dig +noall +answer: show only the answer records with their TTL
- tool
- dig / nslookup
- command
- dig
- flag
- +noall +answer
- default
- dig prints all sections: header comments, question, answer, authority, additional and statistics
dig +noall +answer example.com clears every display section with +noall and then turns the answer section back on with +answer, so dig prints only the resource records of the answer, one per line: owner name, TTL, class, type and data. The BIND manual uses exactly this combination as its example for "a much shorter output with just the name, record type, TTL, and value for each answer". Unlike +short, the TTL and the full record are kept, which is what you need when checking caching, CNAME chains or propagation.
Typical commands
dig +noall +answer example.com # A records with TTL
dig +noall +answer www.example.com AAAA # follows CNAMEs, shows every hop
dig +noall +answer example.com MX TXT # several types in one call
dig +noall +answer +comments example.com # plus the status line (NOERROR, NXDOMAIN)
dig @1.1.1.1 +noall +answer +ttlunits example.com # TTL printed as 5m, 1h ...Display options that combine with +noall
| Option | Shows |
|---|---|
| +answer | The answer section (the records) |
| +authority | The authority section, e.g. NS or SOA for negative answers |
| +additional | The additional section, e.g. glue addresses and the OPT record |
| +question | The question section |
| +comments | Header comments, including status, flags and section titles |
| +stats | Query time, server used, message size |
| +cmd | The first line naming the dig version and options |
The order matters: +noall must come before the sections you want, because it clears all display flags at that point.
Reading the TTL
The TTL in the answer from a recursive resolver is the time the record will stay in that resolver's cache, counting down from the value set in the zone. Querying the authoritative server directly (dig @ns1.example.com +noall +answer example.com) shows the configured TTL. Comparing the two tells you how long a change can take to be visible through that resolver.
Pitfalls
- Empty output hides errors. NXDOMAIN, SERVFAIL and "no records of this type" all print nothing with
+noall +answer; add+commentswhen the distinction matters. - Making it the default. Options in
~/.digrcapply to every query, for example a line+noall +answer; override per query with+all. - For scripts, the record data alone is easier to parse with +short. Transport problems such as truncated answers are covered on dig +tcp.
More options are summarised in the dig cheat sheet, and record-specific lookups in dig MX record lookup.
FAQ
What is the difference between +short and +noall +answer?
+short prints only the record data. +noall +answer prints complete answer records: owner name, TTL, class, type and data, so you can see the remaining TTL and which name a CNAME chain passed through.
How do I also see the response status (NOERROR, NXDOMAIN)?
Add +comments: dig +noall +answer +comments example.com prints the header comments, including status, next to the answer section.
Why is the output empty?
There are no records of that type for the name, or the name does not exist. +noall hides the header that would tell you which; add +comments or run dig without options to see the status.