dig and nslookup are the essential command-line tools for diagnosing DNS issues — this guide covers practical usage patterns for common troubleshooting scenarios.
Basic dig Usage
dig yourdomain.comReturns the A record and relevant details — the ANSWER SECTION shows the actual resolved IP address(es).
Querying a Specific Record Type
dig yourdomain.com MX
dig yourdomain.com TXT
dig yourdomain.com NS
dig yourdomain.com AAAAQuerying a Specific DNS Server Directly
dig @8.8.8.8 yourdomain.comUseful for checking what a specific resolver (like Google's public DNS) currently returns, bypassing your local/ISP resolver's potentially cached answer.
Getting a Concise Answer Only
dig +short yourdomain.comTracing the Full Resolution Path
dig +trace yourdomain.comShows the complete resolution process from the root servers down through TLD servers to your domain's authoritative nameservers — useful for diagnosing delegation issues.
Checking DNSSEC Validation
dig +dnssec yourdomain.comSee How to Set Up DNSSEC for Your Domain for interpreting the results.
Basic nslookup Usage
nslookup yourdomain.comA simpler, more universally available alternative to dig, though generally with less detailed output.
Querying a Specific Record Type with nslookup
nslookup -type=MX yourdomain.comReverse DNS Lookup
dig -x 203.0.113.10nslookup 203.0.113.10Looks up the PTR record for a given IP address — useful for verifying reverse DNS configuration, relevant to email deliverability.
Checking TTL Values
dig yourdomain.comThe TTL value appears alongside each returned record in the ANSWER SECTION — useful for understanding current caching behavior (see Understanding DNS Propagation and TTL).
Diagnosing "Domain Not Resolving" Issues
- Check if the domain resolves at all:
dig yourdomain.com - Verify the correct nameservers are set:
dig yourdomain.com NS - Query the authoritative nameserver directly:
dig @ns1.yourdomain.com yourdomain.com - Check from a different resolver to rule out local caching:
dig @1.1.1.1 yourdomain.com
Checking Email-Related DNS Records
dig yourdomain.com MX
dig yourdomain.com TXT | grep spf
dig _dmarc.yourdomain.com TXTUseful when troubleshooting email deliverability issues, checking that SPF, DKIM, and DMARC records are correctly published.
Common Errors
"connection timed out" or "no servers could be reached" — indicates a network connectivity issue reaching DNS servers themselves, separate from the domain's actual DNS configuration; check basic network connectivity first.
Continue Reading
- Understanding DNS Propagation and TTL
- Common DNS Errors and How to Fix Them
- DNS Fundamentals: A, AAAA, CNAME, MX, TXT & NS Records Explained
Browse more articles in Networking & DNS.
