NetKit

Dig online

Run a dig query from your browser. Pick the record type and resolver and get output laid out exactly like the dig command prints it.

dig
Try:

Results appear here. Choose record types above, then press Look up.

dig options, translated

CommandWhat it does
dig example.comA record via your system resolver
dig @8.8.8.8 example.com MXMX records, asked of Google Public DNS
dig +short example.comOnly the values, one per line
dig -x 8.8.8.8Reverse lookup (PTR); try our reverse DNS tool
dig +trace example.comFollow delegation from the root servers down
dig +dnssec example.comInclude RRSIG signatures; the ad flag means validated
dig example.com ANYMost resolvers now refuse or minimise ANY (RFC 8482); query types one by one instead

Header flags worth knowing

  • status: NOERROR (fine), NXDOMAIN (name doesn't exist), SERVFAIL (resolver couldn't get a valid answer), REFUSED.
  • qr rd ra: this is a response; recursion was desired; recursion is available.
  • aa: authoritative answer, only set when you ask the zone's own name server.
  • ad: the resolver validated the DNSSEC signatures.

Questions people ask

What is dig?
dig (domain information groper) is the standard DNS query tool from ISC's BIND suite. It prints the raw DNS response in sections: header (status and flags), question, answer, authority and additional.
How do I read the ANSWER SECTION?
Each line is name, TTL in seconds, class (IN = internet), type, and value. For example example.com. 300 IN A 93.184.215.14 means the A record is 93.184.215.14 and resolvers may cache it for 300 seconds.
Can I run dig +trace here?
Not exactly: this tool asks a recursive resolver, which is what dig does without +trace. To see the delegation chain, step through the resolution explainer on the DNS lookup page, or run dig +trace example.com locally.
How do I install dig?
macOS and most Linux distributions include it (package bind-utils on RHEL/Fedora, dnsutils on Debian/Ubuntu). On Windows, install BIND tools or use WSL, or use nslookup / Resolve-DnsName.