Walk me through dig output. Where do you look to know whether a lookup really worked?
Show the answer
Say this first
I read the header first: status (NOERROR, NXDOMAIN, SERVFAIL or REFUSED), the flags, and the answer
count. NOERROR with ANSWER 0 means the name exists but has no record of that type. Then the answer section
for the records and their TTLs, and the footer for which server answered and how long it took. aa in the
flags means an authoritative server answered; without it the answer came from a resolver's cache.
Go deeper
Example through the systemd-resolved stub
$ dig www.example.com A
; <<>> DiG 9.18.28 <<>> www.example.com A
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 41872
;; flags: qr rd ra; QUERY: 1, ANSWER: 2, AUTHORITY: 0, ADDITIONAL: 1
;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 65494
;; QUESTION SECTION:
;www.example.com. IN A
;; ANSWER SECTION:
www.example.com. 300 IN CNAME web.example.net.
web.example.net. 60 IN A 203.0.113.80
;; Query time: 12 msec
;; SERVER: 127.0.0.53#53(127.0.0.53) (UDP)
;; WHEN: Tue Nov 10 09:14:02 UTC 2026
;; MSG SIZE rcvd: 89status: NOERRORandANSWER: 2: success. The name is a CNAME toweb.example.net, which has the A record.- Flags:
qrthis is a response,rdwe asked for recursion,rathe server offers it. Noaa, so cached. - TTL 300 and 60 seconds: how long a resolver may cache each record. Repeat the query and they count down.
SERVER: 127.0.0.53: the local systemd-resolved stub answered, not the real DNS server.
Status codes
| Status | Meaning |
|---|---|
| NOERROR, ANSWER > 0 | Records found |
| NOERROR, ANSWER 0 | Name exists, no record of that type (NODATA) |
| NXDOMAIN | The name does not exist |
| SERVFAIL | The resolver failed, often DNSSEC validation or unreachable authoritative servers |
| REFUSED | The server will not answer you, typically recursion not allowed for your source |
Options I use
dig @10.0.20.53 name (ask a specific server), +short, +trace (walk from the root), -x 203.0.113.80
(PTR), dig example.com MX, +norecurse (see what a server has itself).
They will ask next
How do you get the authoritative answer instead of a cached one?
Find the zone's servers with
dig example.com NS +shortand query one directly with@, or usedig +trace, which follows the delegation from the root itself. The answer should carry theaaflag.When would you use nslookup instead?
For a quick check, and on Windows where dig is not installed. Its output is less detailed: no flags, no TTLs by default. Like dig, it queries DNS directly and skips
/etc/hosts.
Traps
- Treating NOERROR as success without checking the answer count.
- Forgetting that dig talks to the server in resolv.conf, which on many hosts is the local stub.