Domain Information Groper (gatherer)
Simple usage: dig hostname
Ask specific DNS server dig @DNSserver hostname
dig [gobal opts] hostname
[ …] lookup this IP address
[-x addr]
[@server]
[-b sourceAddress]
[-c class] [-t type]
[-p port#]
[-q name]
[-y [hmac:]tname:key]
[-f digCommandFile]
[-4] [-6]
[type]
[class]
[queryopt...]
[-k keyFile]
dig [global-queryopt...] [query...]
domain information groper interrogates DNS name servers, performs
DNS lookups and outputs the answers.
Note that the completness of the response will vary from server to serer and query to query!!
> dig NS pppg.org ;; ANSWER SECTION: pppg.org. 3600 IN NS ns64.domaincontrol.com. pppg.org. 3600 IN NS ns63.domaincontrol.com. |
By default uses servers in /etc/resolv.conf (which may have come from DHCP server)
User defaults are in ${HOME}/.digrc and are applied before the command line arguments.
Output is in a form suitable for use in named.conf
with commentary information prefixed with
; which will be treated as comments.
hostname | resource record(s) to be looked up. |
server |
-t type
|
ANY, A, AAAA†, MX, NS, SOA, HINFO, AXF, TXT, SIG, RRSIG,… Default: A (not all).TXT may contain information including Sender Policy Frameworkexample: v=spf1 a mx ip4:67.228.235.89 ?all AXFR requests a zone transfer.IXFR incremental zone transfer When an IXFR is required, type is set to IXFR=nnnnnnnn.
The incremental zone transfer will contain the changes made to
the zone since the serial number in the zone's SOA record was nnnnnnnn.Frequently the serial number used is in the form; yyyymmddNN where NN is incremented each time the conf is changed in a given day. see BIND . | ||||||||
-x iii.iii.iii.iii | reverse lookup; maps addresses to names like 216.40.47.26.in-addr.arpa and sets query type to PTR and class to IN .By default, IPv6 addresses are looked up using nibble format under the IP6.ARPA domain. | ||||||||
-i x.x.x.x.x.x.x.x.x | use the older RFC1886 method using the IP6.INT domain
Bit string labels (RFC2874) are not attempted.
| ||||||||
-f filename | read requests from filename .
Using the same format as a command.
| ||||||||
-q name | sets the query name to distingish the name from other arguments. | ||||||||
-c class | Default IN internet.
HS Hesiod or CH Chaosnet
| ||||||||
-4 -6 | use IPv4 query transport. use IPv6 | ||||||||
-b address[#port]
sets the | source IP address or 0.0.0.0 or xx:xx:xx:xx.-p portDefault 53.
| -k keyfile Sign DNS queries and responses using transaction signatures (TSIG)
| -y hmac tname keyTSIG | hmac type of TSIG, default HMAC†-MD5 alternate:-SHDA1tname the name of the key key base-64 encoded string(typically generated by dnssec-keygen(8)). N.B. The key is visible from ps or the shell's history file. When using TSIG authentication the name server needs to know the key and algorithm that is
being used. In BIND, this is done by providing appropriate key and server statements in named.conf.
-h |
+) and an optional no.
Supressing some output is useful when comparing queries that are expected to be the same.
For example since ttl keeps changing and stats includes the current time,
including them will result in differences which are not significant.
Simularly outputting version identification can be supressed using +nocmd
+[no]all | |||||||||||||||||||||||||
Some of these set or reset flag bits in the query header
keywords are preceded by a plus (+).
keywords which set or reset an option and may be preceded by no.
keywords which assign values to options (like the timeout interval), have the form keyword=value.
domain=somename | Set the search list to contain the single domain somename,
as if specified in a domain directive
in /etc/resolv.conf, and enable search list processing as if search were given.
| ||||||||||||||||||||||||||||||||||||||||||||||||||||
search | |||||||||||||||||||||||||||||||||||||||||||||||||||||
-f file, specifying multiple queries on the command line is permited, each can be supplied with its own set of flags, options and query options.
Each query argument represent an individual query in the command-line syntax . consisting of any of the standard options and flags, the name to be looked up, an optional query type and class and any query options that should be applied to that query.
Global query options, applied to all queries,
must precede the first tuple of name, class, type, options, flags, and query options on the command line
and can be overridden by a query-specific set of query options. For example:
dig +qr www.isc.org any -x 127.0.0.1 isc.org ns +noqr
+qr is applied, so the initial query it made for each lookup. +noqr not output the initial query when it
looks up isc.org.tip: The IN and CH class names overlap with the IN and CH top level domains names.
/etc/resolv.conf
${HOME}/.digrc
SEE host, named, dnssec-keygen, RFC1035.
dig [@global-server] [domain] [q-type] [q-class] {q-opt}
{global-d-opt} host [@local-server] {local-d-opt}
[ host [@local-server] {local-d-opt} …
Where:
domain is in the Domain Name System
q-class one of: in, hs, ch,… default: in
q-type one of: any, a, mx, ns, soa, hinfo, axf, txt,… default:a
Use ixfr=version for type ixfr
q-opt :
-q name -t type -c class
-f filename batch mode
-x dot-notation shortcut for in-addr lookups
-i IP6.INT reverse IPv6 lookups
-b address#port bind to source address/port
-p port
-4 -6 use IPv4/IPv6 query transport only
d-opt is of the form +keyword=value, where keyword is:
vc tcp TCP mode aka Virtual Circuit
+time=### timeout 5 sec.
+tries=### UDP attempts 3 +retry=### UDP retries 2
+domain=### default domainname
+bufsize=### EDNS0 Max UDP packet size
+ndots=###
+edns=###
search Set whether to use searchlist
showsearch Search with intermediate results
defname
recurse
ignore Don't revert to TCP for TC responses
fail Don't try next server on SERVFAIL
besteffort Try to parse even illegal messages
all Set or clear all output flags
aaonly Set AA flag in query aaflag
adflag Set AD cdflag Set CD
cmd output command line
qr output question before sending
cl output class
comments question answer
authority additional stats
short ttlid (ommits type=txt)
nssearch Search all authoritative nameservers
identify ID responders in short answers
trace Trace delegation down from root
multiline output records in an expanded format
dnssec Request DNSSEC records
-k keyfile specify tsig key file
-y [hmac:]name:key (specify named base64 tsig key)
global d-opts and servers (before host name) affect all queries.
local d-opts and servers (after host name) affect only that lookup.
dig +noall +answer -t any real-world-systems.com
real-world-systems.com. 14114 IN TXT "v=spf1 a mx ip4:67.228.235.89 ?all"
real-world-systems.com. 13835 IN A 67.228.235.89
real-world-systems.com. 13835 IN MX 0 real-world-systems.com.
real-world-systems.com. 53938 IN NS dns2.midphase.com.
real-world-systems.com. 53938 IN NS dns1.midphase.com.
dig @ns1.hover.com pppg.org ; << DiG 9.3.4-P1 << @ns1.hover.com pppg.org ; (1 server found) ;; global options: printcmd ;; Got answer: ;; ->>HEADER<< opcode: QUERY, status: NOERROR, id: 10336 ;; flags: qr aa rd; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 0 ;; QUESTION SECTION: ;pppg.org. IN A ;; ANSWER SECTION: pppg.org. 900 IN A 67.220.194.133 ;; Query time: 132 msec ;; SERVER: 216.40.47.26#53(216.40.47.26) ;; WHEN: Thu Oct 29 12:39:23 2009 ;; MSG SIZE rcvd: 42 | dig @ns1.midphase.com pppg.org ; <<>> DiG 9.3.4-P1 <<>> @ns1.midphase.com pppg.org ; (1 server found) ;; global options: printcmd ;; Got answer: ;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 7373 ;; flags: qr aa rd; QUERY: 1, ANSWER: 1, AUTHORITY: 2, ADDITIONAL: 2 ;; QUESTION SECTION: ;pppg.org. IN A ;; ANSWER SECTION: pppg.org. 14400 IN A 67.228.235.89 ;; AUTHORITY SECTION: pppg.org. 86400 IN NS dns1.midphase.com. pppg.org. 86400 IN NS dns2.midphase.com. ;; ADDITIONAL SECTION: dns1.midphase.com. 86400 IN A 67.213.216.225 dns2.midphase.com. 86400 IN A 69.4.235.113 ;; Query time: 69 msec ;; SERVER: 67.213.216.227#53(67.213.216.227) ;; WHEN: Thu Oct 29 12:42:56 2009 ;; MSG SIZE rcvd: 124 | |||||||||||
cccu.us. 86367 IN RRSIG NSEC 5 2 86400 20110219155930 20110120152137 4787 US. FVbkawbzpPd5cKbvj24QSZJ1hDVawkohCA3+65kIVhZBp5EVqa6U0hjl +oP3ZMTYCM0v38ezLOKuKBZR0+rRS6UUaN+TWC77EoGY85LGe+o9Sz4x BXULGzhPzobdw1Rk1FrDLdo/MYNMjAe5946JXozyxVXJiqZJt+VGa9KC LpU= cccu.us. 86367 IN NSEC CCCUN.us. NS RRSIG NSEC
/etc/resolve.confdomain Germans nameserver 192.168.1.1 nameserver 71.250.0.12 |