dig: the Domain Information Groper, or the art of asking a name server
For years, my DNS tool was nslookup. The habit comes from far away, it comes from Windows, it comes from the reflex “I want to see a record, I type nslookup”. Then one day I had to debug a zone that was propagating badly between a primary and a secondary and nslookup answered me with its interactive interface, its > prompt, its output that changes shape depending on the resolver library version of the system. I installed the dnsutils package that very evening and nslookup retired.
The package that triggered this is called dnsutils, it sits in every distribution and it carries three tools: dig, nslookup (for compatibility, more on that later) and nsupdate. dig comes with BIND, the ISC suite, the same family as the name server. And its name is the best acronym in Unix tooling: Domain Information Groper. The man who digs into domains.
The anatomy of a response
dig without arguments queries the root zone (., the root domain) and prints the list of the thirteen root servers, a through m. But the real learning is reading a full response, flag by flag:
$ dig www.mydomain.fr
; <<>> DiG 9.3.1 <<>> www.mydomain.fr
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 4016
;; flags: qr rd ra; QUERY: 1, ANSWER: 2, AUTHORITY: 3, ADDITIONAL: 1
;; QUESTION SECTION:
;www.mydomain.fr. IN A
;; ANSWER SECTION:
www.mydomain.fr. 3600 IN A 82.x.x.x
mydomain.fr. 86400 IN NS ns1.mydomain.fr.
;; Query time: 12 msec
;; SERVER: 192.168.1.1#53(192.168.1.1)
;; WHEN: Sun Jun 11 14:22:51 2006
;; MSG SIZE rcvd: 94
What the header says: qr (the question was asked), rd (recursion desired), ra (recursion available). If you query the authoritative server of the zone directly, a fourth flag appears: aa, authoritative answer, the response comes from the zone master, not from a cache. status: NXDOMAIN instead of NOERROR means the name does not exist. The three counters (QUERY, ANSWER, AUTHORITY, ADDITIONAL) give the size of each section and the footer says who answered and in how many milliseconds. Twelve milliseconds for a local resolver is healthy; eighty for a resolver that should make two is an incident waiting to be declared.
The everyday commands
The base reflex, the short version for scripts and tired eyes:
$ dig +short mydomain.fr A
$ dig +short mydomain.fr MX
$ dig +short mydomain.fr NS
The MX is the first mail debugging reflex: “the mail does not go through” is resolved nine times out of ten by a dig +short domain.tld MX revealing a missing record or one pointing anywhere. The TXT record, meanwhile, got hot this spring: SPF went RFC in April and every domain playing the anti-spam card now carries its policy in a TXT record. Checking yours takes one command.
The zone debugging reflex, the one that made me switch tools: comparing serial numbers between the primary and the secondaries. A SOA serial is traditionally written as YYYYMMDDNN (date plus revision number) and zone propagation is checked with two commands:
$ dig +short @ns1.mydomain.fr mydomain.fr SOA
$ dig +short @ns2.mydomain.fr mydomain.fr SOA
If the two numbers differ, the secondary has not reloaded yet (the SOA refresh timer has not expired) or cannot reach the primary. That is THE answer to “but it works on my machine”, said by someone querying their local resolver while the whole world sees the old zone.
The reverse walk, to check what the IP of a correspondent claims (the HELO of the mail server that was writing to you, for instance):
$ dig -x 82.x.x.x +short
And the full walk, the one that shows the whole delegation chain from the thirteen root servers down to your zone:
$ dig +trace www.mydomain.fr
+trace queries the roots, then the servers for .fr, then yours and prints every hop. It is the tool that answers “where does the problem come from” when the problem is a badly-placed delegation record.
AXFR, audit rather than attack
$ dig @ns1.mydomain.fr mydomain.fr AXFR
The zone transfer is the mechanism that feeds secondary servers. If it succeeds from your workstation, it succeeds from anywhere and your entire zone (every name, every machine, every comment left in the files) is readable by anyone. The correct answer from a well-configured server is status: REFUSED. If you watch the whole zone scroll by, the allow-transfer directive of BIND is waiting to be restricted to the secondaries only. It is the highest-return audit test in DNS: one command and either everything is fine, or you just discovered your internal map is public.
For scripting
dig was designed to be parsed. The trio that turns any response into a clean line:
$ dig +noall +answer mydomain.fr MX
+noall cuts everything, +answer only puts back the answer section. Add +comments for debugging, remove it for scripts. And if a response overflows the UDP packet, dig switches to TCP on its own; the +tcp flag forces that switch for testing.
nslookup, the brief eulogy
nslookup is not dead and will probably never die: it remains the only DNS tool present on Windows workstations and the reflex of admins who only have it. On our Unix systems, its interactive interface and its output that varies across implementations make it the tool you leave. The honest trio of the era: host for one-liners, nslookup for machines that only have it, dig for everything else. dig supersedes the two older ones, the BIND manpage says it without detours, but the three cohabit without quarrel.
The way out
All of this has an immediate application when you own your zone: delegating a subdomain to a machine you control. Two zone lines (an NS and an A) and queries for everything ending in that subdomain land at your place, wherever the asker sits. That can host a service, create yourself a discreet entrance, or something else I will show in a next article. Hint: everything, absolutely everything, fits in 63 characters per label.
[edit: 2026] Twenty years later, dig is still here, in the dnsutils package of every distribution, maintained by ISC through BIND 9.18 and 9.20 (whose license moved from ISC to MPL 2.0 along the way). Two things from this article aged and it is instructive: the acronym was removed from the manpage in 2017 (dig is no longer called “Domain Information Groper”, it is called dig, period) and ANY queries died in 2019 with RFC 8482: public resolvers no longer answer them usefully, you must ask for types one by one, exactly as the end of this article advises. nslookup, meanwhile, never died: it is still installed everywhere and still the default reflex on Windows workstations. The SOA test between primary and secondaries remains the first check of any zone audit (the DNS inventory still does it, just faster). And the promise at the end of the article was kept six weeks later: the subdomain delegation article arrived, it talked about a tunnel (iodine ) and its preliminary test was exactly this article’s dig.