Offensive Security Researcher & Quantum Cryptography Analyst

Dig: Complete Guide to DNS Lookup and Network Troubleshooting Using Kali Linux

Abdul Wahab Junaid
Dig: Complete Guide to DNS Lookup and Network Troubleshooting Using Kali Linux

dig (Domain Information Groper) is part of the ISC BIND DNS software suite and is the industry-standard tool for querying DNS servers. Unlike nslookup, dig was purpose-built for scripting and detailed diagnostic output, giving full visibility into DNS responses including flags, TTL values, and the authority/additional sections of a DNS response. For penetration testers, dig is essential for enumerating DNS records (A, AAAA, MX, TXT, NS, SOA, CNAME, SRV), testing for zone transfer vulnerabilities, and tracing the full DNS resolution path.

Installation

dig is included in the dnsutils (Debian/Kali) or bind-utils (RHEL/Fedora) package and is pre-installed on Kali Linux.

# Debian/Kali/Ubuntu
sudo apt update && sudo apt install dnsutils -y

# RHEL/CentOS/Fedora
sudo yum install bind-utils -y

# macOS (Homebrew)
brew install bind

Verify installation:

dig -v

Syntax

dig [@server] [OPTIONS] [name] [type] [class]

Command-Line Options

Flag/ArgumentDescription
@serverSpecify the DNS server to query (e.g., @8.8.8.8)
nameThe domain/hostname to query
typeRecord type: A, AAAA, MX, NS, TXT, SOA, CNAME, SRV, PTR, ANY, AXFR
-x IPReverse lookup for an IP address
-4 / -6Force IPv4 or IPv6 for the query transport
-p PORTUse a non-standard port for the DNS query
-f FILEBatch mode: read lookup requests from a file
-b ADDRESSSet source IP address for queries (on multi-homed hosts)
+shortDisplay a terse/short answer only
+noall +answerDisplay only the answer section
+traceTrace the delegation path from the root servers down
+nssearchQuery all authoritative name servers for SOA info
+tcpForce the query to use TCP instead of UDP
+notcpForce UDP
+dnssecRequest DNSSEC records in the reply
+multilinePrint records in a verbose, multi-line format
+identifyShow which server produced each answer (useful with multiple @server args)
+stats / +nostatsToggle query statistics footer
+comments / +nocommentsToggle comment lines in output
+question / +noquestionToggle display of the question section
-t TYPEAlternative way to specify record type
-c CLASSSpecify the query class (default IN)
-4Use IPv4 query transport only
AXFRUsed as record type to attempt a full zone transfer

Basic Usage

dig example.com

Expected output:

; <<>> DiG 9.18.24-1-Debian <<>> example.com
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 5321
;; flags: qr rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 1

;; QUESTION SECTION:
;example.com.                  IN      A

;; ANSWER SECTION:
example.com.            86400   IN      A       93.184.216.34

;; Query time: 22 msec
;; SERVER: 127.0.0.53#53(127.0.0.53)
;; WHEN: Sun Jul 19 10:15:02 UTC 2026
;; MSG SIZE  rcvd: 56

Practical Examples

Example 1 — Query MX records

dig example.com MX +short

10 mail.example.com.

Example 2 — Query all NS records

dig example.com NS +short

a.iana-servers.net.
b.iana-servers.net.

Example 3 — Attempt a zone transfer (AXFR)

dig axfr @ns1.target.com target.com

; Transfer failed.

(A properly secured DNS server should always refuse this; if it succeeds, it’s a critical misconfiguration exposing the entire zone.)

Example 4 — Reverse DNS lookup

dig -x 8.8.8.8 +short

dns.google.

Example 5 — Trace full delegation path

dig +trace example.com

.                       518400  IN      NS      a.root-servers.net.
com.                    172800  IN      NS      a.gtld-servers.net.
example.com.            172800  IN      NS      a.iana-servers.net.
example.com.            86400   IN      A       93.184.216.34

Example 6 — Query TXT records (often reveals SPF, DKIM, verification tokens)

dig example.com TXT +short

"v=spf1 -all"
"google-site-verification=abc123XYZ"

Example 7 — Query using a specific resolver

dig @1.1.1.1 example.com A +short

93.184.216.34

Example 8 — Batch queries from a file

cat domains.txt
# example.com A
# example.org MX

dig -f domains.txt +short

93.184.216.34
10 mail.example.org.

Example 9 — Get only the answer section, no headers

dig example.com +noall +answer

example.com.            86400   IN      A       93.184.216.34

Common Use Cases

Automation with Bash

Enumerate common record types for a domain in one pass:

#!/bin/bash
# dig_enum.sh - enumerate common DNS records for a domain
DOMAIN=$1
for TYPE in A AAAA MX NS TXT SOA CNAME; do
    echo "=== $TYPE ==="
    dig "$DOMAIN" "$TYPE" +short
    echo
done

Usage:

./dig_enum.sh example.com

Test AXFR against every discovered name server automatically:

#!/bin/bash
DOMAIN=$1
for ns in $(dig "$DOMAIN" NS +short); do
    echo "[*] Trying zone transfer via $ns"
    dig axfr @"$ns" "$DOMAIN"
done

Tips and Best Practices

Troubleshooting

ProblemCauseFix
connection timed out; no servers could be reachedFirewall blocking UDP/TCP port 53 outboundTry a different network, or specify a reachable resolver with @8.8.8.8
;; Transfer failed. on AXFRServer correctly refuses transfer (expected/secure behavior)This is normal; note it as a passed control, not a bug
Empty answer sectionRecord type doesn’t exist for that domain, or query hit a caching resolver with a negative cacheQuery authoritative name server directly with @ns1.domain.com
SERVFAIL statusDNSSEC validation failure or broken delegationUse +cd to disable DNSSEC checking (for diagnostics only)
Inconsistent results between runsCDN/GeoDNS load balancing return different IPs each queryExpected behavior; query multiple times to build a full picture

References

Exit mobile version