DIG
Authorized use only. Offensive reference for systems you own or are explicitly permitted to test. You are responsible for staying within the law.
BASIC USAGE#
dig domain.com # Query A record dig domain.com ANY # Query all records dig domain.com MX # Query MX records dig domain.com NS # Query NS records dig domain.com TXT # Query TXT records dig domain.com AAAA # Query IPv6 address dig domain.com CNAME # Query CNAME record dig domain.com SOA # Query SOA record dig domain.com PTR # Query PTR record
SPECIFYING DNS SERVER#
dig @8.8.8.8 domain.com # Use Google DNS dig @1.1.1.1 domain.com # Use Cloudflare DNS dig @ns1.example.com domain.com # Use specific nameserver
RECORD TYPES#
A # IPv4 address AAAA # IPv6 address MX # Mail exchange NS # Name server TXT # Text record CNAME # Canonical name (alias) SOA # Start of authority PTR # Pointer (reverse DNS) SRV # Service record CAA # Certificate authority DNSKEY # DNSSEC public key DS # Delegation signer ANY # All records
OUTPUT OPTIONS#
dig +short domain.com # Short answer only dig +noall +answer domain.com # Answer section only dig +noall +answer +additional domain.com # With additional dig +trace domain.com # Trace delegation path dig +nssearch domain.com # Query all authoritative NS dig +multiline domain.com SOA # Multi-line format dig +nocmd domain.com # No command line shown dig +nocomments domain.com # No comment lines dig +nostats domain.com # No statistics dig +noall +stats domain.com # Only statistics
QUERY OPTIONS#
+tcp # Use TCP instead of UDP +ignore # Ignore truncation +time=5 # Set timeout (seconds) +tries=3 # Number of retries +bufsize=4096 # Set UDP buffer size +ndots=5 # Set ndots value +search # Use search list +nosearch # Don't use search list +recurse # Request recursion (default) +norecurse # No recursion +dnssec # Request DNSSEC records +cd # Disable DNSSEC checking +edns=0 # Set EDNS version +noedns # Disable EDNS
REVERSE DNS LOOKUP#
dig -x 8.8.8.8 # Reverse lookup dig -x 2001:4860:4860::8888 # IPv6 reverse lookup
BATCH MODE#
dig -f queries.txt # Read queries from file dig -f queries.txt +short # Batch with short output # queries.txt format: domain1.com A domain2.com MX domain3.com NS
PRACTICAL EXAMPLES#
# Get just the IP address dig +short domain.com # Get MX records with priority dig +short domain.com MX # Get nameservers dig +short domain.com NS # Get all TXT records (SPF, DKIM, etc.) dig +short domain.com TXT # Full DNS trace dig +trace domain.com # Check DNSSEC dig +dnssec domain.com # Query specific record from authoritative NS dig @$(dig +short domain.com NS | head -1) domain.com # Check if domain exists dig +short domain.com | head -1 # Get TTL values dig domain.com | grep -A1 "ANSWER SECTION" # Check all authoritative nameservers dig +nssearch domain.com
ZONE TRANSFER (AXFR)#
dig @ns1.domain.com domain.com AXFR # Request zone transfer dig @ns1.domain.com domain.com IXFR=serial # Incremental transfer
OUTPUT SECTIONS#
# HEADER ;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 12345 ;; flags: qr rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 1 # QUESTION SECTION ;domain.com. IN A # ANSWER SECTION domain.com. 300 IN A 93.184.216.34 # AUTHORITY SECTION (nameservers) domain.com. 86400 IN NS ns1.domain.com. # ADDITIONAL SECTION (glue records) ns1.domain.com. 86400 IN A 192.0.2.1 # Response status codes NOERROR # Success NXDOMAIN # Domain doesn't exist SERVFAIL # Server failure REFUSED # Query refused FORMERR # Format error
DNSSEC VERIFICATION#
dig +dnssec domain.com # Request DNSSEC dig +dnssec +multiline domain.com DNSKEY # Get DNSKEY records dig +dnssec domain.com DS # Get DS records delv domain.com # DNSSEC validation tool delv @8.8.8.8 domain.com +rtrace # Trace DNSSEC chain
USEFUL FLAGS#
+qr # Print query +ttlid # Show TTL as ID +ttlunits # Human-readable TTL +split=48 # Split long values +onesoa # One SOA in AXFR +identify # Show server identity +subnet=192.0.2.0/24 # ECS (EDNS Client Subnet)
COMMON DNS SERVERS#
# Public DNS 8.8.8.8, 8.8.4.4 # Google 1.1.1.1, 1.0.0.1 # Cloudflare 9.9.9.9, 149.112.112.112 # Quad9 208.67.222.222, 208.67.220.220 # OpenDNS 94.140.14.14, 94.140.15.15 # AdGuard
SCRIPTING EXAMPLES#
# Check multiple domains
for domain in google.com amazon.com github.com; do
echo "=== $domain ==="
dig +short $domain
done
# Monitor DNS propagation
watch -n 5 "dig +short domain.com @8.8.8.8"
# Compare responses from different servers
for ns in 8.8.8.8 1.1.1.1 9.9.9.9; do
echo "=== $ns ==="
dig +short @$ns domain.com
done
# Extract all records
dig domain.com ANY +noall +answer
# Get DNS response time
dig domain.com | grep "Query time"
ALTERNATIVE TOOLS#
host domain.com # Simple lookup nslookup domain.com # Interactive lookup drill domain.com # DNSSEC-aware lookup delv domain.com # DNSSEC validation whois domain.com # Domain registration info