📞 The dig phonebook

A navigation index of every dig and nslookup command covered in this wiki, gathered onto one page and sorted by what you are trying to see. The lookups point at the live demo zone (example.isitdns.net and the isitdns.net apex) or at a stable public anchor (Cloudflare's 1.1.1.2 reverse, the permanently-broken dnssec-failed.org, the root). Each entry links to the source page that walks the same lookup through its full annotated output.

Tools note: the macOS system dig is 9.10.6, which has no +https and does not know the HTTPS type by name. Where a record needs newer tooling or the AD bit, the phonebook gives you a curl DoH form that works from any machine. See nslookup-and-dig for the tool-by-tool reference and dot-doh for encrypted transport.

Records#

The bread and butter: one query per record type, each pointing at a live demo record. Per-type deep dives live under the record-type cheat sheet.

nslookup -type=A    example.isitdns.net 1.1.1.1
nslookup -type=AAAA example.isitdns.net 1.1.1.1
nslookup -type=CNAME cname.example.isitdns.net 1.1.1.1
nslookup -type=MX   mx.example.isitdns.net 1.1.1.1
nslookup -type=TXT  txt.example.isitdns.net 1.1.1.1
nslookup -type=CAA  caa.example.isitdns.net 1.1.1.1
nslookup -type=SRV  _xmpp-server._tcp.example.isitdns.net 1.1.1.1
nslookup -type=NS   isitdns.net 1.1.1.1
nslookup -type=SOA  isitdns.net 1.1.1.1
nslookup -type=SSHFP sshfp.example.isitdns.net 1.1.1.1
nslookup -type=TLSA _443._tcp.tlsa.example.isitdns.net 1.1.1.1
nslookup -type=TYPE65 svcb.example.isitdns.net 1.1.1.1

Zones and transfer#

Walking the apex, poking authoritative servers directly, and the transfer commands. An authoritative server answers an iterative (RD=0) query straight from its zone data: the aa bit is set and ra is not, because the server holds the answer itself and offers no recursion (RFC 1034 section 4.3.2). That is true of Cloudflare's coleman and hera at the isitdns.net apex and of BIND authoritative servers like the ones behind the probe.isitdns.net demo alike. If a direct @server query instead comes back with ra set, no aa, or a REFUSED / SERVFAIL, that reply came from an in-path port-53 interceptor answering in the server's place, not from the authoritative server; see the warning below.

DNSSEC#

The signed-zone chain, and the permanently-broken anchor that proves validation works. isitdns.net is signed (algorithm 13, ECDSAP256SHA256); dnssec-failed.org is a public zone that is deliberately, permanently BOGUS.

curl -s -H 'accept: application/dns-json' \
  'https://cloudflare-dns.com/dns-query?name=isitdns.net&type=A'

Encrypted transport (DoT / DoH / DoQ)#

The system dig (9.10.6) cannot speak DoH or DoT, so the portable path is curl against a DoH JSON endpoint. dig +https needs 9.18+; kdig covers DoT and DoQ. Background and the kdig recipes live on dot-doh.

curl -s -H 'accept: application/dns-json' \
  'https://cloudflare-dns.com/dns-query?name=txt.example.isitdns.net&type=TXT'

Reverse DNS#

IP back to name. The 1.1.1.2 and 2606:4700:4700::1111 reverses are stable public Cloudflare records, so the lookups answer live. The full tree walk is on reverse-dns.

nslookup 1.1.1.2 1.1.1.1
nslookup -type=PTR 2.1.1.1.in-addr.arpa 1.1.1.1
nslookup 2606:4700:4700::1111 1.1.1.1

Troubleshooting: when it actually is DNS#

The checks that tell a real DNS failure apart from something wearing a DNS costume. Each one pairs with a worked failure on when-its-dns.

Just for fun#

The demo zone hides a few TXT records that draw ASCII art. Each one is an ordinary one-line TXT value with ~ standing in for the line breaks (past 255 bytes the wire format also chunks it into extra strings, as the hangman shows), and the front-page dig tool unfolds them. Plain dig shows the folded line; the tool draws the picture.

See also#

• The dig-along: every record type, live, one query at a time
• dig flag reference: what each +flag does and how to read a response
• Worked examples: DNSSEC, NXDOMAIN, ECS, encrypted DNS, annotated
• nslookup and dig: the two tools, side by side
• When it actually is DNS: the failures people blame on DNS
• Record type cheat sheet · DNSSEC · Encrypted DNS · Reverse DNS
• Wireshark DNS filters: when even dig +qr is not enough