dig: look up DNS records

Updated November 2026

dig asks DNS servers questions and shows their answers in detail. It is the tool for checking that a domain points where it should, that mail records are right, and that a DNS change has spread.

dig is in the bind9-dnsutils package on Debian and Ubuntu (apt install dnsutils also works), and bind-utils on RHEL and Fedora.

Examples

dig example.com                    # A record, with full details
dig +short example.com             # just the answer
dig +short example.com AAAA        # IPv6 address
dig example.com MX                 # mail servers
dig +short example.com TXT         # SPF, verification records
dig +short _dmarc.example.com TXT  # DMARC policy
dig +short www.example.com CNAME
dig example.com NS                 # the domain's name servers
dig @1.1.1.1 example.com           # ask a particular resolver
dig @ns1.example.net example.com   # ask the authoritative server directly
dig -x 203.0.113.10                # reverse lookup: address to name (PTR)
dig +trace example.com             # follow the delegation from the root servers
dig +dnssec example.com            # include DNSSEC signatures

Reading the output

;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 31337
;; flags: qr rd ra ad; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 1

;; ANSWER SECTION:
example.com.        3600    IN    A    203.0.113.10

;; Query time: 12 msec
;; SERVER: 127.0.0.53#53(127.0.0.53) (UDP)

• status: NOERROR (fine), NXDOMAIN (the name does not exist), SERVFAIL (the server could not get an answer, often a DNSSEC or delegation problem).
• 3600 is the TTL: how many seconds resolvers may cache the answer.
• The ad flag means the resolver validated the answer with DNSSEC.
• SERVER shows which resolver answered. 127.0.0.53 is the local systemd-resolved stub.

Has my DNS change spread?

Ask the authoritative server first: it shows the new value immediately. Then ask public resolvers; they show the old value until the old TTL runs out.

dig +short NS example.com
dig +short @ns1.example.net www.example.com
dig +short @1.1.1.1 www.example.com ; dig +short @8.8.8.8 www.example.com ; dig +short @9.9.9.9 www.example.com

Lower the TTL a day before a planned move, so the switch takes effect quickly. See DNS basics.

What does my system actually use?

dig talks to DNS directly. Programs on the system use the resolver configuration, which can also consult /etc/hosts, so the answers can differ:

getent hosts www.example.com       # what programs on this machine will get
resolvectl status                   # DNS servers in use (systemd-resolved)
resolvectl query example.com
cat /etc/resolv.conf

host example.com gives a short, readable answer, and nslookup is available on almost every system including Windows, but dig gives the most complete picture.