dig cheat sheet: DNS lookups from the command line

updated 2026-10-20

tool: dig / nslookup
versions: BIND 9
os: linux, macos, windows

dig NAME asks the system's DNS resolver for the A record of NAME and prints the full response; dig +short NAME prints only the answer. Add a record type (dig NAME MX), a server (dig @1.1.1.1 NAME) or +trace to follow the delegation from the root servers. dig is part of BIND 9 (package dnsutils or bind-utils on Linux).

Basic lookups

Command	What it does
dig example.com	A record, full output (question, answer, authority, statistics)
dig +short example.com	Only the answer values
dig example.com AAAA	IPv6 address
dig example.com MX	Mail servers
dig example.com TXT	TXT records (SPF, domain verification)
dig example.com NS	Name servers of the zone
dig example.com SOA	Start of authority: primary server, serial, timers
dig www.example.com CNAME	Alias target
dig _sip._tcp.example.com SRV	Service records
dig -x 192.0.2.10	Reverse lookup (PTR) for an IP address

Choose the server and transport

Command	What it does
dig @1.1.1.1 example.com	Ask a specific resolver instead of the system one
dig @ns1.example.com example.com	Ask the authoritative server directly (bypasses caches)
dig +tcp example.com	Use TCP instead of UDP
dig -p 5353 @127.0.0.1 example.com	Non-standard port
dig -4 example.com / dig -6 example.com	Force IPv4 or IPv6 transport
dig +https @1.1.1.1 example.com	DNS over HTTPS (BIND 9.18 and later)

Control the output

Option	Effect
+short	Answer values only
+noall +answer	Answer section only, in zone-file format with TTLs
+trace	Follow the delegation from the root servers to the authoritative answer
+dnssec	Request DNSSEC records (RRSIG) with the answer
+norecurse	Do not ask for recursion (see what a server knows itself)
+nocmd +nostats	Drop the header line and the statistics
-f names.txt	Batch mode: one query per line from a file

Read the status

The header line ;; ->>HEADER<<- opcode: QUERY, status: NOERROR tells you how the server answered:

Status	Meaning
NOERROR	The name exists. An empty answer section means it has no record of the requested type
NXDOMAIN	The name does not exist
SERVFAIL	The resolver could not get an answer (broken delegation, DNSSEC validation failure, unreachable servers)
REFUSED	The server refuses to answer this client (for example a resolver that only serves its own network)

Troubleshooting recipes

bash

# does the change appear at the authoritative server? (compare the SOA serial)
dig +short example.com SOA @ns1.example.com
# is a resolver still caching the old value? (the TTL counts down)
dig +noall +answer example.com @8.8.8.8
# where does resolution break?
dig +trace example.com

On Windows, dig is included in the BIND 9 tools; nslookup and PowerShell's Resolve-DnsName are the built-in alternatives.

Sources

flags · digdig +short: print only the answer (IP address or record data)dig +short prints only the answer data, such as IP addresses or MX hosts, one per line for scripts. Empty output also hides NXDOMAIN, so check the status.errors · curlcurl: (6) Could not resolve hostcurl: (6) Could not resolve host means the host name in the URL did not resolve to an IP: a typo, bad quoting, no DNS, a VPN or proxy issue. How to check each.commands · ssss -tulpn: list listening ports and the process using themss -tulpn lists listening TCP and UDP ports with the owning process on Linux. What each flag means, filters for one port, and macOS and Windows equivalents.cheat sheets · opensslOpenSSL cheat sheet: keys, CSRs, certificates and TLS checksOpenSSL cheat sheet: generate keys and CSRs, inspect certificates, check that key and certificate match, convert PEM, DER and PFX, verify chains and test TLS.flags · digdig +noall +answer: show only the answer records with their TTLdig +noall +answer prints only the answer records with name, TTL, class, type and data, unlike +short. Add +comments to see NXDOMAIN or SERVFAIL status too.