Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

When doing a dig over some site (i.e. from different online dig tool sites(in this case, and, I've noticed their answers are different. I guess this must mean that the answers each one of them is getting is not from root dns servers but from local ones, instead (for example, their ISPs).

What I'd like to know is how to force the dig tool to return the info from the root servers itself. Is it possible, at all?


share|improve this question

To get authoritative information using dig you usually use a combination of +trace and @server. For example, if I want authorative information about I would do it like this:

# dig +trace NS

; <<>> DiG 9.4.2-P2 <<>> +trace NS
;; global options:  printcmd
.                       3600000 IN      NS      L.ROOT-SERVERS.NET.
.                       3600000 IN      NS      M.ROOT-SERVERS.NET.
.                       3600000 IN      NS      D.ROOT-SERVERS.NET.
.                       3600000 IN      NS      I.ROOT-SERVERS.NET.
.                       3600000 IN      NS      H.ROOT-SERVERS.NET.
.                       3600000 IN      NS      F.ROOT-SERVERS.NET.
.                       3600000 IN      NS      C.ROOT-SERVERS.NET.
.                       3600000 IN      NS      G.ROOT-SERVERS.NET.
.                       3600000 IN      NS      B.ROOT-SERVERS.NET.
.                       3600000 IN      NS      K.ROOT-SERVERS.NET.
.                       3600000 IN      NS      E.ROOT-SERVERS.NET.
.                       3600000 IN      NS      A.ROOT-SERVERS.NET.
.                       3600000 IN      NS      J.ROOT-SERVERS.NET.
;; Received 244 bytes from in 3 ms

com.                    172800  IN      NS
com.                    172800  IN      NS
com.                    172800  IN      NS
com.                    172800  IN      NS
com.                    172800  IN      NS
com.                    172800  IN      NS
com.                    172800  IN      NS
com.                    172800  IN      NS
com.                    172800  IN      NS
com.                    172800  IN      NS
com.                    172800  IN      NS
com.                    172800  IN      NS
com.                    172800  IN      NS
;; Received 488 bytes from in 129 ms             172800  IN      NS             172800  IN      NS             172800  IN      NS             172800  IN      NS
;; Received 164 bytes from in 149 ms             345600  IN      NS             345600  IN      NS             345600  IN      NS             345600  IN      NS
;; Received 164 bytes from in 32 ms

Now I have the nameservers that are listed for, as well as the IP address of one of them. I can ask this nameserver directly for the records:

# dig @

; <<>> DiG 9.4.2-P2 <<>> @
;; global options:  printcmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 24224
;; flags: qr aa rd; QUERY: 1, ANSWER: 7, AUTHORITY: 0, ADDITIONAL: 0
;; WARNING: recursion requested but not available

;                        IN      A

;; ANSWER SECTION:         604800  IN      CNAME       300     IN      A       300     IN      A       300     IN      A       300     IN      A       300     IN      A       300     IN      A

;; Query time: 34 msec
;; WHEN: Fri Apr 29 15:22:40 2011
;; MSG SIZE  rcvd: 148
share|improve this answer
+1. Nice answer that visually demonstrates what I posted in my answer. – joeqwerty Apr 29 '11 at 13:31

Root servers don't answer queries for second-level domains. gTLD servers don't answer queries for second-level domains (other than returning the name servers for second-level domains). The authoratative name servers for the second-level domain answer queries for that second-level domain. You can query a gTLD to find the name servers for a specific domain and then query those name servers for resource records in that domain.

Root Servers

---------------->gTLD Servers

---------------------------------->Authorataive Name Servers

--------------------------------------------------------------------->Resource Records

share|improve this answer

Root servers should never be asked a recursive query (i.e.) for a server.example.tld, only about the servers handling the top level domains (.tld in the example).

However I think, that what you mean you want an answer from an authoritative server. In order to do that do:

1) Ask for NS i.e. name server field, instead of A -- IPv4 address, for domain

2) Change the server field to one of servers obtained in point 1).

3) Ask the question about address of

The same procedure works for any other domain, of course.

The procedure works for a CLI dig and with interface.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.