← All cheat sheets

🌶 DNSTRACER

Authorized use only. Offensive reference for systems you own or are explicitly permitted to test. You are responsible for staying within the law.

dnstracer traces a chain of DNS servers to the source. It determines
where a given DNS server gets its information from, useful for
understanding DNS delegation and troubleshooting DNS issues.

dnstracer <domain>               # Trace DNS resolution chain
dnstracer -s . <domain>          # Start from root servers
dnstracer -s <ns> <domain>       # Start from specific nameserver

dnstracer -q A <domain>          # Query A records (default)
dnstracer -q AAAA <domain>       # Query AAAA (IPv6) records
dnstracer -q MX <domain>         # Query MX records
dnstracer -q NS <domain>         # Query NS records
dnstracer -q SOA <domain>        # Query SOA records
dnstracer -q CNAME <domain>      # Query CNAME records
dnstracer -q TXT <domain>        # Query TXT records

dnstracer -r 1 <domain>          # Set retries (default: 3)
dnstracer -t 5 <domain>          # Set timeout in seconds
dnstracer -o <domain>            # Enable overview of received answers
dnstracer -c <domain>            # Disable local caching
dnstracer -C <domain>            # Enable negative caching

dnstracer -s . <domain>          # Start from root DNS servers
dnstracer -s 8.8.8.8 <domain>   # Start from Google DNS
dnstracer -s ns1.example.com <domain>
                                 # Start from specific server

dnstracer -v <domain>            # Verbose output
dnstracer -4 <domain>            # Use IPv4 only
dnstracer -S <source_ip> <domain>
                                 # Use specific source IP

# Trace full DNS path from root servers
dnstracer -s . example.com

# Trace MX record resolution
dnstracer -q MX -s . example.com

# Verbose trace with overview
dnstracer -v -o -s . example.com

# Trace from specific nameserver
dnstracer -s 8.8.8.8 subdomain.example.com

# Quick trace with reduced retries
dnstracer -r 1 -t 2 example.com

# Each line shows:
# - The DNS server queried
# - The response received
# - Whether the answer is authoritative (AA flag)
# - Delegation chain to next server

# Key indicators:
# "Got authoritative answer" = final authoritative server
# "Received delegation" = server delegated to another
# "Timeout" = server did not respond

- Useful for debugging DNS delegation issues
- Shows the complete chain from root to authoritative server
- Can reveal DNS misconfigurations and slow servers
- Root servers queried when starting with -s .
- No modification to DNS records, read-only operation