When diagnosing network issues or verifying website migrations, system administrators must frequently interact with the Domain Name System (DNS). If a website is failing to load, the problem might not be the web server itself, but rather a misconfigured DNS record pointing traffic to the wrong IP address.
While the older nslookup tool is still common, modern Linux professionals rely on the dig (Domain Information Groper) command. It provides significantly more detailed output, bypasses the operating system’s local DNS resolver by default, and is incredibly flexible for advanced troubleshooting.
The Basic dig Command
The dig utility is part of the bind-utils or dnsutils package, which is pre-installed on most major Linux distributions (like Ubuntu and CentOS). If you simply type the command followed by a domain name, it will query your system’s default DNS server for the domain’s ‘A’ record (the IPv4 address).
dig google.com
Press Enter. The output will contain several sections. The most important section is the ANSWER SECTION, which will show you the exact IP address the domain resolves to. The Query time at the bottom indicates how long the server took to respond, which is useful for diagnosing slow lookups.
How to Query Specific Record Types
By default, dig only asks for ‘A’ records. If you are configuring an email server, you need to check the MX (Mail Exchange) records. If you are setting up website verification, you might need to check TXT records.
To query a specific record type, simply append the type to the end of the command:
- MX Records (Email):
dig google.com MX - TXT Records (Verification/SPF):
dig google.com TXT - NS Records (Nameservers):
dig google.com NS - AAAA Records (IPv6 Address):
dig google.com AAAA - All Records (ANY):
dig google.com ANY
How to Query a Specific DNS Server
If you recently updated a DNS record and are waiting for it to propagate across the internet, your local internet provider’s DNS cache might still be serving the old IP address. You can use dig to bypass your local network and query a specific, authoritative server directly to see if the change was successful.
To specify a server, type the @ symbol followed by the server’s IP address, placed immediately after the dig command.
For example, to ask Google’s public DNS server (8.8.8.8) about a domain, use:
dig @8.8.8.8 digitash.com
To query Cloudflare’s public DNS (1.1.1.1) for MX records:
dig @1.1.1.1 digitash.com MX
How to Get a Clean, Short Output
The default output of dig is verbose, filled with technical headers, footers, and authority sections. If you are writing a bash script and only need the final IP address without the clutter, you can use the +short flag.
dig google.com +short
This command strips away all the formatting and prints only the raw answer (e.g., 142.250.190.46). This is incredibly useful for piping the output into other command-line tools like awk or grep.
How to Trace the DNS Path
If a domain is failing to resolve completely, you can force dig to map out the entire hierarchical lookup process, starting from the global root servers down to the authoritative nameserver.
dig +trace google.com
This will print a step-by-step path, allowing you to identify exactly which server in the global chain is failing to hand off the correct information.