What is the ‘dig’ command, and how can I use it?

The dig command, short for “Domain Information Groper,” in Linux or MacOS is a command-line tool used to query Domain Name System (DNS) servers. The command is a lot like nslookup, but at the same time it is different. If you are a Windows user, you have to use nslookup. For a reference on nslookup go here.

The dig command helps in diagnosing DNS issues and retrieving information about DNS records for a given domain or hostname. It is widely used by network administrators and developers for troubleshooting.

Install dig:

On most Unix-based systems, dig is part of the dnsutils package. To install it:

• Ubuntu/Debian: sudo apt install dnsutils
• CentOS/Red Hat: sudo yum install bind-utils
• MacOS: Pre-installed in most cases or can be installed via Homebrew: brew install bind

Basic Syntax:

dig [@server] [name] [type] [options]

Components:

1. @server (optional): The DNS server to query (e.g., @8.8.8.8 for Google DNS).
2. name: The domain name or hostname to query (e.g., example.com).
3. type (optional): The type of DNS record to query. Common types include:
   • A: IPv4 address
   • AAAA: IPv6 address
   • MX: Mail exchange server
   • CNAME: Canonical name (alias)
   • TXT: Text records
   • NS: Name server records
4. options (optional): Additional flags to modify the output.

Examples of Common Use Cases:

1. Query the A Record (IPv4 address): dig example.com A This retrieves the IPv4 address of example.com.
2. Query the MX Record (Mail Exchange): dig example.com MX This retrieves mail server information for example.com.
3. Query a Specific DNS Server: dig @8.8.8.8 example.com A This queries Google’s public DNS server for the IPv4 address of example.com.
4. Get All DNS Records (ANY type): dig example.com ANY Note: Some servers restrict responses to ANY queries for security reasons.
5. Query the NS Records: dig example.com NS This retrieves the authoritative name servers for example.com.
6. Reverse DNS Lookup (PTR record): dig -x 8.8.8.8 This retrieves the domain name associated with the IP address 8.8.8.8.
7. Verbose Output: dig +trace example.com This shows the path of the DNS query, starting from the root servers.
8. Simplify Output (Using +short): dig example.com A +short This returns only the IP address, making it easier to read.

Output Structure:

The dig output is typically divided into sections:

1. Header: Query details, including flags and response codes.
2. QUESTION SECTION: The domain and query type.
3. ANSWER SECTION: The result of the query (e.g., IP address, DNS records).
4. AUTHORITY SECTION: Information about the authoritative DNS servers.
5. ADDITIONAL SECTION: Additional information (e.g., IP addresses of name servers).

Key Options:

• +short: Outputs only the essential result.
• +trace: Traces the query through each DNS server in the resolution chain.
• +noall +answer: Displays only the ANSWER section.
• +nocmd: Suppresses the command details in the output.

There are many many options you can look at in the command (a partial screen shot below):

Usage Tips:

• Combine dig with grep or awk to filter results programatically.
• Use +timeout and +tries to control the query timeout and retries.

The TTL in the dig Output

In the output of the dig command, TTL stands for Time to Live. This is not the same as the IP TTL value in the header of IP tackets.

It is a value in seconds that specifies the duration for which a DNS record can be cached by a resolver or a DNS server. The TTL determines how long a record is considered valid before the resolver must query the authoritative DNS server again for updated information.

Where TTL Appears:

In the ANSWER SECTION of a dig query output, TTL is displayed as one of the fields for each DNS record.

Example dig output:

Here

• 3600 is the TTL value (in seconds).
• It means this record can be cached by a resolver for 3600 seconds (1 hour) before being considered stale.

How TTL Works:

1. Caching and Performance: DNS resolvers cache records to reduce the load on DNS servers and improve response times for clients. The TTL specifies how long this cache is valid.
2. Updates: If a DNS record changes, the TTL determines how quickly the change propagates. A lower TTL ensures faster updates but increases query traffic to authoritative servers.
3. Default Values: The TTL is configured by the owner of the DNS zone and may vary for different record types or domains.

Key Points:

• Short TTL: Use a low TTL (e.g., 300 seconds) when records may change frequently, such as during server migrations or IP address updates.
• Long TTL: Use a high TTL (e.g., 86400 seconds) for records that rarely change, to minimize DNS query traffic and improve performance.
• Dynamic Updates: During planned changes, TTL can be temporarily lowered in advance to ensure quicker propagation of updates.

Example with Multiple Records:

;; ANSWER SECTION:
example.com.    300     IN    A    192.0.2.1
example.com.    300     IN    A    192.0.2.2

Both records have a TTL of 300 seconds (5 minutes). After 5 minutes, any cached data for these records must be refreshed.

Checking TTL with dig:

To view the TTL of a specific DNS record:

dig example.com A

For a more concise output with only the TTL:

dig example.com A +noall +answer

Comments are welcomed below from registered users.  You can also leave comments at our Discord server. 

If you would like to see more content and articles like this, please support us by clicking the patron link where you will receive free bonus access to courses and more, or simply buying us a cup of coffee!