dig (domain information groper) asks DNS servers questions and shows the answers in detail. It’s the standard tool for checking whether a domain points to your server, why email fails SPF, or whether a DNS change has propagated.

Install it if needed:

sudo apt install dnsutils        # Debian/Ubuntu (bind9-dnsutils on newer releases)
sudo dnf install bind-utils      # RHEL family

Basic lookup

dig example.com

The important parts of the output:

;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 4242
;; flags: qr rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 1

;; ANSWER SECTION:
example.com.        3600    IN    A    93.184.215.14

;; Query time: 23 msec
;; SERVER: 127.0.0.53#53(127.0.0.53) (UDP)
  • status — NOERROR (fine), NXDOMAIN (name doesn’t exist), SERVFAIL (resolver failed — often DNSSEC or broken nameservers), REFUSED.
  • ANSWER — the records, with TTL (seconds remaining in cache) and type.
  • SERVER — which resolver answered.

Short answers

dig +short example.com
dig +short www.example.com

Perfect for scripts and quick checks.

Record types

dig example.com A          # IPv4
dig example.com AAAA       # IPv6
dig example.com MX         # mail servers
dig example.com TXT        # SPF, DKIM, verification records
dig example.com NS         # authoritative nameservers
dig example.com CNAME
dig example.com SOA        # zone info: primary NS, serial, timers
dig example.com CAA        # which CAs may issue certificates
dig _dmarc.example.com TXT
dig selector1._domainkey.example.com TXT   # DKIM key for a selector

dig example.com ANY is unreliable — many servers return minimal answers to ANY queries. Ask for specific types.

See DNS records explained for what each type does.

Ask a specific server

dig @1.1.1.1 example.com          # a public resolver
dig @8.8.8.8 example.com
dig @ns1.example-dns.com example.com   # the authoritative nameserver directly

Querying the authoritative nameserver shows what your DNS provider is serving right now, bypassing every cache. If it’s correct there but wrong elsewhere, you’re waiting on TTLs — see DNS propagation.

Find the authoritative servers first:

dig +short NS example.com

Trace the delegation

dig +trace example.com

dig starts at the root servers and follows the delegation through .com to your domain’s nameservers, showing each step. This exposes problems like a registrar pointing to old nameservers or a missing delegation.

Reverse DNS (PTR)

dig -x 203.0.113.10
dig +short -x 203.0.113.10

Mail servers check that your sending IP has a PTR record matching your hostname. See PTR records and reverse DNS.

Cleaner output

dig +noall +answer example.com           # only the answer section
dig +noall +answer +ttlunits example.com # human-readable TTLs
dig +short +identify example.com         # which server answered

Put favourites in ~/.digrc, e.g. +noall +answer.

TCP, IPv4/IPv6 and timeouts

dig +tcp example.com
dig -4 example.com
dig +time=2 +tries=1 @203.0.113.53 example.com

DNSSEC

dig +dnssec example.com
dig example.com DS +short
dig +cd example.com          # "checking disabled": bypass validation

If a query returns SERVFAIL normally but works with +cd, DNSSEC validation is failing — usually a stale DS record at the registrar after changing DNS providers. See DNSSEC.

Batch queries

for host in example.com www.example.com mail.example.com; do
  printf "%-22s %s\n" "$host" "$(dig +short "$host" A | tr '\n' ' ')"
done

Common troubleshooting scenarios

“My domain doesn’t point to the new server yet”

dig +short example.com @ns1.your-dns-provider.com   # authoritative answer
dig +short example.com @1.1.1.1                     # a public resolver's cached answer
dig example.com | grep -A1 "ANSWER SECTION"         # TTL remaining

“Emails go to spam” — check SPF, DKIM, DMARC and PTR:

dig +short TXT example.com | grep spf
dig +short TXT default._domainkey.example.com
dig +short TXT _dmarc.example.com
dig +short -x 203.0.113.10

See SPF, DKIM and DMARC.

“Let’s Encrypt says NXDOMAIN” — the record doesn’t exist at the authoritative server yet, or there’s a typo. Check with @ the authoritative server.

dig vs nslookup vs host

  • dig — most detailed, best for troubleshooting.
  • nslookup — available on Windows too; simpler output.
  • host — very short output: host example.com.

Related: change DNS servers on Linux.

  • DNS
  • dig
  • Networking