dig cheatsheet
dig is the main CLI tool for checking DNS.
It shows not only the answer, but also TTL, resolver, authoritative data, and DNS-chain details.
Short answer
dig +short getsrv.app A
dig +short getsrv.app AAAA
Useful for quick checks and scripts.
Full answer
dig getsrv.app A
Look at:
ANSWER SECTION;- TTL;
- record type;
- server that answered;
- query time.
Check A
dig getsrv.app A
dig +short getsrv.app A
Check AAAA
dig getsrv.app AAAA
dig +short getsrv.app AAAA
If AAAA exists, clients may use IPv6.
Check CNAME
dig getsrv.app CNAME
dig +short getsrv.app CNAME
If CNAME exists, check the final name:
dig final.example.net A
dig final.example.net AAAA
Check NS
dig getsrv.app NS
dig +short getsrv.app NS
NS records are especially important after changing DNS provider.
Check TXT
dig getsrv.app TXT
dig +short getsrv.app TXT
For a specific record:
dig _dmarc.getsrv.app TXT
Check CAA
dig getsrv.app CAA
CAA may affect certificate issuance.
Query a specific resolver
Cloudflare:
dig @1.1.1.1 getsrv.app A
Google:
dig @8.8.8.8 getsrv.app A
Quad9:
dig @9.9.9.9 getsrv.app A
Short form:
dig @1.1.1.1 getsrv.app A +short
dig @8.8.8.8 getsrv.app A +short
dig @9.9.9.9 getsrv.app A +short
Check authoritative DNS
Get NS:
dig +short getsrv.app NS
Query one NS directly:
dig @ns1.example.net getsrv.app A
If authoritative NS already returns the new record but a public resolver still returns the old one, the public resolver is still caching.
Trace DNS path
dig +trace getsrv.app
+trace shows the path from root DNS to authoritative servers.
Useful when zone delegation is broken.
See TTL
dig getsrv.app A
Example:
getsrv.app. 300 IN A 203.0.113.10
300 is TTL.
Check several types
for t in A AAAA CNAME NS TXT CAA; do
echo "=== $t ==="
dig +short getsrv.app "$t"
done
Compare resolvers
for r in 1.1.1.1 8.8.8.8 9.9.9.9; do
echo "=== @$r ==="
dig @"$r" getsrv.app A +short
done
Check DNS + HTTP
DNS alone does not prove the site works.
dig +short getsrv.app A
curl -kI https://getsrv.app/
Check DNS + TLS
dig +short getsrv.app A
openssl s_client -connect getsrv.app:443 -servername getsrv.app -brief
Common mistakes
Empty answer is not always an error
If you check AAAA and the domain has no IPv6, an empty answer can be normal.
+short hides details
Good for quick checks. For diagnostics, use full dig.
Wrong resolver
Different resolvers may temporarily see different answers.
Looking at A while the issue is in CNAME
If the name is a CNAME, check both the intermediate and final name.
Minimal set
dig +short getsrv.app NS
dig +short getsrv.app A
dig +short getsrv.app AAAA
dig @1.1.1.1 getsrv.app A +short
dig @8.8.8.8 getsrv.app A +short
curl -kI https://getsrv.app/
This is enough for a baseline check: the domain is delegated, addresses are returned, and the site responds.