📞 The dig phonebook

A navigation index of every dig and nslookup command covered in this wiki, gathered onto one page and sorted by what you are trying to see. The lookups point at the live demo zone (example.isitdns.net and the isitdns.net apex) or at a stable public anchor (Cloudflare's 1.1.1.2 reverse, the permanently-broken dnssec-failed.org, the root). Each entry links to the source page that walks the same lookup through its full annotated output.

Tools note: check your build with dig -v. Older system builds (the macOS system dig, still 9.10.6 as of mid-2026) have no +https and do not know the HTTPS type by name. Where a record needs newer tooling or the AD bit, the phonebook gives you a curl DoH form that works from any machine. See nslookup-and-dig for the tool-by-tool reference and dot-doh for encrypted transport.

Records#

The bread and butter: one query per record type, each pointing at a live demo record. Per-type deep dives live under the record-type cheat sheet.

nslookup -type=A    example.isitdns.net 1.1.1.1
nslookup -type=AAAA example.isitdns.net 1.1.1.1
nslookup -type=CNAME cname.example.isitdns.net 1.1.1.1
nslookup -type=MX   mx.example.isitdns.net 1.1.1.1
nslookup -type=TXT  txt.example.isitdns.net 1.1.1.1
nslookup -type=CAA  caa.example.isitdns.net 1.1.1.1
nslookup -type=SRV  _xmpp-server._tcp.example.isitdns.net 1.1.1.1
nslookup -type=NS   isitdns.net 1.1.1.1
nslookup -type=SOA  isitdns.net 1.1.1.1
nslookup -type=SSHFP sshfp.example.isitdns.net 1.1.1.1
nslookup -type=TLSA _443._tcp.tlsa.example.isitdns.net 1.1.1.1
nslookup -type=TYPE65 svcb.example.isitdns.net 1.1.1.1

Zones and transfer#

Walking the apex, poking authoritative servers directly, and the transfer commands. An authoritative server answers an iterative (RD=0) query for a name inside a zone it serves straight from its zone data: the aa bit is set and ra is not (RFC 1035 section 4.1.1). A referral to a delegated child, like the probe.isitdns.net NS lookup below, legitimately comes back without aa: the parent is pointing you at the child's servers, not answering from its own data. A direct @server query that comes back with ra set and no aa is a sign that something on the path answered in the server's place, but on its own it is not proof: REFUSED is also the normal reply from a real authoritative server for a zone it does not serve, and SERVFAIL can be a genuine server failure. Before concluding anything, run the same query over an encrypted transport (dot-doh) and compare; see the warning below.

DNSSEC#

The signed-zone chain, and the permanently-broken anchor that proves validation works. isitdns.net is signed (algorithm 13, ECDSAP256SHA256); dnssec-failed.org is a public zone that is deliberately, permanently BOGUS.

curl -s -H 'accept: application/dns-json' \
  'https://cloudflare-dns.com/dns-query?name=isitdns.net&type=A'

Encrypted transport (DoT / DoH / DoQ)#

An older system dig (like macOS's 9.10.6) cannot speak DoH or DoT, so the portable path is curl against a DoH JSON endpoint. dig +https needs 9.18+; kdig covers DoT and DoQ. Background and the kdig recipes live on dot-doh.

curl -s -H 'accept: application/dns-json' \
  'https://cloudflare-dns.com/dns-query?name=txt.example.isitdns.net&type=TXT'

Reverse DNS#

IP back to name. The 1.1.1.2 and 2606:4700:4700::1111 reverses are stable public Cloudflare records, so the lookups answer live. The full tree walk is on reverse-dns.

nslookup 1.1.1.2 1.1.1.1
nslookup -type=PTR 2.1.1.1.in-addr.arpa 1.1.1.1
nslookup 2606:4700:4700::1111 1.1.1.1

Troubleshooting: when it actually is DNS#

The checks that tell a real DNS failure apart from something wearing a DNS costume. Each one pairs with a live failure on when-its-dns.

Just for fun#

The demo zone hides a few TXT records that draw ASCII art. Each one is an ordinary one-line TXT value with ~ standing in for the line breaks (past 255 bytes the wire format also chunks it into extra strings, as the hangman shows), and the front-page dig tool unfolds them. Plain dig shows the folded line; the tool draws the picture.

See also#

• The dig-along: every record type, live, one query at a time
• dig flag reference: what each +flag does and how to read a response
• Live examples: DNSSEC, NXDOMAIN, ECS, encrypted DNS, annotated
• nslookup and dig: the two tools, side by side
• When it actually is DNS: the failures people blame on DNS
• Record type cheat sheet · DNSSEC · Encrypted DNS · Reverse DNS
• Wireshark DNS filters: when even dig +qr is not enough