Query DNS with dig

dig is the tool I reach for whenever DNS is involved. It shows you the raw response, with nothing hidden.

Let’s ask for an address record:

dig A flaviocopes.com

Read the whole response

The output looks noisy at first. Don’t shorten it yet. Every section is evidence:

• status: NOERROR, NXDOMAIN, SERVFAIL, or another result code
• flags: aa means the answer came from an authoritative server, ra means the responding server offers recursion
• ANSWER SECTION: the records that answer your question
• AUTHORITY SECTION: delegation info, or the SOA when the answer is negative
• SERVER: which resolver replied
• Query time: how long the request took

The number next to each record in the answer section is the remaining TTL in seconds. A recursive resolver counts it down while the answer sits in its cache.

One thing to remember: NOERROR doesn’t mean you got records. The name may exist without an A record. Check the answer count too.

When to use +short

+short prints only the values:

dig A flaviocopes.com +short

It’s handy in scripts and for a quick glance. But it throws away the status, the flags, the authority section, and the server. When something is wrong, +short hides the reason.

Ask a specific resolver

Put a resolver after @ to bypass your default one. This is how you compare caches:

dig @1.1.1.1 A flaviocopes.com +short
dig @8.8.8.8 A flaviocopes.com +short

If Cloudflare and Google disagree, one of them has an older cached answer.

Pick the sections you want

Between the full output and +short there’s a middle ground. Turn everything off, then turn back on what you need:

dig A flaviocopes.com +noall +answer +comments

You get the answer records with their TTLs, plus the header with status and flags. That’s my usual format.

After a change

If two resolvers disagree after you edited a record, don’t keep hitting refresh in the browser. Compare their remaining TTLs, then ask an authoritative server directly. The browser tells you almost nothing. dig tells you exactly who has which answer and for how long.

Try this: run one full dig query and note the status, flags, answer, TTL, server, and query time. Then run the same query with +short and list every piece of evidence that disappeared.