dig Command Examples: 25 Tested DNS Troubleshooting Commands

A DNS incident is easier to diagnose when each query has a job. This page gives 25 commands that were actually run against public domains, with excerpts of their output. The commands are arranged around the decisions an on-call engineer makes: record or name, cache or authority, delegation or signature. The command output is a snapshot, so rerun it for your domain.

Read the response code before the value

Start with the long answer when the outcome is uncertain. In our capture, dig +short enterno.io AAAA and the CAA query returned no stdout, both with exit code 0. That alone does not say whether the name is missing, the type has no records, or a resolver failed. Run the query again with +comments +answer and read status. A recursive A response in this capture was NOERROR and contained 81.163.20.249.

$ dig +noall +comments +answer enterno.io A
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 34558
;; flags: qr rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 1
# … omitted OPT pseudo-section
;; ANSWER SECTION:
enterno.io. 2989 IN A 81.163.20.249

The value 2989 was the remaining TTL in one cached response, not a promise that every resolver would show the same number. A direct query to an authoritative server returned TTL 3600 and the aa flag. The TTL migration guide explains when a cached answer can outlive a change; the record reference covers the meaning of each type.

Pick a query for the failure you see

The table is a field map, not a list of flags to paste blindly. First ask for the record you expect. Compare at least two recursive resolvers if users disagree. Query the authoritative servers when the caches disagree or when you need to know what the zone serves now. For delegation, compare the parent with the child. For DNSSEC, inspect the chain and validation behavior separately.

Three blank or redirected outputs deserve attention. dig -v printed its version to stderr. An empty AAAA or CAA answer in short mode did not imply a command failure. A +trace response spanned several referrals, so the table shows the route rather than pretending its last line is the whole story. The raw output and exit codes are kept in the measurement file.

Separate a stale cache from a bad zone

For enterno.io, 1.1.1.1, 8.8.8.8, and 9.9.9.9 returned the same A address in this capture. The two authoritative nameservers also returned that address. If one recursive resolver differs while the authoritative pair agrees, check its remaining TTL and the time of the last change. If the authoritative pair differs, inspect the DNS provider’s zone distribution before waiting for caches to expire.

Use Enterno DNS lookup for a quick visible record check, then confirm any disputed result with dig @nameserver +norecurse. A resolver comparison helps show whether the discrepancy is regional. It does not tell you what a user’s local router, browser, or corporate resolver has cached. For that, run the same command from the affected network.

Trace delegation at the parent

The parent zone controls which nameservers the rest of DNS will ask. In our capture, a0.nic.io listed dns1.yandex.net and dns2.yandex.net for enterno.io. The child zone listed the same pair, although the order differed. Compare them as sets. If they disagree, inspect both the registrar delegation and the zone’s NS records; editing a child NS record alone does not update the parent.

dig +trace enterno.io NS shows where a referral changes or stops. Read each transition, especially the final move from the TLD to the child. A trace is useful for locating a broken delegation; it is not a full zone inventory. See the DNS resolution runbook when an authoritative server is not answering at all.

DNSSEC needs a validator, not a longer answer

The signed cloudflare.com example returned a DS record and a DNSKEY. A query to 1.1.1.1 with +dnssec returned the ad flag; the +cd query returned cd. These observations show two resolver behaviors in one healthy case. They do not reproduce a broken signature. The distinction matters: +dnssec asks for DNSSEC data, while ISC’s delv validates a chain using BIND’s validation code. The protocol rules are in RFC 4035.

If the ordinary query returns SERVFAIL but the +cd query returns data, investigate DS, DNSKEY, and signatures. If both fail, DNSSEC is only one hypothesis. The DNSSEC guide covers the chain; this cheat sheet tells you which command establishes which observation.

Do not use ANY as a zone export

ANY asks about one name and does not guarantee all its record types. RFC 8482 allows a responder to return a subset or a minimal response. Query A, AAAA, MX, NS, SOA, TXT, and CAA explicitly for known names. If you need every name in a zone, export it through the DNS provider or its API. The exact dig option behavior is documented by ISC.

How we tested

We ran 25 commands on 13 November 2026 from srv2029141.hstgr.cloud with DiG 9.18.33. The capture script records argv, stdout, stderr, and exit code in data.json; all 25 exited 0. The public targets were enterno.io, cloudflare.com, and 1.1.1.1. No customer domains or account data were used. DNS answers change over time, so the values and TTLs must be rechecked before publication. The article is based on measured output and primary sources; full command output is retained in the editorial archive.

Frequently asked questions

Why does dig +short return nothing?

Short mode hides the response code. Repeat with +noall +comments +answer and distinguish NOERROR with no matching type (usually NODATA; inspect CNAME and authority sections) from NXDOMAIN or SERVFAIL. Do not infer a broken domain from an empty AAAA or CAA query alone.

What does the aa flag mean?

The responding server marked its answer authoritative. Query a nameserver for the zone directly with +norecurse to inspect what it serves now. A recursive resolver may return the same record without aa because it answered from cache.

Does dig +dnssec verify a signature?

No. It requests DNSSEC records. Use a validating resolver and delv to examine the chain; compare an ordinary answer with +cd when troubleshooting validation failures.

Can I list every DNS record with dig ANY?

No. ANY does not enumerate every name in a zone and may return only some types at one name. Ask for specific types, and use the provider’s zone export for complete inventory.

Sources

• RFC 2308 negative DNS responses
• ISC BIND 9 dig manual
• ISC dig and delv
• RFC 4035 DNSSEC protocol
• RFC 8482 minimal ANY responses