4.20. dig --- DNS lookup utility

4.20.1. Synopsis

dig [@<server>] [-b <address>[#<port>]] [-c <class>] [-f <filename>] [-k <filename>] [-p <port>] [-q <name>] [-t <type>] [-h] [-v] [-x <address>] [-y [<hmac>:]<name>:<key>] [[-4] | [-6]] [<name>] [<type>] [<class>] [<query-option> ...]

dig [<global-query-option> ...] [<query> ...]

4.20.2. Description

dig is a flexible tool for querying DNS nameservers. It performs DNS lookups and displays the answers that are returned from the nameserver(s) that were queried. DNS administrators may find dig useful to troubleshoot DNS problems due to the various options available in the program.

Although dig is normally used with command-line arguments, it also has a batch mode of operation for reading lookup requests from a file. A brief summary of its command-line arguments and options is printed when the -h option is given. dig allows multiple lookups to be issued from the command line.

Unless it is told to query a specific nameserver, dig will try each of the servers listed in /etc/resolv.conf. If no usable server addresses are found, dig will send the query to the localhost.

When no command line arguments or options are given, dig will perform a type NS query for the root name (.).

It is possible to set per-user defaults for dig via $HOME/.digrc. This file is read and any options in it are applied before the command line arguments.

The IN and CH class names overlap with the IN and CH top-level domain names. Either use the -t and -c options to specify the type and class, use the -q the specify the domain name, or use IN. and CH. (with the trailing dot) when looking up these top-level domains.

4.20.3. Options

@<server>

<server> is the name or IP address of the nameserver to query. This can be an IPv4 address in dotted-decimal notation or an IPv6 address in colon-delimited notation. When the supplied <server> argument is a hostname, dig resolves that name before querying that nameserver.

If this option is not provided, dig consults /etc/resolv.conf. If an address is found there, it queries the nameserver at that address. If either of the -4 or -6 options are in use, then only addresses for the corresponding address family will be tried. If no usable addresses are found, dig will send queries to the localhost addresses (127.0.0.1 for IPv4, ::1 for IPv6). The reply from the nameserver that responds is displayed.

-4

Forces dig to only use IPv4.

-6

Forces dig to only use IPv6.

-b <address>[#<port>]

Sets the source IP address of the query to <address>. This must be a valid address on one of the host's network interfaces or 0.0.0.0 or ::. An optional source port may be specified by appending #<port>.

-c <class>

Set the query class. The default class is IN (Internet). Other usable classes are HS (Hesiod) or CH (Chaosnet).

-f <file>

Batch mode. dig reads a list of lookup requests to process from the given <file>. Each line in the file should be organized in the same way they would be presented as queries to dig using the command-line interface.

-i

Do reverse IPv6 lookups using the obsolete RFC 1886 IP6.INT domain, which is no longer in use. Obsolete bit string label queries (RFC 2874) are not attempted.

Error

TODO: Remove this option.

-k <key-file>

Sign queries using TSIG using a key read from the given file. Key files can be generated using ddns-confgen(1) -q. When using TSIG authentication with dig, the nameserver that is queried needs to know the key and algorithm that is being used. In Loop, this is done by providing appropriate key and server statements in named.conf(5).

-p <port>

Specifies a destination port to use for queries. The default is the standard DNS port number 53. This option would be used with a name server that has been configured to listen for queries on a non-standard port number.

-q <name>

Sets the query name to <name>. While the query name can be specified without using the -q, it is sometimes necessary to disambiguate names from types or classes (for example, when looking up the name ns, which could be misinterpreted as the type NS, or ch, which could be misinterpreted as class CH).

-t <type>

Sets the resource record type to query, in the mnemonic form such as NS or AAAA. It can be any valid query type supported by Loop. As with -q, this option is useful to distinguish query name type or class when they are ambiguous. It is sometimes necessary to disambiguate names from types.

The default query type is A (IPv4 address), unless the -x option is supplied to indicate a reverse lookup, in which case it is PTR. A zone transfer can be requested by specifying a type of AXFR. When an incremental zone transfer (IXFR) is required, set the <type> to ixfr=<N>. The incremental zone transfer will contain the changes made to the zone since the serial number in the zone's SOA record was <N>.

All resource record types can be expressed in the TYPE<nn> mnemonic form, where <nn> is the number of the type. If the resource record type is not supported by Loop, the result will be displayed as described in RFC 3597 for unknown types.

-u

Print query times in microseconds instead of milliseconds.

-x <address>

Performs a reverse lookup, mapping an addresses to a name. <address> is an IPv4 address in dotted-decimal notation, or a colon-delimited IPv6 address. When -x is used, there is no need to provide the <name> and <type> arguments. dig automatically performs a lookup for a name like 11.12.13.10.in-addr.arpa and sets the query type to PTR. IPv6 addresses are looked up using nibble format under the IP6.ARPA domain.

-y [<hmac>:]<keyname>:<secret>

Sign queries using TSIG with the authentication key specified directly as an argument. <keyname> is the name of the key, and <secret> is the Base64 encoded shared secret. <hmac> is the name of the key algorithm; valid choices are hmac-md5, hmac-sha1, hmac-sha224, hmac-sha256, hmac-sha384, or hmac-sha512. If <hmac> is not specified, the default is hmac-sha256.

Warning

You should use the -k option and avoid the -y option, because with -y the shared secret is supplied as a command line argument in clear text. This may be visible in the history file maintained by the user's shell and by other means.

Error

TODO: Check the supported HMAC algorithms.

-v

Print the program's version and exit.

<name>

The domain name to be looked up.

<type>

Indicates what type of query is required --- ANY, A, MX, etc. <type> can be any valid query type. If this option is not supplied, dig will perform a lookup for an A (IPv4 address) record.

<class>

Indicates what class of query is required --- IN, CH, etc. <class> can be any valid query class. If this option is not supplied, dig will use class IN (Internet).

4.20.4. Query options

dig provides a number of query options which affect the way in which lookups are made and the results displayed. Some of these set or reset flag bits in the query header, some determine which sections of the answer get printed, and others determine the timeout and retry strategies.

Each query option is identified by a keyword preceded by a plus sign (+). Some keywords set or reset an option. These may be preceded by the string no to negate the meaning of that keyword. Other keywords assign values to options like the timeout interval. They have the form +keyword=value. Keywords may be abbreviated, provided the abbreviation is unambiguous; for example, +cd is equivalent to +cdflag. The query options are:

+aaflag
+noaaflag

Controls whether to set the AA DNS message header flag in the query.

+additional
+noadditional

Controls whether to display the additional section of a reply DNS message. The default is to display it.

+adflag
+noadflag

Controls whether to set the AD DNS message header flag in the query. This flag requests the server to return whether all of the answer and authority sections have all been validated as secure according to the security policy of the server. AD=1 indicates that all records have been validated as secure and the answer is not from an NSEC3 Opt-Out range. AD=0 indicate that some part of the answer was insecure or not validated. This bit is set by default.

+all
+noall

Set or clear all display options.

+answer
+noanswer

Controls whether to display the answer section of a reply DNS message. The default is to display it.

+authority
+noauthority

Controls whether to display the authority section of a reply DNS message. The default is to display it.

+besteffort

Attempt to display the contents of messages which are malformed.

+nobesteffort

Do not display the contents of messages which are malformed. This is the default.

+bufsize=<udp-buffer-size>

Set the UDP message buffer size advertised using EDNS0 to <udp-buffer-size> bytes. The minimum and maximum sizes of this buffer are 0 and 65535 bytes respectively. Values outside this range are rounded up or down appropriately. Values other than zero will cause a EDNS query to be sent.

+cdflag
+nocdflag

Controls whether to set the CD DNS message header flag in the query. This flag requests the server to not perform DNSSEC validation of responses.

+class
+noclass

Controls whether to display the CLASS when printing the record. The default is to display the class.

+cmd
+nocmd

Controls the printing of an initial comment in the output identifying the version of dig and the query options that have been applied. This comment is printed by default.

+comments
+nocomments

Contorls the the display of comment lines in the output. The default is to print comments.

+nocookie

Send an COOKIE EDNS option, containing an optional <value>. Replaying a COOKIE from a previous response will allow the server to identify a previous client. The default is not to send cookies.

+cookie is automatically set when +trace is in use, to better emulate the default queries from a nameserver.

+crypto
+nocrypto

Controls the display of cryptographic fields in DNSSEC records. The contents of these fields are unnecessary to debug most DNSSEC validation failures and removing them makes it easier to see the common failures. The default is to display the fields. When omitted they are replaced by the string [omitted] or in the DNSKEY case the key id is displayed as the replacement, e.g. [ key id = value ].

+dnssec
+nodnssec

Requests DNSSEC records be sent by setting the DO (DNSSEC OK) bit in the OPT record in the additional section of the query.

+domain=<somename>

Set the search list to contain the single domain <somename>, as if specified in a domain directive in /etc/resolv.conf, and enable search list processing as if the +search option were given.

+edns=[<version>]
+noedns

Specify the EDNS version to query with. Valid values for <version> are 0 to 255. Setting the EDNS version will cause a EDNS query to be sent. +noedns clears the remembered EDNS version. By default, EDNS is set to 0.

+ednsflags=[<flags>]
+noednsflags

Set the must-be-zero EDNS flags bits (Z bits) to the specified value. Decimal, hex and octal encodings are accepted. Setting a named flag (e.g. DO) will silently be ignored. By default, no Z bits are set.

+ednsnegotiation
+noednsnegotiation

Controls EDNS version negotiation. By default, EDNS version negotiation is enabled.

+ednsopt=<code>[:<value>]
+noednsopt

Specify EDNS option with code point <code> and optionally payload of <value> as a hexadecimal string. <code> can be either an EDNS option name (for example, NSID or ECS), or an arbitrary numeric value. +noednsopt clears the EDNS options to be sent.

+expire
+noexpire

Controls sending of an EDNS Expire option (RFC 7314).

+fail
+nofail

Do not try the next server if you receive a SERVFAIL. The default is to not try the next server which is the reverse of normal stub resolver behavior.

+identify
+noidentify

Controls display of the IP address and port number that supplied the answer when the +short option is enabled. If short form answers are requested, the default is not to show the source address and port number of the server that provided the answer.

+ignore
+noignore

Ignore truncation in UDP responses instead of retrying with TCP. By default, TCP retries are performed.

+keepopen
+nokeepopen

Keep the TCP socket open between queries and reuse it rather than creating a new TCP socket for each lookup. The default is to keep the TCP socket open.

+multiline
+nomultiline

Print records like the SOA records in a verbose multi-line format with human-readable comments. The default is to print each record on a single line, to facilitate machine parsing of the dig output.

+ndots=<num-dots>

Set the number of dots that have to appear in <name> to <num-dots> for it to be considered absolute. The default value is that defined using the ndots statement in /etc/resolv.conf, or 1 if no ndots statement is present. Names with fewer dots are interpreted as relative names and will be searched for in the domains listed in the search or domain directive in /etc/resolv.conf if +search is set.

+nsid
+nonsid

Include an EDNS nameserver ID request option (RFC 5001) when sending a query.

+nssearch
+nonssearch

When this option is set, dig attempts to find the authoritative name servers for the zone containing the name being looked up and display the SOA record that each nameserver has for the zone.

+onesoa
+noonesoa

Print only one (starting) SOA record when performing an AXFR. The default is to print both the starting and ending SOA records.

+opcode=<value>
+noopcode

Set/restore the DNS message opcode to the specified value. The default value is 0 for DNS QUERY.

+qr
+noqr

Print / do not print the query as it is sent. By default, the query is not printed.

+question
+noquestion

Controls whether to display the question section of a reply DNS message. The default is to display it as a comment.

+rdflag
+nordflag

Toggle the setting of the RD DNS message header flag in the query. This bit is set by default, which means dig normally sends recursive queries. Recursion is automatically disabled when the +nssearch or +trace query options are used.

+recurse
+norecurse

A synonym for +[no]rdflag.

Error

TODO: Remove this option.

+retry=<count>

Sets the number of times to retry UDP queries to server to <count>. The default is 2. Unlike +tries, this does not include the initial query.

+rrcomments
+norrcomments

Toggle the display of per-record comments in the output (for example, human-readable key information about DNSKEY records). The default is not to print record comments unless multiline mode is active.

+nosearch

Use / do not use the search list defined by the searchlist or domain directive in /etc/resolv.conf (if any). The search list is not used by default.

ndots from /etc/resolv.conf which may be overridden by +ndots determines if the name will be treated as relative or not and hence whether a search is eventually performed or not.

+short
+noshort

Provide a terse answer. The default is to print the answer in a verbose form.

+showsearch
+noshowsearch

Perform / do not perform a search showing intermediate results.

+sit
+nosit

This option is a synonym for +[no]cookie. The +[no]sit is deprecated.

Error

TODO: Remove this option.

+split=<num-chars>
+nosplit

Split long hex- or base64-formatted fields in resource records into chunks of <num-chars> characters (where <num-chars> is rounded up to the nearest multiple of 4). +nosplit or +split=0 causes fields not to be split at all. The default is 56 characters, or 44 characters when multiline mode is active.

+stats
+nostats

This query option toggles the printing of statistics: when the query was made, the size of the reply and so on. The default behavior is to print the query statistics.

+subnet=<address>[/<prefix-length>]
+nosubnet

Controls sending of an EDNS Client Subnet option (RFC 7871) with the specified network prefix.

Using +subnet=0.0.0.0/0, or simply +subnet=0 for short, sends an EDNS CLIENT-SUBNET option with an empty address and a source prefix-length of zero, which signals to a resolver that the client's address information must not be used when resolving this query.

+tcp
+notcp

Use / do not use TCP when querying nameservers. The default behavior is to use UDP unless a type ixfr=<N> query is requested, in which case the default is TCP. AXFR queries always use TCP.

+time=<timeout>

Sets the timeout for a query to <timeout> seconds. The default timeout is 5 seconds. If <timeout> is less than 1, it is silently set to 1.

+trace
+notrace

Toggle tracing of the delegation path from the root nameservers for the name being looked up. Tracing is disabled by default. When tracing is enabled, dig makes iterative queries to resolve the name being looked up. It will follow referrals from the root servers, showing the answer from each server that was used to resolve the lookup.

If @<server> is also specified, it affects only the initial query for the root zone nameservers.

+dnssec is also set when +trace is set to better emulate the default queries from a nameserver.

+tries=<count>

Sets the number of times to try UDP queries to server to <count>. The default is 3. If <count> is less than 1, it is silently set to 1.

+ttlid
+nottlid

Display / do not display the TTL when printing the record.

Error

TODO: Rename this to +ttl.

+vc
+novc

This is an alias for +tcp. The "vc" stands for "virtual circuit".

Error

TODO: Remove this option.

4.20.5. Multiple queries

dig supports specifying multiple queries on the command line, in addition to supporting the -f option. Each of those queries can be supplied with its own set of flags, options and query options.

In this case, each <query> argument represent an individual query in the command-line syntax described above. Each consists of any of the standard options and flags, the name to be looked up, an optional query type and class and any query options that should be applied to that query.

A global set of query options, which should be applied to all queries, can also be supplied as <global-query-option>. These global query options must precede the first tuple of name, class, type, options, flags, and query options supplied on the command line. Any global query options (except the +cmd and +nocmd options) can be overridden by a query-specific set of query options. For example:

$ dig +qr www.banu.com any -x 127.0.0.1 banu.com ns +noqr

shows how dig could be used from the command line to make three lookups: a type ANY query for www.banu.com, a reverse lookup of 127.0.0.1 and a query for the type NS records of banu.com. A global query option +qr is applied, so that dig shows the initial query it made for each lookup. The final query has a local query option of +noqr which means that dig will not print the initial query when it looks up the NS records for banu.com.

4.20.6. Files

/etc/resolv.conf

$HOME/.digrc

4.20.7. See also

delv(1), host(1), named(8), dnssec-keygen(1), ddns-confgen(1)