dig.html revision 4a14ce5ba00ab7bc55c99ffdcf59c7a4ab902721
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk - Copyright (C) 2004-2009 Internet Systems Consortium, Inc. ("ISC")
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk - Copyright (C) 2000-2003 Internet Software Consortium.
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk - Permission to use, copy, modify, and/or distribute this software for any
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk - purpose with or without fee is hereby granted, provided that the above
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk - copyright notice and this permission notice appear in all copies.
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk - THE SOFTWARE IS PROVIDED "AS IS" AND ISC DISCLAIMS ALL WARRANTIES WITH
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk - REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk - AND FITNESS. IN NO EVENT SHALL ISC BE LIABLE FOR ANY SPECIAL, DIRECT,
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk - INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk - LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk - OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk - PERFORMANCE OF THIS SOFTWARE.
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk<!-- $Id: dig.html,v 1.48 2009/07/11 01:12:45 tbox Exp $ -->
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk<meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1">
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk<meta name="generator" content="DocBook XSL Stylesheets V1.71.1">
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk<body bgcolor="white" text="black" link="#0000FF" vlink="#840084" alink="#0000FF"><div class="refentry" lang="en">
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk<div class="cmdsynopsis"><p><code class="command">dig</code> [@server] [<code class="option">-b <em class="replaceable"><code>address</code></em></code>] [<code class="option">-c <em class="replaceable"><code>class</code></em></code>] [<code class="option">-f <em class="replaceable"><code>filename</code></em></code>] [<code class="option">-k <em class="replaceable"><code>filename</code></em></code>] [<code class="option">-m</code>] [<code class="option">-p <em class="replaceable"><code>port#</code></em></code>] [<code class="option">-q <em class="replaceable"><code>name</code></em></code>] [<code class="option">-t <em class="replaceable"><code>type</code></em></code>] [<code class="option">-x <em class="replaceable"><code>addr</code></em></code>] [<code class="option">-y <em class="replaceable"><code>[<span class="optional">hmac:</span>]name:key</code></em></code>] [<code class="option">-4</code>] [<code class="option">-6</code>] [name] [type] [class] [queryopt...]</p></div>
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk<div class="cmdsynopsis"><p><code class="command">dig</code> [<code class="option">-h</code>]</p></div>
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk<div class="cmdsynopsis"><p><code class="command">dig</code> [global-queryopt...] [query...]</p></div>
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk (domain information groper) is a flexible tool
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk for interrogating DNS name servers. It performs DNS lookups and
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk displays the answers that are returned from the name server(s) that
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk were queried. Most DNS administrators use <span><strong class="command">dig</strong></span> to
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk troubleshoot DNS problems because of its flexibility, ease of use and
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk clarity of output. Other lookup tools tend to have less functionality
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk Although <span><strong class="command">dig</strong></span> is normally used with
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk command-line
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk arguments, it also has a batch mode of operation for reading lookup
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk requests from a file. A brief summary of its command-line arguments
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk and options is printed when the <code class="option">-h</code> option is given.
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk Unlike earlier versions, the BIND 9 implementation of
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk <span><strong class="command">dig</strong></span> allows multiple lookups to be issued
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk command line.
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk Unless it is told to query a specific name server,
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk <span><strong class="command">dig</strong></span> will try each of the servers listed
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk When no command line arguments or options are given,
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk <span><strong class="command">dig</strong></span> will perform an NS query for "." (the root).
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk It is possible to set per-user defaults for <span><strong class="command">dig</strong></span> via
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk <code class="filename">${HOME}/.digrc</code>. This file is read and
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk any options in it
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk are applied before the command line arguments.
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk The IN and CH class names overlap with the IN and CH top level
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk domains names. Either use the <code class="option">-t</code> and
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk <code class="option">-c</code> options to specify the type and class,
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk use the <code class="option">-q</code> the specify the domain name, or
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk use "IN." and "CH." when looking up these top level domains.
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk A typical invocation of <span><strong class="command">dig</strong></span> looks like:
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk<pre class="programlisting"> dig @server name type </pre>
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk<dt><span class="term"><code class="constant">server</code></span></dt>
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk is the name or IP address of the name server to query. This can
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk be an IPv4
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk address in dotted-decimal notation or an IPv6
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk address in colon-delimited notation. When the supplied
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk <em class="parameter"><code>server</code></em> argument is a
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk <span><strong class="command">dig</strong></span> resolves that name before
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk querying that name
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk server. If no <em class="parameter"><code>server</code></em>
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk argument is provided,
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk <span><strong class="command">dig</strong></span> consults <code class="filename">/etc/resolv.conf</code>
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk and queries the name servers listed there. The reply from the
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk server that responds is displayed.
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk<dt><span class="term"><code class="constant">name</code></span></dt>
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk is the name of the resource record that is to be looked up.
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk<dt><span class="term"><code class="constant">type</code></span></dt>
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk indicates what type of query is required —
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk ANY, A, MX, SIG, etc.
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk <em class="parameter"><code>type</code></em> can be any valid query
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk type. If no
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk <em class="parameter"><code>type</code></em> argument is supplied,
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk <span><strong class="command">dig</strong></span> will perform a lookup for an
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk The <code class="option">-b</code> option sets the source IP address of the query
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk to <em class="parameter"><code>address</code></em>. This must be a valid
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk address on
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk one of the host's network interfaces or "0.0.0.0" or "::". An optional
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk may be specified by appending "#<port>"
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk The default query class (IN for internet) is overridden by the
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk <code class="option">-c</code> option. <em class="parameter"><code>class</code></em> is
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk class, such as HS for Hesiod records or CH for Chaosnet records.
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk The <code class="option">-f</code> option makes <span><strong class="command">dig </strong></span>
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk in batch mode by reading a list of lookup requests to process from the
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk file <em class="parameter"><code>filename</code></em>. The file contains a
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk queries, one per line. Each entry in the file should be organized in
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk the same way they would be presented as queries to
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk <span><strong class="command">dig</strong></span> using the command-line interface.
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk The <code class="option">-m</code> option enables memory usage debugging.
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk If a non-standard port number is to be queried, the
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk <code class="option">-p</code> option is used. <em class="parameter"><code>port#</code></em> is
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk the port number that <span><strong class="command">dig</strong></span> will send its
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk instead of the standard DNS port number 53. This option would be used
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk to test a name server that has been configured to listen for queries
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk on a non-standard port number.
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk The <code class="option">-4</code> option forces <span><strong class="command">dig</strong></span>
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk use IPv4 query transport. The <code class="option">-6</code> option forces
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk <span><strong class="command">dig</strong></span> to only use IPv6 query transport.
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk The <code class="option">-t</code> option sets the query type to
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk <em class="parameter"><code>type</code></em>. It can be any valid query type
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk supported in BIND 9. The default query type is "A", unless the
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk <code class="option">-x</code> option is supplied to indicate a reverse lookup.
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk A zone transfer can be requested by specifying a type of AXFR. When
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk an incremental zone transfer (IXFR) is required,
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk <em class="parameter"><code>type</code></em> is set to <code class="literal">ixfr=N</code>.
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk The incremental zone transfer will contain the changes made to the zone
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk since the serial number in the zone's SOA record was
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk The <code class="option">-q</code> option sets the query name to
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk <em class="parameter"><code>name</code></em>. This useful do distinguish the
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk <em class="parameter"><code>name</code></em> from other arguments.
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk Reverse lookups — mapping addresses to names — are simplified by the
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk <code class="option">-x</code> option. <em class="parameter"><code>addr</code></em> is
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk address in dotted-decimal notation, or a colon-delimited IPv6 address.
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk When this option is used, there is no need to provide the
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk <em class="parameter"><code>name</code></em>, <em class="parameter"><code>class</code></em> and
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk <em class="parameter"><code>type</code></em> arguments. <span><strong class="command">dig</strong></span>
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk automatically performs a lookup for a name like
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk <code class="literal">11.12.13.10.in-addr.arpa</code> and sets the
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk query type and
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk class to PTR and IN respectively. By default, IPv6 addresses are
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk looked up using nibble format under the IP6.ARPA domain.
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk To use the older RFC1886 method using the IP6.INT domain
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk specify the <code class="option">-i</code> option. Bit string labels (RFC2874)
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk are now experimental and are not attempted.
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk To sign the DNS queries sent by <span><strong class="command">dig</strong></span> and
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk responses using transaction signatures (TSIG), specify a TSIG key file
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk using the <code class="option">-k</code> option. You can also specify the TSIG
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk key itself on the command line using the <code class="option">-y</code> option;
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk <em class="parameter"><code>hmac</code></em> is the type of the TSIG, default HMAC-MD5,
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk <em class="parameter"><code>name</code></em> is the name of the TSIG key and
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk <em class="parameter"><code>key</code></em> is the actual key. The key is a
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk encoded string, typically generated by
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk <span class="citerefentry"><span class="refentrytitle">dnssec-keygen</span>(8)</span>.
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk Caution should be taken when using the <code class="option">-y</code> option on
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk multi-user systems as the key can be visible in the output from
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk <span class="citerefentry"><span class="refentrytitle">ps</span>(1)</span>
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk or in the shell's history file. When
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk using TSIG authentication with <span><strong class="command">dig</strong></span>, the name
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk server that is queried needs to know the key and algorithm that is
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk being used. In BIND, this is done by providing appropriate
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk <span><strong class="command">key</strong></span> and <span><strong class="command">server</strong></span> statements in
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk provides a number of query options which affect
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk the way in which lookups are made and the results displayed. Some of
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk these set or reset flag bits in the query header, some determine which
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk sections of the answer get printed, and others determine the timeout
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk and retry strategies.
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk Each query option is identified by a keyword preceded by a plus sign
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk (<code class="literal">+</code>). Some keywords set or reset an
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk option. These may be preceded
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk by the string <code class="literal">no</code> to negate the meaning of
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk that keyword. Other
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk keywords assign values to options like the timeout interval. They
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk have the form <code class="option">+keyword=value</code>.
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk The query options are:
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk<dt><span class="term"><code class="option">+[no]tcp</code></span></dt>
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk Use [do not use] TCP when querying name servers. The default
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk behavior is to use UDP unless an AXFR or IXFR query is
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk requested, in
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk which case a TCP connection is used.
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk<dt><span class="term"><code class="option">+[no]vc</code></span></dt>
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk Use [do not use] TCP when querying name servers. This alternate
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk syntax to <em class="parameter"><code>+[no]tcp</code></em> is
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk provided for backwards
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk compatibility. The "vc" stands for "virtual circuit".
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk<dt><span class="term"><code class="option">+[no]ignore</code></span></dt>
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk Ignore truncation in UDP responses instead of retrying with TCP.
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk default, TCP retries are performed.
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk<dt><span class="term"><code class="option">+domain=somename</code></span></dt>
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk Set the search list to contain the single domain
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk <em class="parameter"><code>somename</code></em>, as if specified in
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk <span><strong class="command">domain</strong></span> directive in
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk <code class="filename">/etc/resolv.conf</code>, and enable
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk search list
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk processing as if the <em class="parameter"><code>+search</code></em>
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk option were given.
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk<dt><span class="term"><code class="option">+[no]search</code></span></dt>
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk Use [do not use] the search list defined by the searchlist or
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk directive in <code class="filename">resolv.conf</code> (if
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk The search list is not used by default.
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk<dt><span class="term"><code class="option">+[no]showsearch</code></span></dt>
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk Perform [do not perform] a search showing intermediate
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk<dt><span class="term"><code class="option">+[no]defname</code></span></dt>
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk Deprecated, treated as a synonym for <em class="parameter"><code>+[no]search</code></em>
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk<dt><span class="term"><code class="option">+[no]aaonly</code></span></dt>
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk Sets the "aa" flag in the query.
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk<dt><span class="term"><code class="option">+[no]aaflag</code></span></dt>
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk A synonym for <em class="parameter"><code>+[no]aaonly</code></em>.
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk<dt><span class="term"><code class="option">+[no]adflag</code></span></dt>
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk Set [do not set] the AD (authentic data) bit in the
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk query. This requests the server to return whether
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk all of the answer and authority sections have all
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk been validated as secure according to the security
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk policy of the server. AD=1 indicates that all records
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk have been validated as secure and the answer is not
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk from a OPT-OUT range. AD=0 indicate that some part
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk of the answer was insecure or not validated.
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk<dt><span class="term"><code class="option">+[no]cdflag</code></span></dt>
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk Set [do not set] the CD (checking disabled) bit in the query.
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk requests the server to not perform DNSSEC validation of
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk responses.
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk<dt><span class="term"><code class="option">+[no]cl</code></span></dt>
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk Display [do not display] the CLASS when printing the record.
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk<dt><span class="term"><code class="option">+[no]ttlid</code></span></dt>
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk Display [do not display] the TTL when printing the record.
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk<dt><span class="term"><code class="option">+[no]recurse</code></span></dt>
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk Toggle the setting of the RD (recursion desired) bit in the
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk This bit is set by default, which means <span><strong class="command">dig</strong></span>
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk normally sends recursive queries. Recursion is automatically
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk when the <em class="parameter"><code>+nssearch</code></em> or
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk <em class="parameter"><code>+trace</code></em> query options are
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk<dt><span class="term"><code class="option">+[no]nssearch</code></span></dt>
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk When this option is set, <span><strong class="command">dig</strong></span>
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk attempts to find the
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk authoritative name servers for the zone containing the name
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk looked up and display the SOA record that each name server has
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk<dt><span class="term"><code class="option">+[no]trace</code></span></dt>
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk Toggle tracing of the delegation path from the root name servers
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk the name being looked up. Tracing is disabled by default. When
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk tracing is enabled, <span><strong class="command">dig</strong></span> makes
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk iterative queries to
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk resolve the name being looked up. It will follow referrals from
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk root servers, showing the answer from each server that was used
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk resolve the lookup.
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk<dt><span class="term"><code class="option">+[no]cmd</code></span></dt>
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk Toggles the printing of the initial comment in the output
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk identifying
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk the version of <span><strong class="command">dig</strong></span> and the query
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk options that have
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk been applied. This comment is printed by default.
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk<dt><span class="term"><code class="option">+[no]short</code></span></dt>
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk Provide a terse answer. The default is to print the answer in a
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk verbose form.
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk<dt><span class="term"><code class="option">+[no]identify</code></span></dt>
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk Show [or do not show] the IP address and port number that
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk supplied the
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk answer when the <em class="parameter"><code>+short</code></em> option
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk is enabled. If
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk short form answers are requested, the default is not to show the
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk source address and port number of the server that provided the
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk<dt><span class="term"><code class="option">+[no]comments</code></span></dt>
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk Toggle the display of comment lines in the output. The default
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk print comments.
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk<dt><span class="term"><code class="option">+[no]stats</code></span></dt>
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk This query option toggles the printing of statistics: when the
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk was made, the size of the reply and so on. The default
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk behavior is
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk to print the query statistics.
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk<dt><span class="term"><code class="option">+[no]qr</code></span></dt>
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk Print [do not print] the query as it is sent.
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk By default, the query is not printed.
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk<dt><span class="term"><code class="option">+[no]question</code></span></dt>
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk Print [do not print] the question section of a query when an
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk returned. The default is to print the question section as a
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk<dt><span class="term"><code class="option">+[no]answer</code></span></dt>
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk Display [do not display] the answer section of a reply. The
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk is to display it.
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk<dt><span class="term"><code class="option">+[no]authority</code></span></dt>
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk Display [do not display] the authority section of a reply. The
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk default is to display it.
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk<dt><span class="term"><code class="option">+[no]additional</code></span></dt>
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk Display [do not display] the additional section of a reply.
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk The default is to display it.
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk<dt><span class="term"><code class="option">+[no]all</code></span></dt>
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk Set or clear all display flags.
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk<dt><span class="term"><code class="option">+time=T</code></span></dt>
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk Sets the timeout for a query to
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk <em class="parameter"><code>T</code></em> seconds. The default
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk timeout is 5 seconds.
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk An attempt to set <em class="parameter"><code>T</code></em> to less
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk than 1 will result
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk in a query timeout of 1 second being applied.
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk<dt><span class="term"><code class="option">+tries=T</code></span></dt>
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk Sets the number of times to try UDP queries to server to
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk <em class="parameter"><code>T</code></em> instead of the default, 3.
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk <em class="parameter"><code>T</code></em> is less than or equal to
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk zero, the number of
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk tries is silently rounded up to 1.
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk<dt><span class="term"><code class="option">+retry=T</code></span></dt>
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk Sets the number of times to retry UDP queries to server to
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk <em class="parameter"><code>T</code></em> instead of the default, 2.
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk <em class="parameter"><code>+tries</code></em>, this does not include
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk the initial
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk<dt><span class="term"><code class="option">+ndots=D</code></span></dt>
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk Set the number of dots that have to appear in
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk <em class="parameter"><code>name</code></em> to <em class="parameter"><code>D</code></em> for it to be
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk considered absolute. The default value is that defined using
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk ndots statement in <code class="filename">/etc/resolv.conf</code>, or 1 if no
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk ndots statement is present. Names with fewer dots are
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk interpreted as
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk relative names and will be searched for in the domains listed in
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk <code class="option">search</code> or <code class="option">domain</code> directive in
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk<dt><span class="term"><code class="option">+bufsize=B</code></span></dt>
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk Set the UDP message buffer size advertised using EDNS0 to
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk <em class="parameter"><code>B</code></em> bytes. The maximum and minimum sizes
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk of this buffer are 65535 and 0 respectively. Values outside
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk this range are rounded up or down appropriately.
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk Values other than zero will cause a EDNS query to be sent.
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk<dt><span class="term"><code class="option">+edns=#</code></span></dt>
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk Specify the EDNS version to query with. Valid values
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk are 0 to 255. Setting the EDNS version will cause a
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk EDNS query to be sent. <code class="option">+noedns</code> clears the
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk remembered EDNS version.
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk<dt><span class="term"><code class="option">+[no]multiline</code></span></dt>
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk Print records like the SOA records in a verbose multi-line
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk format with human-readable comments. The default is to print
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk each record on a single line, to facilitate machine parsing
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk of the <span><strong class="command">dig</strong></span> output.
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk<dt><span class="term"><code class="option">+[no]fail</code></span></dt>
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk Do not try the next server if you receive a SERVFAIL. The
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk default is
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk to not try the next server which is the reverse of normal stub
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk<dt><span class="term"><code class="option">+[no]besteffort</code></span></dt>
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk Attempt to display the contents of messages which are malformed.
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk The default is to not display malformed answers.
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk<dt><span class="term"><code class="option">+[no]dnssec</code></span></dt>
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk Requests DNSSEC records be sent by setting the DNSSEC OK bit
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk in the OPT record in the additional section of the query.
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk<dt><span class="term"><code class="option">+[no]sigchase</code></span></dt>
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk Chase DNSSEC signature chains. Requires dig be compiled with
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk -DDIG_SIGCHASE.
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk<dt><span class="term"><code class="option">+trusted-key=####</code></span></dt>
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk Specifies a file containing trusted keys to be used with
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk <code class="option">+sigchase</code>. Each DNSKEY record must be
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk on its own line.
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk If not specified, <span><strong class="command">dig</strong></span> will look for
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk <code class="filename">trusted-key.key</code> in the current directory.
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk Requires dig be compiled with -DDIG_SIGCHASE.
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk<dt><span class="term"><code class="option">+[no]topdown</code></span></dt>
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk When chasing DNSSEC signature chains perform a top-down
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk validation.
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk Requires dig be compiled with -DDIG_SIGCHASE.
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk<dt><span class="term"><code class="option">+[no]nsid</code></span></dt>
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk Include an EDNS name server ID request when sending a query.
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk The BIND 9 implementation of <span><strong class="command">dig </strong></span>
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk specifying multiple queries on the command line (in addition to
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk supporting the <code class="option">-f</code> batch file option). Each of those
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk queries can be supplied with its own set of flags, options and query
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk In this case, each <em class="parameter"><code>query</code></em> argument
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk represent an
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk individual query in the command-line syntax described above. Each
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk consists of any of the standard options and flags, the name to be
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk looked up, an optional query type and class and any query options that
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk should be applied to that query.
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk A global set of query options, which should be applied to all queries,
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk can also be supplied. These global query options must precede the
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk first tuple of name, class, type, options, flags, and query options
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk supplied on the command line. Any global query options (except
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk overridden by a query-specific set of query options. For example:
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk shows how <span><strong class="command">dig</strong></span> could be used from the
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk command line
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk to make three lookups: an ANY query for <code class="literal">www.isc.org</code>, a
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk reverse lookup of 127.0.0.1 and a query for the NS records of
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk A global query option of <em class="parameter"><code>+qr</code></em> is
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk applied, so
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk that <span><strong class="command">dig</strong></span> shows the initial query it made
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk lookup. The final query has a local query option of
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk <em class="parameter"><code>+noqr</code></em> which means that <span><strong class="command">dig</strong></span>
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk will not print the initial query when it looks up the NS records for
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk If <span><strong class="command">dig</strong></span> has been built with IDN (internationalized
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk domain name) support, it can accept and display non-ASCII domain names.
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk <span><strong class="command">dig</strong></span> appropriately converts character encoding of
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk domain name before sending a request to DNS server or displaying a
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk reply from the server.
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk If you'd like to turn off the IDN support for some reason, defines
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk the <code class="envar">IDN_DISABLE</code> environment variable.
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk The IDN support is disabled if the variable is set when
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk<p><span class="citerefentry"><span class="refentrytitle">host</span>(1)</span>,
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk <span class="citerefentry"><span class="refentrytitle">named</span>(8)</span>,
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk <span class="citerefentry"><span class="refentrytitle">dnssec-keygen</span>(8)</span>,
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk There are probably too many query options.