dig +nsid: find out which anycast DNS server instance answered
- tool
- DNS
- command
- dig
- flag
- +nsid
- default
- +nonsid (no name server identifier is requested)
dig +nsid @k.root-servers.net . SOA adds an EDNS Name Server Identifier (NSID) request to the query; the BIND manual describes the option as including "an EDNS name server ID request when sending a query". Servers that support RFC 5001 reply with an identifier string chosen by the operator, which dig prints in the OPT pseudo-section as an NSID: line. With anycast, where one IP address is served from dozens of sites, that identifier is the only way to know which physical server instance answered your query.
Typical commands
dig +nsid @k.root-servers.net . SOA # which root-server instance answered
dig +nsid @ns1.example.com example.com SOA # identify an authoritative instance
dig +nsid +norecurse @ns1.example.com example.com A # combine with an authoritative check
for i in 1 2 3; do dig +nsid +noall +comments @ns1.example.com example.com SOA | grep -i nsid; doneThe last loop shows whether consecutive queries hit the same instance; with anycast they usually do from one location, but routing changes can switch sites.
When NSID helps
| Problem | How NSID helps |
|---|---|
| Some clients get old data after a change | Shows which anycast node still serves the old zone (compare SOA serials per NSID) |
| Intermittent timeouts from one region | Identifies the site to report to the DNS provider |
| Different answers from the same IP | Proves that different instances answered |
| Verifying routing to the nearest site | Site names in NSID often contain an airport or city code |
Combine it with +norecurse (see dig +norecurse) when checking authoritative servers, and with the SOA serial when following a change through DNS propagation.
Related EDNS options in dig
| Option | Purpose |
|---|---|
| +nsid | Request the server identifier (RFC 5001) |
| +cookie | Send a DNS COOKIE option |
| +subnet=ADDR/PREFIX | Send an EDNS Client Subnet option to test geo-dependent answers |
| +edns=N / +noedns | Choose the EDNS version or disable EDNS |
| +bufsize=B | Advertised UDP buffer size |
Pitfalls
- Optional feature. Many servers, and most home routers, do not support NSID; an empty result is normal.
- EDNS stripped. Firewalls that drop or rewrite EDNS options also remove NSID; compare results from another network before concluding.
- Not authentication. The identifier is free text from the operator and is not signed; use it for troubleshooting, not for trust decisions.
- Choose the server explicitly with
@server, as on query a specific DNS server; response codes are explained in DNS RCODEs.
FAQ
Why would I need the server ID when I already know the IP address?
Large DNS services announce the same IP address from many locations (anycast). The address tells you nothing about which site answered; NSID identifies the specific instance, which operators ask for when you report inconsistent answers.
Why does dig +nsid show no NSID line?
The server does not support NSID or does not send it, or a middlebox removed the EDNS option. NSID is optional, so its absence is not an error.
Does NSID reveal anything about me?
No. The request carries no data from the client; only the server returns an identifier that its operator chose to publish.