameservers for the domain | dig google.com NS |
| SOA | Start of Authority — zone serial, refresh, TTLs | dig google.com SOA |
| PTR | Reverse DNS — IP address to hostname | dig -x 8.8.8.8 |
| ANY | All available records (often restricted) | dig google.com ANY |
ℹ Many resolvers now restrict ANY queries and return a minimal response. Query specific record types for reliable results.
04 — Common Flags
| Flag | Description | Example |
|---|---|---|
| @<server> | Query a specific DNS server | dig @8.8.8.8 google.com |
| -t <type> | Record type to query | dig -t MX google.com |
| -x <ip> | Reverse lookup (PTR) | dig -x 1.1.1.1 |
| +short | Print only the answer value | dig google.com +short |
| +noall +answer | Show only the ANSWER section | dig google.com +noall +answer |
| +trace | Trace full delegation from root servers | dig google.com +trace |
| +dnssec | Request DNSSEC records | dig google.com +dnssec |
| +tcp | Use TCP instead of UDP | dig google.com +tcp |
| +time=<n> | Query timeout in seconds | dig google.com +time=2 |
| -4 / -6 | Force IPv4 or IPv6 transport | dig -6 google.com |
05 — Practical Examples
Quick IP lookup
dig google.com +short
Query a specific DNS server
dig @1.1.1.1 cloudflare.com A
Check mail records
dig gmail.com MX +noall +answer
Reverse DNS lookup
dig -x 8.8.8.8 +short
Check SPF / DKIM / DMARC records
# SPF
dig google.com TXT +short
# DKIM (replace selector as needed)
dig google._domainkey.google.com TXT +short
# DMARC
dig _dmarc.google.com TXT +short
Trace full DNS delegation from root
dig google.com +trace
All nameservers for a domain
dig google.com NS +short
Test over TCP (large responses / DNSSEC)
dig google.com +dnssec +tcp
ℹ +short is your best friend for scripting — it strips all headers and prints only the answer value, one per line.
06 — Troubleshooting with dig
| Problem | dig command to run | What to check |
|---|---|---|
| Domain not resolving | dig google.com @8.8.8.8 | If this works but your default resolver fails, the issue is your local DNS server |
| Wrong IP returned | dig google.com +trace | Follow the delegation — a rogue NS or stale cache may be intercepting |
| Email delivery issues | dig domain.com MX dig domain.com TXT | Verify MX records point to the right server and SPF/DKIM are correct |
| Slow DNS response | dig google.com +stats | Check Query time — above 100 ms points to a slow or overloaded resolver |
| NXDOMAIN (no such domain) | dig domain.com SOA | Confirm the domain exists — if SOA returns nothing the domain may not be registered or delegated |
| Stale cached record | dig domain.com +short | Check the TTL in the ANSWER section — low TTL means propagation is fast, high TTL means a change may take hours |
⚠ dig queries your system's configured resolver by default. Always test with @8.8.8.8 or @1.1.1.1 in parallel to distinguish between a local DNS problem and a global one.