Dig Command (reprint)

Dig command use Daquan (domain name query on Linux)

It can be said that the process of translating this document is my re-learning the process of DNS, Dig command can help us learn the principle of DNS, configuration,
As well as its query process. The previous use of dig only to query a record or MX record, now found that its function is not generally strong. Hope
This article is not very good for English friends in the use of Linux and DNS some help.
The official source of this howto is http://www.madboa.com/geek/dig/.
Because this document appears earlier, some of the examples in this article may be inconsistent with the results that are queried in the actual query process, but
To ensure that the translation is consistent with the author's original text, and I have not made any changes to the content.
In addition, because my English and Chinese are not so good, some content may be translated not very smooth or lied, I hope the Master to guide
or by email. Thank you!
Victor Chen ([email protected])
6/22/2008 translation

Dig Introduction:
Dig is a tool that queries DNS for information such as NS Records, A records, MX records, and so on in Unix-like command-line mode. Because it has been missing
Dig man page document, this article right when a Dig use the wizard.
Dig's source code is part of the ISC bind package, but most of the files that compile and install bind do not include it, but the Linux system
System, it is usually a part of a package, under Gentoo is Bind-tools, under Redhat/fedora is bind-utils, or in
Under Debian is dnsutils.
If you are looking for information about bind configuration, you should refer to my article: Bind for the mall LAN
(http://www.madboa.com/geek/soho-bind/).
Read the default output:
The simplest and most common query is to query a host, but by default, the output information for dig is verbose. You may not need all the output,
But it does deserve to know.

=======================================================================

The following is a query with comments:
$ digwww.isc.org
Above is the command line where I call dig.
; <<>> DiG 9.2.3 <<>> www.isc.org
;; Global Options:printcmd
The partial output of the dig tells us some information about its version 9.2.3 and the global Settings option if +nocmd on the command line
Is the first parameter, then this part of the output can be +nocmd by adding a query.
;; Got Answer:
;; ->>header<<-opcode:query, Status:noerror, id:43071
;; Flags:qr Rd RA; Query:1, Answer:1, Authority:3, Additional:3
Here, Dig tells us some technical information returned from DNS, this information can be used to control the display with the option +[no]comments, but careful
, it is also possible to turn off some other options by banning comments.
;; QUESTION section:
; www.isc.org. In A
In this query section, dig shows the output of our query, the default query is to query a record, you can display or prohibit the use of these +[no]
Question Options
;; ANSWER section:
www.isc.org. In A 204.152.184.88
Finally, we get the results of our query. Www.isc.org's address is 204.152.184.8, I don't know why you prefer to filter it out.
These outputs, but you can keep these options with +[no]answer.
;; Authority section:
isc.org. 2351 in NS ns-int.isc.org.
isc.org. 2351 in NS ns1.gnac.com.
isc.org. 2351 in NS ns-ext.isc.org.
This authoritative note tells us which DNS server provides authoritative answers to us. In this example, Isc.org has 3 name servers, and you
This output can be preserved with the +[no]authority option.
;; ADDITIONAL section:
ns1.gnac.com. 171551 in A 209.182.216.75
ns-int.isc.org. 2351 in A 204.152.184.65
ns-int.isc.org. 2351 in AAAA 2001:4f8:0:2::15
These additional options are representative of the IP addresses of the authoritative DNS listed, which can be reserved with the +[no]additional option.
;; Query time:2046 msec
;; server:127.0.0.1#53 (127.0.0.1)
;; When:fri 27 08:22:26 2004
;; MSG SIZE rcvd:173
The last section of the default output contains the statistics of the query, which can be reserved with +[no]stats.

===========================================================================

What can we inquire about?
Dig allows you to effectively query DNS, the most commonly used queries are A records, TXT (text comments), MX records, NS records, or any combination of queries.

Find a record for yahoo.com: (This must be a domain and not a host, as our company is xinpindao.com)
Dig yahoo.com A +noall +answer

To find a list of yahoo.com MX records:
Dig yahoo.com MX +noall +answer

To find the authoritative DNS for yahoo.com:
Dig yahoo.com NS +noall +answer

Query all of the above records:
Dig yahoo.com any +noall +answer

In this case, you can also use the AAAA option to query the host's IPv6 AAAA record for this IPv4 and IPV6 mix:
Dig www.isc.org AAAA +short
If the domain you want to query allows forwarding, you can also query the relevant information, such as DNS records on the Internet life cycle, but now
In only a few DNS allow unrestricted forwarding.

How do we check? Get a streamlined answer?
When we need a quick answer, the +short option is your best friend:
Dig www.isc.org +short
204.152.184.88

Get an answer that's not very concise?
Streamlining answers is not the same as just one answer,

The way to get a detailed answer without additional information is to use the +noall option so that only the output you want is preserved.
Here is a thin query with only one answer, and finally contains all the configuration information, including TTL data, formatted BIND configuration information.
$ dig fsf.org mx +short
Mx20.gnu.org.
Mx30.gnu.org.
Ten mx10.gnu.org.
$ dig +nocmd fsf.org mx +noall +answer
fsf.org. 3583 in MX mx30.gnu.org.
fsf.org. 3583 in MX mx10.gnu.org.
fsf.org. 3583 in MX mx20.gnu.org.

get a detailed answer?
Through its man page, you can get a lengthy multiline mode with a user-friendly annotated DSN SOA record through the +multiline option, in general,
The information obtained with the +multiline option can be displayed a lot, just like the bind configuration file.
$ dig +nocmd ogi.edu any +multiline +noall +answer
ogi.edu. 14267 in A 129.95.59.31
ogi.edu. 14267 in MX 5 cse.ogi.edu.
ogi.edu. 14267 in MX hermes.admin.ogi.edu.
ogi.edu. 14267 in SOA zeal.admin.ogi.edu. Hostmaster.admin.ogi.edu. (
200408230; Serial
14400; Refresh (4 hours)
900; Retry (minutes)
3600000; Expire (5 weeks 6 days hours)
14400; Minimum (4 hours)
)
ogi.edu. 14267 in NS zeal.admin.ogi.edu.
ogi.edu. 14267 in NS cse.ogi.edu.
ogi.edu. 14267 in NS fork.admin.ogi.edu.

Find PTR records?
You can use the-X option to find the host name of an IP address.
$ dig-x 204.152.184.167 +short
Mx-1.isc.org.
In this loop, the script has the flexibility to map the name in the given subnet.
#!/bin/bash
net=18.7.22
For n in $ (seq 1 254); Do
Addr=${net}.${n}
Echo-e "${addr}\t$ (dig-x ${addr} +short)"
Done

Query a different naming server?
The query commands are as follows:
Dig @ns1. Google.com www.google.com
Use the record query inside the/etc/resolv.conf
The host will automatically query DNS records from the/etc/resolv.conf file
$ host www
Www.madboa.com has address 65.102.49.170
However, by default, dig produces some unexpected output. If you want to query the local hostname instead of the full domain name, use the
+search Options
Dig www +search

handle most of the queries?
If you want to query a large number of host names, you can store them in a text file (one record line), using the dig with the-f parameter to
Second query.
# Querying a large number of host names
Dig-f/path/to/host-list.txt
# The same, more explicit output
Dig-f/path/to/host-list.txt +noall +answer
But I have to tell you that the dig 9.2.3 and later versions do not support the use of the-f option to reverse the query.
Verifying DNS Mappings
Incorrect DNS configuration can cause you a lot of distress, and there are two ways to verify your DNS configuration:
1. Each hostname should be resolved to an IP address, and that IP address should also be directed back to that host name.
2. If an address on your subnet is directed to a hostname, the host name must also point to that IP.
For these two rules, there are some exceptions, such as the CNAME should first resolve to a different host name, and can only point to an IP
, sometimes multiple host names point to the same IP address, but that IP can have only one PTR record.
In summary, these help you check whether your DNS mappings work as you think.
You can also write a test script to write your known hostname, as shown below, and the content is simple; when it executes, when it snaps to a CNAME, it
will be interrupted if multiple host names point to the same IP address it will error. Let's say this file contains your hostname called named-hosts.
。
#!/bin/bash
#
# test DNS Forward-and reverse-mapping
#
# edit this variable to reflect local class C subnet (s)
nets= "192.168.1 192.168.2"
# Test name to address to name validity
Echo
Echo-e "\tname, address and name"
Echo '----------------------------------'
while read H; Do
addr=$ (Dig $H +short)
If Test-n "$ADDR"; Then
host=$ (dig-x $ADDR +short)
if test "$H" = "$HOST"; Then
Echo-e $HOST, $ADDR, ok\t$h
Elif test-n "$HOST"; Then
Echo-e $HOST, $ADDR, fail\t$h
Else
Echo-e "Fail\t$h $ADDR [Unassigned]"
Fi
Else
Echo-e "fail\t$h [Unassigned]"
Fi
Done < named-hosts
# Test address to name to address validity
Echo
Echo-e "\taddress, name-and-Address"
Echo '-------------------------------------'
For NET in $NETS; Do
For n in $ (seq 1 254); Do
A=${net}.${n}
host=$ (dig-x $A +short)
If Test-n "$HOST"; Then
addr=$ (Dig $HOST +short)
if test "$A" = "$ADDR"; Then
Echo-e $ADDR, $HOST, ok\t$a
Elif test-n "$ADDR"; Then
Echo-e $ADDR, $HOST, fail\t$a
Else
Echo-e "fail\t$a $HOST [Unassigned]"
Fi
Fi
Done
Done

Interesting dig.
Create your own Named.root file
Any DNS server connected to the Internet will certainly have a copy of the InterNIC named.root file that lists the root of all the Internet
DNS, if you are not afraid of trouble, you can often download it from the InterNIC FTP server, or you can use the dig command
Create your own funky Named.root
# Compare with Ftp://ftp.internic.net/domain/named.root
Dig +nocmd. NS +noall +answer +additional
Your TTL value may be small here, but it's where you find the latest Named.root file!

Tracing the query path for dig
You may be a traceroute enthusiast and often like to see How to connect point B from point A. Then you can use the Dig +trace option to do something like
The matter.
Dig gentoo.de +trace
You can see the root DNS in the header section of the dig output, and then find the DNS that resolves all *.de, and finally find the gentoo.de domain name IP.

Get SOA Records
As a DNS administrator, I sometimes make some changes (to DNS configuration) and wonder if my DNS resolution is pushing or old data.
This +nssearch option provides clear statistics for your public servers.
# The Unvarnished truth
Dig cse.ogi.edu +nssearch
# the same, displaying only serial number and hostname
Dig cse.ogi.edu +nssearch | Cut-d '-f4,11

Interpreting TTL values
One of the reasons I love Google for many reasons is that it provides accurate links in my web logs, which makes it easy for me to point out
Which type of query leads people to access the pages of this site.
Unexpectedly, I've seen a lot of requests asking for a TTL value, and I never thought the TTL would be the most popular thing, but every day you
Are learning new things, so, in response to everyone's request, here a little bit about the TTL.
If you query the Internet address from local DNS, the server points out where to get the authoritative answer and get the address, once the server learns the answer, it
Save the answer in the local cache so that you can query the same address again later in the day, so that it will quickly get you from the cache
The answer is much faster than if you were to query the Internet again.
When domain administrators configure DNS records, they can determine how long this record can be stored in the cache, which is the TTL value (usually
Seconds to indicate).
Typically, the remote server typically stores only the TTL value for a recorded cache for a long time. After the time expires, the server refreshes its local cache and
Re-query an authoritative answer.
When you use dig to query a DNS server for a record, the server tells dig how long this record can remain in the cache.
For example, as written above, the TTL value of the MX record for the gmail.com domain is that the administrator of the 300s,gmail.com domain requires the remote server to slow
The MX record to save it cannot be higher than 5 minutes, so when you first query that record (gmail.com's MX record), Dig will tell you a 300
The TTL.
$ dig +nocmd gmail.com MX +noall +answer
gmail.com in MX gsmtp57.google.com.
gmail.com in MX ten gsmtp171.google.com.
If you check back for a while, you'll find that the TTL value is reduced to 280 (20s in interval).
$ dig +nocmd gmail.com MX +noall +answer
gmail.com. 280 in MX gsmtp171.google.com.
gmail.com. 280 in MX gsmtp57.google.com.
If your time is good enough, you will get the last surviving time of this record.
$ dig +nocmd gmail.com MX +noall +answer
gmail.com. 1 in MX ten gsmtp171.google.com.
gmail.com. 1 in MX gsmtp57.google.com.
After that, the DNS server you are querying will "forget" the answer to the question, and the next time you query this record, the entire loop will start (
In this example, 300s).

Under UNIX and Linux, it is recommended that you use the dig command instead of Nslookup. The function of the dig command is much more powerful than the nslookup, unlike Nslookkup, which has to set to set to go, blame trouble.

Here are some of the more commonly used commands for dig:
# The most basic usage of dig
Dig @server qianlong.com
# View Zone data transfer with dig
Dig @server qianlong.com AXFR
# View incremental transfer of zone data with dig
Dig @server qianlong.com Ixfr=n
# View reverse resolution with dig
Dig-x 124.42.102.203 @server
# Find an authoritative DNS server for a domain
Dig qianlong.com +nssearch
# Start tracking the parsing process of a domain name from the root server
Dig qianlong.com +trace
# See which F root DNS server you are using
Dig +norec @f.root-servers.net HOSTNAME. BIND CHAOS TXT
# View the version number of BIND
Dig @bind_dns_server CHAOS TXT version.bind

********************************
You can go to www.isc.org to download a version of BIND for Windows installation, you can use the Dig command on Windows after installation. ^O^
Ftp://ftp.isc.org/isc/bind/contrib/ntbind-9.3.0/BIND9.3.0.zip
*********************************
Use
DNS Query Utility.
Grammar
Dig [@server] [-B address] [-C class] [-f filename] [-k filename] [-n][-p port#] [-t type] [-X addr] [-y name:key] [name ] [Type] [class] [queryopt ...]
Dig [-h]
Dig [global-queryopt ...] [Query ...]
Describe
The dig (Domain Information Finder) command is a flexible tool for asking DNS domain name servers. It performs a DNS search that displays replies returned from the requested domain name server. Most DNS administrators use dig as a troubleshooting for DNS issues because of its flexibility, ease of use, and clear output. Although dig typically uses command-line arguments, it can also read a search request from a file in batch mode. Unlike earlier versions, the BIND9 implementation of dig allows multiple queries to be emitted from the command line. Unless instructed to request a specific domain name server, dig will attempt to/etc/resolv.conf all servers listed in the. When no command-line arguments or options are specified, the dig will be "." (root) executes the NS query.
Sign
-B Address Sets the source IP address to be queried. This must be a valid address on the host network interface.
The-C class default query class (in for Internet) is reset by option-C. Class can be any legal class, such as the HS class that queries Hesiod records or the CH class that queries Chaosnet records.
-f filename enables dig to run in batch mode and is processed by reading a series of search requests from the file filename. The file contains many queries, one per line. Each item in the file should be organized in the same way as the dig query using the command line interface.
-H when the option-H is used, a brief summary of command-line arguments and options is displayed.
-k filename to sign the DNS queries sent by dig and the responses to them using transaction signing (TSIG), specify the TSIG key file with option-K.
-N By default, use IP6. ARPA domain and RFC2874-defined binary designator search IPV6 address. To use an earlier RFC1886 method that uses the Ip6.int domain and nibble tags, specify option-N (Nibble).
-P port# If you need to query for a non-standard port number, use the option-P. port# is the port number that dig will send its query to, not the standard DNS port number 53. This option can be used to test a domain name server that has been configured on a non-standard port number to listen for queries.
-T type sets the type of the query. can be any valid query type supported by BIND9. The default query type is a, unless the-X option is provided to indicate a reverse query. You can request a zone transfer by specifying the type of AXFR. When an incremental zone transfer (IXFR) is required, the type is set to Ixfr=n. An incremental zone transfer will contain changes to the zone since the sequence number in the SOA record of the zone has been changed to N.
The-X addr Reverse query (maps addresses to names) can be simplified with the-x option. Addr is a IPv4 address or a colon-bounded IPv6 address that is bounded by a decimal point. When you use this option, you do not need to provide the name, class, and type parameters. Dig automatically runs a domain name query similar to 11.12.13.10.IN-ADDR.ARPA and sets the query type and class to PTR and in respectively.
-Y Name:key You can specify the TSIG key by using the-y option on the command line; name is the TSIG password, and key is the actual password. The password is a 64-bit cryptographic string, usually generated by Dnssec-keygen (8). Caution should be exercised when using option-Y on multi-user systems, because the password may be visible in the output of PS (1) or in the Shell's history file. When using both dig and TSCG authentication, the queried name server needs to know the password and decoding rules. In BIND, the implementation is implemented by providing the correct password and the server declaration in named.conf.
Parameters
Global-queryopt ... Global query options (see multiple queries).
Query query options (see query Options).
Query options
Dig provides the query option number, which affects the search method and results display. Some in the query request header settings or reset flag bits, part of the decision to display which reply information, other deterministic timeout and retry strategy. Each query option is identified by a keyword with a prefix (+). Some keywords to set or reset an option. The usual prefix is the string no that is the meaning of the Negation keyword. Other keywords assign values for each option, such as the time-out interval. They are formatted as +keyword=value. The query options are:
+[no]tcp
Use [Do not use] TCP when querying a domain name server. The default behavior is to use UDP, except for AXFR or IXFR requests, to use a TCP connection.
+[no]vc
Use [Do not use] TCP when querying the name server. +[NO]TCP's alternate syntax provides backward compatibility. VC stands for Virtual circuit.
+[no]ignore
Ignore the interrupt of the UDP response, not retry with TCP. TCP retries are run by default.
+domain=somename
Sets a search list that contains a single domain Somename, as if specified by a domain pseudo-directive in/etc/resolv.conf, and enables search list processing as if the +search option is given.
+[no]search
A search list that is defined using the [do not use] search list or domain pseudo-directives (if any) in resolv.conf. The search list is not used by default.
+[no]defname
Not recommended as a synonym for +[no]search.
+[no]aaonly
This option does nothing. It is used to provide compatibility with older versions of Dig that are set to not implement the parser flag.
+[no]adflag
Set the [not set] AD (real data) bit in the query. The current AD bit has standard meaning only in the response, but not in the query, but for completeness, this performance can be set in the query.
+[no]cdflag
Set the [Do not set] CD (check disabled) bit in the query. It requests that the server not run the DNSSEC legitimacy of the response information.
+[no]recursive
Switches the RD (requires recursive) bit setting in the query. This bit is set by default, which means that dig normally sends a recursive query. Recursion is automatically disabled when you use the query option +nssearch or +trace.
+[no]nssearch
When this option is set, Dig attempts to locate the authoritative domain name server that contains the network segment for which the name is to be searched and displays the SOA record for each domain name server in the network segment.
+[no]trace
Switch to the proxy path trace that is to be queried for the name starting from the root name server. Tracing is not used by default. Once tracing is enabled, Dig uses an iterative query to resolve the name to be queried. It displays the answer from each server that uses the resolve query, as referenced from the root server.
+[no]cmd
Sets the initial comment in the output that indicates the dig version and the query options used. Comments are displayed by default.
+[no]short
Provide a brief response. The default value is to display the reply information in a verbose format.
+[no]identify
When the +short option is enabled, the IP address and port number that provide the answer is displayed [or not displayed]. If a short format answer is requested, the source address and port number of the server providing the answer is not displayed by default.
+[no]comments
Toggle the comment line display in the output. The default value is to display a comment.
+[no]stats
This query option sets the display statistics: When the query is made, the size of the answer, and so on. The query statistics are displayed by default.
+[no]qr
Displays the query request that was sent [not displayed]. The default is not displayed.
+[no]question
When the answer is returned, the problem portion of the query request is displayed. The problem section is displayed by default as a comment.
+[no]answer
Displays the answer part of the [Do not show] answer. Displayed by default.
+[no]authority
Displays the permission portion of the [do not show] answer. Displayed by default.
+[no]additional
Displays an additional part of the [Do not show] answer. Displayed by default.
+[no]all
Sets or clears all display flags.
+time=t
Set the time-out for the query to T seconds. The default is 5 seconds. If T is set to a number less than 1, the query time-out is 1 seconds.
+tries=a
Set the number of retries to send a UDP query request to the server to a, instead of the default 3 times. If A is less than or equal to 0, 1 is used as the retry count.
+ndots=d
For full consideration, set the number of points that must appear in the name D. The default value is defined using the Ndots statement in/etc/resolv.conf, or 1 if there is no ndots statement. Names with fewer points are interpreted as relative names and searched by Domain pseudo-directives in the field or file/etc/resolv.conf in the search list.
+bufsize=b
Set the UDP message buffer size to B bytes using EDNS0. The maximum and minimum values for the buffers are 65535 and 0, respectively. Values beyond this range are automatically rounded to the nearest valid value.
+[no]multiline
Displays similar SOA-like records in a detailed multi-line format with readable annotations. The default value is to display a record on each individual line so that the computer resolves the output of the dig.
More than one query
Dig's BIND9 supports specifying multiple queries on the command line (additional features that support the-F batch file option). Each query can use its own flag bits, options, and query options.
In this case, in the command-line syntax described above, each query argument represents an individual query. Each one is made up of any standard options and flags, the name to be queried, the optional query type and class, and any query options that apply to the query.
You can also use the Global collection of query options that are valid for all queries. The global query option must precede the tuple of the first name, class, type, option, flag, and query options on the command line. Any global query option (except for the +[NO]CMD option) can be reset by the following query special option. For example:
Dig +qr www.isc.org any-x 127.0.0.1 isc.org ns +NOQR show dig How to do three queries from the command line: an arbitrary query for www.isc.org, a reverse query for 127.0.0.1, and an I NS record query for sc.org. The +QR Global query option is applied so that dig displays the initial query for each query. The last query has a local query option of +NOQR, which indicates that dig does not display the initial query when searching for NS records for isc.org.
Example
A typical dig call is similar to:
Dig @server name type where:
Server
Name or IP address of the name server you want to query. Can be a dot-delimited IPv4 address or a colon-delimited IPv6 address. When the server parameter is provided by the host, dig resolves that name before querying the nameserver. If no server parameters are available, dig reference/etc/resolv.conf, and then query the name servers that are listed there. Displays an answer from the domain name server.
Name
The name of the resource record that will be queried.
Type
Displays the type of query you want-any, A, MX, SIG, and any valid query type. If no type parameter is supplied, dig will execute a query against record A.
*********************************

Dig Command (reprint)