dig

Domain Information Groper (dig) is a command-line DNS lookup utility that queries Domain Name System (DNS) servers for domain records on Linux, macOS, and Windows.

What dig Does and When to Use It

Domain Information Groper (dig) sends DNS queries to nameservers and displays the responses. dig retrieves DNS records such as A, AAAA, MX, CNAME, NS, SOA, TXT, and PTR records for any domain. Network administrators and developers use dig to troubleshoot DNS resolution issues, verify DNS propagation after changes, and inspect the delegation path from root nameservers to authoritative servers.

dig is part of the Berkeley Internet Name Domain (BIND) suite, maintained by the Internet Systems Consortium (ISC). It replaces older tools such as nslookup and host with more detailed output and greater flexibility. dig runs on Linux, macOS, and Windows (via Cygwin or Windows Subsystem for Linux).

Use dig when a domain fails to resolve, when DNS records need verification, or when tracing the full resolution path from root servers through Top-Level Domain (TLD) servers to the authoritative nameserver. For quick one-off lookups where detailed output is unnecessary, host or nslookup may be simpler alternatives.

How to Install dig

dig ships preinstalled on most Linux distributions and on macOS. Verify whether dig is available by checking its version:

dig -v

Install dig on systems where it is missing:

Ubuntu / Debian:

sudo apt update && sudo apt install dnsutils

CentOS / RHEL / Fedora:

sudo dnf install bind-utils

Arch Linux:

sudo pacman -S bind-tools

Alpine Linux:

sudo apk add bind-tools

macOS (Homebrew):

brew install bind

Core Concepts of dig

dig Query Syntax

dig follows the syntax dig [@server] [name] [type] [options]. The @server argument specifies which DNS resolver to query. The name argument identifies the domain to look up. The type argument selects the DNS record type (A, MX, NS, AAAA, CNAME, TXT, SOA, PTR, or ANY). Options modify the output format and query behavior.

dig Output Sections

dig divides its response into five sections. The HEADERsection shows the query status (NOERROR, NXDOMAIN, SERVFAIL), flags, and record counts. The QUESTIONsection repeats the query that was sent. The ANSWERsection contains the DNS records returned by the nameserver. The AUTHORITYsection lists the authoritative nameservers for the domain. The ADDITIONALsection provides extra records such as nameserver IP addresses. The statistics footer shows query time, responding server, and message size.

dig Record Types

dig queries different DNS record types to retrieve specific information. The A record maps a domain to an IPv4 address. The AAAA record maps a domain to an IPv6 address. The MX record identifies mail exchange servers for a domain. The NS record lists the authoritative nameservers. The CNAME record maps an alias to a canonical domain name. The TXT record holds text data such as SPF policies and domain verification strings. The SOA record contains zone authority metadata including the primary nameserver, administrator email, serial number, and Time to Live (TTL) values.

dig Default Resolver

dig reads the system's /etc/resolv.conf file to determine which DNS resolver to use when no @server argument is specified. Override this default by passing a specific resolver with the @ prefix, such as @8.8.8.8 for Google Public DNS or @1.1.1.1 for Cloudflare DNS.

Common Tasks with dig

How to Query a Domain A Record with dig

dig queries the A record of a domain by default. Pass the domain name as the argument:

dig example.com

Add +short to display the IP address without the full verbose output:

dig example.com +short

For detailed options, see How to Use dig.

How to Perform a Reverse DNS Lookup with dig

dig performs a reverse DNS lookup with the -x flag. Pass the IP address to find the associated domain name through a PTR record query:

dig -x 8.8.8.8

For the full procedure, see How to Look Up a Domain by IP with dig.

How to Query a Specific DNS Server with dig

dig queries a specific DNS resolver when the @server argument precedes the domain name. This bypasses the system's default resolver:

dig @8.8.8.8 example.com

For more details, see How to Query a Domain Using a Specific DNS Server with dig.

How to Trace the DNS Delegation Path with dig

dig traces the full DNS resolution path from root nameservers to the authoritative server with the +trace option. This reveals each step of DNS delegation:

dig example.com +trace

For the complete walkthrough, see How to Trace the DNS Delegation Path with dig.

How to Query MX Records with dig

dig retrieves Mail Exchange (MX) records by specifying the MX record type after the domain name:

dig example.com MX

How to Query NS Records with dig

dig lists the authoritative nameservers for a domain with the NS record type:

dig example.com NS

dig Flags and Options Reference

dig accepts command-line flags and query options prefixed with +. The table below covers the most commonly used options.

For the complete flag and option reference, see dig References.

Related Tools and Guides

nslookup is an older DNS lookup tool that dig replaces for most diagnostic tasks. See nslookupfor its usage.

host is a simpler DNS lookup tool that provides concise output without the detailed sections that dig displays. See hostfor basic DNS queries.

The .digrc configuration file stores default dig options that apply to every query. See How to Use .digrcfor configuration details.