dig is a command line tips for querying DNS name servers for information about host addresses, mail exchanges, name servers, and related information.
Understanding the default output
The most typical, simplest query is for a single host Command line tips. By default, however, dig is pretty verbose. You probably don’t need all the information in the default output, but it is probably worth knowing what it is. Below is an annotated query.
This article explains you how to do the data recovery from a crashed windows-plesk server.
[bash]
$ dig www.www.sparksupport.com
That is the command-line invocation of dig I used
; <<>> DiG 9.2.3 <<>> www.www.sparksupport.com
;; global options: printcmd
[/bash]
The opening section of dig’s output tells us a little about itself (version 9.2.3) and the global options that are set (in this case, printcmd). This part of the output can be quelled by using the +nocmd option, but only if it is the very first argument on the command line (even preceeding the host you are querying).
[bash]
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 43071
;; flags: qr rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 3, ADDITIONAL: 3
[/bash]
Here, dig tells us some technical details about the answer received from the DNS server. This section of the output can be toggled using the +[no]comments option, but beware that disabling the comments also turns off many section headers.
[bash]
;; QUESTION SECTION:
;www.www.sparksupport.com. IN A
[/bash]
In the question section, dig reminds us of our query. The default query is for an Internet address (A). You can turn this output on or off using the +[no]question option.
[bash]
;; ANSWER SECTION:
www.www.sparksupport.com. 600 IN A 203.23.184.88
[/bash]
Finally, we get our answer: the address of www.www.sparksupport.com is 204.152.184.88. I don’t know why you’d ever want to turn off the answer, but you can toggle this section of the output using the +[no]answer option.
[bash]
;; AUTHORITY SECTION:
www.sparksupport.com. 2351 IN NS ns1.nis.tc.org.
www.sparksupport.com. 2351 IN NS ns1.gnac.com.
www.sparksupport.com. 2351 IN NS ns2.nis.tc.org.
[/bash]
The authority section tells us what DNS servers can provide an authoritative answer to our query. In this example, www.sparksupport.com has three name servers. You can toggle this section of the output using the +[no]authority option.
[bash]
;; ADDITIONAL SECTION:
ns1.gnac.com. 171551 IN A 203.23.34.21
ns-int.www.sparksupport.com. 2351 IN A 211.52.18.65
ns-int.www.sparksupport.com. 2351 IN AAAA 2001:4f8:0:2::15
[/bash]
The final section of Command line tips the default output contains statistics about the query; it can be toggled with the +[no]stats option.
Some useful options with dig
dig will let you perform any valid DNS query, the most common of which are A (the IP address), TXT (text annotations), MX (mail exchanges), NS name servers, or the omnibus ANY.
[bash]
# get the address(es) for yahoo.com
dig yahoo.com A +noall +answer
# get a list of yahoo’s mail servers
dig yahoo.com MX +noall +answer
# get a list of DNS servers authoritative for yahoo.com
dig yahoo.com NS +noall +answer
# get all of the above
dig yahoo.com ANY +noall +answer
#Short answer
dig www.sparksupport.com +short
#To get the TTL values
dig +nocmd www.sparksupport.com mx +noall +short
#To get a long answer
dig +nocmd www.sparksupport.com any +multiline +noall +answer
#To reverselookup
dig -x 216.109.112.135 +short
To bulk lookups # do full lookups for a number of hostnames
#dig -f /path/to/host-list.txt
#the same, with more focused output
dig -f /path/to/host-list.txt +noall +answer
Tracing dig’s path
dig www.sparksupport.com +trace
[/bash]
How to interpret TTL value
If you ask your local DNS server for an Internet address, the server figures out where to find an authoritative answer and then asks for Command line tips . Once the server receives an answer, it will keep the answer in a local cache so that if you ask for the same address again a short time later, it can give you the answer quickly rather than searching the Internet for it all over again.
When domain administrators configure their DNS records, they decide how long the records should remain in remote caches. This is the TTL number (usually expressed in number of seconds).
When domain administrators configure their DNS records, they decide how long the records should remain in remote caches. This is the TTL number (usually expressed in number of seconds).
For example, as of this writing, the TTL for the MX records for the gmail.com domain is 300 seconds. The gmail.com admins are asking that remote servers cache their MX records for no more than five minutes. So when you first ask for that record set, dig will report a TTL of 300.
[bash]
$ dig +nocmd gmail.com MX +noall +answer
gmail.com. 300 IN MX 20 gsmtp57.google.com.
gmail.com. 300 IN MX 10 gsmtp171.google.com.
[/bash]
If you ask a few seconds later, you’ll see the TTL number reduced by approximately the number of seconds you waited to ask again.
[bash]
$ dig +nocmd gmail.com MX +noall +answer
gmail.com. 280 IN MX 10 gsmtp171.google.com.
gmail.com. 280 IN MX 20 gsmtp57.google.com.
[/bash]
If your timing is good, you can catch the record at the very end of its life.
[bash]
$ dig +nocmd gmail.com MX +noall +answer
gmail.com. 1 IN MX 10 gsmtp171.google.com.
gmail.com. 1 IN MX 20 gsmtp57.google.com.
[/bash]
After that, the DNS server you are querying will “forget” the answer to that question, so the whole cycle will start over again (in this example, at 300 seconds) the next time you perform that query.
for more please log in to www.sparksupport.com
