DNS Flags & Options
Domain Name System records and resolution.All DNS pages
- dig +cd: bypass DNSSEC validation to tell SERVFAIL from a broken signaturedig +cd sets the Checking Disabled bit so the resolver skips DNSSEC validation. If +cd works but plain dig returns SERVFAIL, the zone signatures are broken.
- dig +dnssec: request RRSIG records and check whether a DNS answer is signeddig +dnssec sets the DO bit so servers return RRSIG signatures with the answer. Read the ad flag, DNSKEY, DS and NSEC records and diagnose DNSSEC failures.
- dig +norecurse: ask a server only what it knows (authoritative and cache checks)dig +norecurse clears the RD bit so a server answers only from its zones or cache. Check authoritative answers (aa flag), referrals and resolver caches.
- dig +nsid: find out which anycast DNS server instance answereddig +nsid requests the EDNS name server identifier (RFC 5001), revealing which anycast DNS instance answered. Use it when reporting inconsistent answers.