/commands/dig/dig-query-specific-dns-server
dig @8.8.8.8 example.com: query a specific DNS server
- tool
- dig / nslookup
- versions
- BIND 9.18, BIND 9.20
- os
- linux, macos, windows
dig @SERVER NAME TYPE sends the query to the name server you choose instead of the ones in /etc/resolv.conf. Use it to compare what different resolvers return, to ask a zone's authoritative server directly (bypassing caches), or to test a server you just configured. SERVER is an IPv4 or IPv6 address or a host name; the ;; SERVER: line near the end of the output confirms which server answered.
dig @1.1.1.1 example.com # public resolver, A record
dig @8.8.8.8 example.com MX # another resolver, MX record
dig @ns1.example.net example.com # authoritative server, no cache in between
dig @127.0.0.1 -p 5353 example.com # local server on a non-standard portHow dig picks the server
Without @, dig reads the nameserver lines of /etc/resolv.conf and uses the first address that works; if none is usable it queries the local host. With @SERVER the file is ignored for the choice of server. When SERVER is a name, dig resolves it through the system resolver before sending the query, so a broken local resolver can make @ns1.example.net fail while @192.0.2.53 works.
Variants
| Command | What it does |
|---|---|
| dig @1.1.1.1 example.com | Ask a public recursive resolver; the answer may come from its cache. |
| dig @ns1.example.net example.com +norecurse | Ask the authoritative server without requesting recursion; the reply carries the aa flag when it is authoritative. |
| dig -4 @dns.example.net example.com | Use only IPv4 to reach the server (-6 for IPv6 only). |
| dig @127.0.0.1 -p 5353 example.com | Query a server listening on a port other than 53. |
| dig @1.1.1.1 example.com +tcp | Send the query over TCP instead of UDP. |
| dig @1.1.1.1 example.com +tls | DNS over TLS (port 853 by default). |
| dig @1.1.1.1 example.com +short +identify | Short answer plus the address and port of the server that sent it. |
Compare two servers
The common use is checking whether a change has reached every server. Ask the authoritative server first (it has the new data), then a public resolver (it may still serve the old record until the TTL in its cached copy runs out):
dig @ns1.example.net www.example.com +noall +answer
dig @8.8.8.8 www.example.com +noall +answerThe second column of each answer line is the TTL. On the authoritative server it is the configured value; on a resolver it counts down, and the old record disappears when it reaches zero.
Errors you may see
;; communications error to 127.0.0.1#53: connection refused: nothing listens on that address and port. See communications error: connection refused.;; connection timed out; no servers could be reached: the server did not answer, often a firewall dropping UDP 53. See connection timed out.couldn't get address for 'ns1.example.net': not found: the host name after@did not resolve. See couldn't get address.;; WARNING: recursion requested but not available: the server is authoritative-only or refuses recursion for you. See recursion requested but not available.
FAQ
Can I give dig a host name after @ instead of an IP?
Yes. dig resolves that name with the system resolver first and then queries the address it gets. If the name cannot be resolved, dig stops with couldn't get address for ... not found, so an IP address is the safer choice when you troubleshoot DNS itself.
How do I query a DNS server on a port other than 53?
Add -p PORT, for example dig @127.0.0.1 -p 5353 example.com. With +tls the default port becomes 853, which is the DNS over TLS port.
Why does the authoritative server return no answer for another domain?
An authoritative-only server answers just for the zones it hosts. For any other name it refuses or returns a referral, and dig prints the warning that recursion was requested but is not available.