dig Cheat Sheet

DNS lookup utility for querying record types, tracing resolution, and debugging DNSSEC.

Reconnaissance & OSINTdnsrecordstroubleshootingUpdated 2026-06-02

Overview

dig (Domain Information Groper) queries DNS servers for A, AAAA, MX, TXT, NS, CNAME, PTR, SRV, and other records. Essential for manual verification after automated enum and for AD/internal DNS analysis.

Authorized testing only. Querying internal DNS may reveal sensitive hostnames—handle logs and data per engagement NDA.

Install

bind9-utils / dnsutils

sudo apt install -y dnsutils

dig -v

Essential commands

A record (short answer)

dig +short target.example.com A

Any record type

dig target.example.com MX

dig target.example.com TXT

Specific resolver

dig @8.8.8.8 target.example.com

Reverse DNS

dig +short -x 10.10.10.5

Common workflows

Zone transfer attempt —

dig axfr @ns1.target.example.com target.example.com

dig axfr target.example.com @ns1.target.example.com +authority

Trace resolution path —

dig +trace target.example.com

DNSSEC validation —

dig target.example.com +dnssec

dig DNSKEY target.example.com +multi

SRV / AD records —

dig +short _ldap._tcp.dc._msdcs.corp.local SRV

dig +short _kerberos._tcp.corp.local SRV

Batch from file —

while read h; do dig +short "$h" A; done < hosts.txt

Flags reference

`@server`	Query specific nameserver
`+short`	Minimal output
`+trace`	Iterative resolution from root
`+dnssec`	Request DNSSEC records
`-x`	Reverse lookup for IP
`+tcp`	Use TCP (large responses, AXFR)
`+noall +answer`	Clean answer section only
`-4 / -6`	Force IPv4 or IPv6
`-f filename`	Batch queries

Tips

Use +tcp for zone transfers (axfr)—many servers require TCP for AXFR.
Compare results from authoritative NS vs public resolver to spot split-horizon DNS.
dig -t ANY is often blocked or deprecated—query specific types.
Pair with host and nslookup for quick checks; dig is most scriptable.