How to Install and Use drill in Linux for Advanced DNSSEC and DNS Query Troubleshooting

For decades, network engineers and system administrators troubleshooting DNS resolution issues in Linux relied on the classic BIND dig utility. While dig remains ubiquitous, modern secure DNS infrastructures increasingly mandate DNSSEC (DNS Security Extensions) verification to protect against cache poisoning, rogue BGP hijacks, and man-in-the-middle DNS spoofing.

drill is a modern DNS lookup utility developed by NLnet Labs as part of the ldns library. Specifically designed with native DNSSEC validation at its core, drill mimics familiar dig syntax while providing significantly superior tools for tracing cryptographic root anchors, inspecting DS and RRSIG records, and debugging recursive delegation chains. This guide demonstrates how to install and use drill on Linux.

Installing drill on Linux

Drill is included in the package managers of all major distributions via the ldnsutils package:

On Ubuntu / Debian

sudo apt update && sudo apt install ldnsutils -y

On Fedora / RHEL

sudo dnf install ldns-utils -y

On Arch Linux

sudo pacman -S ldns

Basic DNS Lookups with drill

1. Querying Specific Resource Records

# Query A records
drill example.com A

# Query MX mail records
drill example.com MX

# Query specific nameserver
drill @1.1.1.1 example.com AAAA

Advanced DNSSEC Cryptographic Validation

1. Validating DNSSEC Signatures with Local Root Keys

To verify the authenticity of an answer against root trust anchors, fetch the root DS keys and validate the cryptographic RRSIG record:

# Query with DNSSEC OK (DO) flag and signature validation
drill -D -k /etc/trusted-key.key example.com A

The -D flag instructs drill to perform client-side signature verification, printing [SECURE] when the Merkle cryptographic chain is valid, or [INSECURE] / [BOGUS] if a signature mismatch is detected.

2. Tracing Root Delegation Chains Iteratively

To inspect the entire delegation path from the root servers (.) down through top-level domain (TLD) authoritative servers to the final host:

drill -T example.com

The -T flag traces each iterative hop, displaying exact response latency, queried NS records, and returned glue records.

Comparison: dig vs drill

Feature	Traditional dig (BIND)	drill (ldns)
DNSSEC Validation	Displays RRSIG records only	Full client-side signature chain validation
Library Footprint	Tied to large BIND9 codebase	Lightweight C library (ldns)
Iterative Trace Mode	Supported (+trace)	Supported (-T) with detailed delegation logs