How to Use the ‘dig’ and ‘nslookup’ Commands for DNS Troubleshooting

The DNS Failure Problem

When you type a website URL into a browser and hit Enter, your computer cannot actually read the letters. It must ask a Domain Name System (DNS) server to translate the human-readable URL (e.g., example.com) into a machine-readable IP address (e.g., 192.168.1.15).

When websites fail to load, the first instinct is often to blame the web server. However, a massive percentage of web outages are actually DNS failures. If you migrate a website to a new host and update the DNS records, it can take up to 48 hours for those changes to propagate globally.

To diagnose exactly what IP address a specific DNS server is currently handing out, network administrators use two fundamental terminal tools: nslookup and its significantly more powerful replacement, dig.

1. The Classic Tool: nslookup

nslookup (Name Server Lookup) is the oldest DNS tool, and its primary advantage is that it is installed on literally every operating system by default (Linux, macOS, and Windows).

To simply ask your default internet provider what IP address belongs to a website, type:

nslookup google.com

The output will show two things: the “Server” (the DNS server that answered your question) and the “Answer” (the actual IP addresses associated with Google).

Querying a Specific DNS Server

If you just updated your website’s DNS records, your local internet provider might still be caching the old IP address. You can use nslookup to bypass your local provider and ask a massive public DNS server (like Google’s 8.8.8.8 or Cloudflare’s 1.1.1.1) directly.

nslookup mywebsite.com 8.8.8.8

2. The Modern Standard: dig

While nslookup is universally available, Linux administrators overwhelmingly prefer dig (Domain Information Groper). It provides drastically more detailed information and handles complex queries elegantly.

dig google.com

The output of dig is divided into structured sections:

• Header: Shows the status of the query (status: NOERROR is good; status: NXDOMAIN means the domain does not exist).
• Question Section: Reconfirms what you actually asked (e.g., Google’s A Record).
• Answer Section: The critical part. It displays the IP addresses and the “TTL” (Time to Live), which tells you exactly how many seconds this answer will be cached before it is refreshed.

3. Extracting Specific DNS Records with dig

A domain name isn’t just one IP address. It has MX records (for email routing), TXT records (for security validation like SPF/DKIM), and CNAME records (aliases).

To explicitly query the email routing servers for a domain to ensure emails aren’t bouncing:

dig mx google.com

To query the TXT records to verify a domain’s security certificates:

dig txt google.com

4. The “Short” Answer (For Scripting)

If you are writing a bash script to automatically test if a website has migrated correctly, you don’t want the massive block of text that dig usually outputs. You only want the raw IP address.

You can use the +short flag to strip away all the headers and formatting.

dig +short google.com

This command outputs nothing but the IP address (e.g., 142.250.190.46), making it perfectly clean to pipe into other Linux commands or variables.

Conclusion

While nslookup remains a convenient cross-platform utility, dig is the definitive forensic tool for DNS troubleshooting. By allowing administrators to query specific record types, target specific nameservers, and parse raw IP data, dig eliminates the guesswork from domain migrations and network outages.