s0sta
EN NL عربي
Filters
Zo zoek je
  • Gewone woorden vinden namen, teksten en voorbeelden.
  • "twee woorden" vindt precies die zin.
  • --naam of -x vindt een optie.
  • #woord zoekt alleen in commando's.
  • @grep vindt lessen en labs die grep gebruiken.
  • Filters: cat:network · in:labs · in:notes · level:rhcsa · ch:8 · root:yes. Zet ! voor een woord om het weg te laten. OR tussen woorden betekent één ervan.
  • ↑ ↓ bewegen · Enter openen · Esc sluiten · / zoeken

dig

Ask DNS servers for records (A, AAAA, MX, TXT, NS …) and show the full answer — the main DNS test tool.

Niveau
Dagelijks Linux
Groep
Netwerk
Root nodig
Nee
Pakket
bind-utils

Dit deel is nog niet vertaald. Je ziet de Engelse tekst.

Wat het doet

dig NAME TYPE @SERVER sends a DNS query and prints the question, the answer, the authority section and statistics (server, time). Without a server it uses the servers in /etc/resolv.conf.

Options with + change the query and the output: +short gives only the answer, +trace follows the delegation from the root servers. dig asks DNS only — not /etc/hosts; use getent hosts to see what programs get.

Zo schrijf je het

dig [@SERVER] [NAME] [TYPE] [CLASS] [OPTION]... [+QUERY-OPTION]...
dig -x ADDRESS

Belangrijkste delen

@SERVER
The DNS server to ask (name or IP).
NAME
The name to look up.
TYPE
Record type: A, AAAA, MX, NS, TXT, CNAME, SOA, PTR, SRV, CAA, ANY …

Opties 42

Meest gebruikt

Options

-x ADDR
Reverse lookup (PTR) of an IP address.
-t TYPE
Record type.
-q NAME
The name (useful when it looks like an option).
-c CLASS
Class (IN is default).
-p PORT
Use another port.
-4
Use IPv4 for the transport.
-6
Use IPv6 for the transport.
-b ADDRESS[#PORT]
Send from this source address.
-f FILE
Read many queries from a file.
-k KEYFILE
TSIG key file.
-y [HMAC:]NAME:SECRET
TSIG key on the command line.
-r
Do not read ~/.digrc.
-u
Times in microseconds.
-m
Memory debugging.
-h
Show help.
-v
Show the version.

Query options (+)

+short
Only the answer data.
+trace
Follow the delegation from the root servers down.
+noall +answer
Show only the answer section.
+norecurse
Ask without recursion (test a server's own data).
+dnssec
Ask for DNSSEC records.
+tcp
Use TCP instead of UDP.
+time=T
Timeout in seconds.
+tries=N
Number of tries.
+retry=N
Number of retries.
+nssearch
Ask every authoritative server for the SOA.
+multiline
Long records on more lines.
+stats, +nostats
Show or hide the statistics.
+question, +answer, +authority, +additional, +comments
Show or hide these sections (with +no… to hide).
+cmd, +nocmd
Show or hide the first line.
+ttlunits
TTL in readable units.
+nsid
Ask the server for its ID.
+subnet=ADDR/LEN
Send an EDNS client subnet.
+bufsize=B
EDNS buffer size.
+edns=N, +noedns
EDNS version or no EDNS.
+cd
Checking disabled (no DNSSEC validation).
+ad
Ask for the authenticated data flag.
+tls
DNS over TLS.
+https
DNS over HTTPS.
+yaml
YAML output.
+identify
Show the server for +short answers.

Voorbeelden 12

$ als gewone gebruiker# als root (of met sudo)

  1. 1Look up an address

    dig www.redhat.com +short
www.redhat.com.edgekey.net.
e3396.dscx.akamaiedge.net.
23.40.100.73

    CNAMEs first, then the IP.

  2. 2Ask a chosen server

    dig @192.168.122.1 server2.example.com

    Compare servers when only some clients fail.

  3. 3Only the answer section

    dig example.com MX +noall +answer
example.com.  3600  IN  MX  10 mail.example.com.

    Name, TTL, class, type, data.

  4. 4Reverse lookup

    dig -x 192.168.122.20 +short
server2.example.com.

    Mail servers and SSH logs use reverse DNS.

  5. 5Follow the delegation

    dig +trace s0sta.com

    Shows root → .com → your name servers; finds wrong NS records.

  6. 6Check mail security records

    dig s0sta.com TXT +short; dig _dmarc.s0sta.com TXT +short

    SPF and DMARC protect against spoofed mail.

  7. 7Check the name servers and SOA

    dig s0sta.com NS +short; dig s0sta.com SOA +short

    The SOA serial must grow after every zone change.

  8. 8See the TTL before a migration

    dig www.s0sta.com A +noall +answer +ttlunits

    Lower the TTL a day before you change the IP.

  9. 9Check DNSSEC

    dig s0sta.com A +dnssec +multiline

    RRSIG records show that the zone is signed.

  10. 10Test a server's own data

    dig @ns1.example.com example.com SOA +norecurse

    An authoritative server must answer without recursion.

  11. 11Find open resolvers (security, own servers only)

    dig @203.0.113.10 www.google.com +short

    Your public DNS server should not answer for other domains.

  12. 12Many names from a file

    dig -f names.txt +short

    One name per line.

Let op

  • dig ignores /etc/hosts. A name can work in a browser and fail in dig (or the other way).
  • The answer may come from a cache: check the TTL.

Bestanden

/etc/resolv.conf
Default DNS servers and search domains.
~/.digrc
Default dig options.

Exitcodes

0 :: An answer came (also NXDOMAIN). 1 :: Wrong syntax. 8 :: Could not open the batch file. 9 :: No reply from the server. 10 :: Internal error.

Volledige handleiding

Deze pagina legt het commando uit in eenvoudige woorden. De originele handleiding heeft elk detail.

In je terminal: man dig

Open de man-pagina (linux.die.net)bind9.readthedocs.io