How to Use the dig Command to Troubleshoot DNS Records in Linux

Why DNS Issues Are the Root of Most Network Failures

In network administration and web hosting, an old industry proverb holds true: “It’s not DNS. There’s no way it’s DNS. It was DNS.” The Domain Name System (DNS) translates human-friendly domain names (like digitash.com) into the numeric IP addresses computers use to route traffic across the internet. When DNS fails or records propagate unevenly after a server migration, websites become unreachable, incoming emails bounce silently, and SSL certificate renewals abort.

While traditional network tools like ping or nslookup can verify basic connectivity, they lack granular visibility into DNS authority, query response times, and authoritative nameserver responses. dig (Domain Information Groper) is the industry-standard, high-precision command-line tool developed by the Internet Systems Consortium (ISC) for interrogating DNS servers and troubleshooting record misconfigurations.

Installing dig on Linux Distributions

The dig binary is part of the bind-utils / dnsutils software package:

Ubuntu / Debian / Linux Mint

sudo apt update && sudo apt install -y dnsutils

Fedora / RHEL / Rocky Linux / AlmaLinux

sudo dnf install -y bind-utils

Arch Linux / Manjaro

sudo pacman -S bind

Step 1: Performing a Standard DNS Query

The simplest invocation queries the default resolver configured in your operating system’s /etc/resolv.conf:

dig example.com

Anatomy of the dig Output

A standard dig query returns several distinct sections:

• Header: Displays the dig version, transaction ID, and query flags (such as qr for query response, rd for recursion desired, and ra for recursion available). Look specifically for status: NOERROR. A status of NXDOMAIN indicates the domain does not exist.
• QUESTION SECTION: Echoes your query (e.g. example.com. IN A).
• ANSWER SECTION: The core data payload showing the resolved IP address, time-to-live (TTL) in seconds, class (IN for internet), and record type.
• Footer Statistics: Shows the exact query time in milliseconds, the specific server and port queried (e.g. SERVER: 127.0.0.53#53), and the timestamp.

Step 2: Querying Specific DNS Record Types

By default, dig requests standard IPv4 A records. You can append the specific record type to target other DNS vectors:

Query IPv6 Addresses (AAAA Records)

dig example.com AAAA +short

Query Mail Exchange Servers (MX Records)

Critical for diagnosing email delivery issues:

dig example.com MX +noall +answer

Query SPF, DKIM, and Verification Tokens (TXT Records)

dig example.com TXT +short

Query Authoritative Nameservers (NS Records)

dig example.com NS +short

Step 3: Querying Specific Nameservers Directly (@ Syntax)

When you update DNS records at your domain registrar, local ISP caches often delay showing the new records due to lingering TTLs. To verify whether the record has successfully updated on authoritative public resolvers without waiting for local cache expiration, prefix the target DNS server with an @ symbol:

Query Google Public DNS (8.8.8.8)

dig @8.8.8.8 example.com A +short

Query Cloudflare Public DNS (1.1.1.1)

dig @1.1.1.1 example.com A +short

Query Your Domain’s Authoritative Nameserver Directly

dig @ns1.cloudflare.com example.com A +short

Querying the authoritative nameserver directly provides ground truth: if the record resolves correctly here, your configuration is valid, and public propagation is simply a matter of time.

Step 4: Tracing the Entire DNS Resolution Path (+trace)

When diagnosing complex routing failures, you can instruct dig to perform an iterative trace from the internet’s root nameservers down to the final authoritative answer:

dig example.com +trace

This command queries the 13 global root DNS servers, follows delegations to the Top-Level Domain (TLD) nameservers (like .com or .org), and terminates at your authoritative nameserver, displaying every single delegation step and response latency along the way.

Frequently Asked Questions

What does +short do in dig?

The +short option strips all headers, query sections, and diagnostic footers, outputting purely the raw answer IP address or text string. It is ideal for clean output inside bash scripts.

How do I perform a reverse DNS lookup (rDNS) with dig?

Use the -x flag followed by the IP address: dig -x 8.8.8.8 +short. This queries the PTR record to find the hostname associated with that IP address.