Sign up ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

When the accuracy of a DNS cache is in question, dig +trace tends to be the recommended way of determining the authoritative answer for an internet facing DNS record. This seems to be particularly useful when also paired with +additional, which also shows the glue records.

Occasionally there seems to be some disagreement on this point -- some people say that it relies on the local resolver to look up the IP addresses of the intermediate nameservers, but the command output offers no indication that this is happening beyond the initial list of root nameservers. It seems logical to assume that this wouldn't be the case if the purpose of +trace is to start at the root servers and trace your way down. (at least if you have the right list of root nameservers)

Does dig +trace really use the local resolver for anything past the root nameservers?

share|improve this question

2 Answers 2

up vote 19 down vote accepted

This is obviously a staged Q&A, but this tends to confuse people often and I can't find a canonical question covering the topic.

dig +trace is a great diagnostic tool, but one aspect of its design is widely misunderstood: the IP of every server that will be queried is obtained from your resolver library. This is very easily overlooked and often only ends up becoming a problem when your local cache has the wrong answer for a nameserver cached.

Detailed Analysis

This is easier to break down with a sample of the output; I'll omit everything past the first NS delegation.

; <<>> DiG 9.7.3 <<>> +trace +additional                                                                      

;; global options: +cmd
.                   121459  IN      NS
.                   121459  IN      NS
.                   121459  IN      NS
.                   121459  IN      NS
.                   121459  IN      NS
.                   121459  IN      NS
.                   121459  IN      NS
.                   121459  IN      NS
.                   121459  IN      NS
.                   121459  IN      NS
.                   121459  IN      NS
.                   121459  IN      NS
.                   121459  IN      NS 354907  IN      A 100300  IN      A 123073  IN      AAAA    2001:500:2f::f 354527  IN      A 354295  IN      A 108245  IN      AAAA    2001:500:1::803f:235 355208  IN      A 542090  IN      AAAA    2001:7fe::53 354526  IN      A 488036  IN      AAAA    2001:503:c27::2:30 354968  IN      A 431621  IN      AAAA    2001:7fd::1 354295  IN      A
;; Received 496 bytes from in 10 ms

com.                        172800  IN      NS
com.                        172800  IN      NS
com.                        172800  IN      NS
com.                        172800  IN      NS
com.                        172800  IN      NS
com.                        172800  IN      NS
com.                        172800  IN      NS
com.                        172800  IN      NS
com.                        172800  IN      NS
com.                        172800  IN      NS
com.                        172800  IN      NS
com.                        172800  IN      NS
com.                        172800  IN      NS 172800  IN      A 172800  IN      AAAA    2001:503:a83e::2:30 172800  IN      A 172800  IN      AAAA    2001:503:231d::2:30 172800  IN      A 172800  IN      A 172800  IN      A 172800  IN      A 172800  IN      A 172800  IN      A 172800  IN      A 172800  IN      A 172800  IN      A 172800  IN      A
;; Received 505 bytes from in 13 ms
  • The initial query for . IN NS (root nameservers) hits the local resolver, which in this case is Comcast. ( This is easy to spot.
  • The next query is for IN A and runs against, randomly selected from the list of root nameservers we just got. It has an IP address of, and since we have +additional enabled it appears to be coming from the glue.
  • Since it is not authoritative for, this gets delegated to the com. TLD nameservers.
  • What isn't obvious from the output here is that dig did not derive the IP address of from the glue.

In the background, this is what really happened:

tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
listening on eth1, link-type EN10MB (Ethernet), capture size 65535 bytes
02:03:43.301022 IP > 63418 NS? . (17)
02:03:43.327327 IP > 63418 13/0/14 NS, NS, NS, NS, NS, NS, NS, NS, NS, NS, NS, NS, NS (512)
02:03:43.333047 IP > 41110+ A? (36)
02:03:43.333096 IP > 5696+ AAAA? (36)
02:03:43.344301 IP > 41110 1/0/0 A (52)
02:03:43.344348 IP > 5696 0/1/0 (96)
02:03:43.344723 IP > 28583 A? (33)
02:03:43.423299 IP > 28583- 0/13/14 (493)

+trace cheated and consulted the local resolver to obtain the IP address of the next hop nameserver instead of consulting the glue. Sneaky!

This is usually "good enough" and won't cause a problem for most people. Unfortunately, there are edge cases. If for whatever reason your upstream DNS cache is providing the wrong answer for the nameserver, this model breaks down entirely.

Real world example:

  • domain expires
  • glue is repointed at registrar redirection nameservers
  • bogus IPs are cached for ns1 and
  • domain is renewed with restored glue
  • any caches with the bogus nameserver IPs continue to send people to a website that says the domain is for sale

In the above case, +trace will suggest that the domain owner's own nameservers are the source of the problem, and you're one call away from incorrectly telling a customer that their servers are misconfigured. Whether it's something you can (or are willing to) do something about is another story, but it's important to have the right information.

dig +trace is a great tool, but like any tool, you need to know what it does and doesn't do, and how to troubleshoot the issue manually when it proves insufficient.


It should also be noted that dig +trace will not warn you about NS records that point at CNAMEaliases. This is a RFC violation that ISC BIND (and possibly others) will not attempt to correct. +trace will be completely happy to accept the A record it gets from your locally configured nameserver, whereas if BIND were to be performing full recursion it would be rejecting the entire zone with a SERVFAIL.

This can be tricky to troubleshoot if glue is present; this will work just fine until the NS records are refreshed, then suddenly break. Glueless delegations will always break BIND's recursion when a NS record points at an alias.

share|improve this answer
What about +nssearch? – vonbrand Feb 27 '13 at 13:14
@vonbrand +nssearch performs a NS record lookup against your local resolver for the requested record, followed by a series of A/AAAA lookups against the local resolver for each of the returned nameservers. It's likewise susceptible to bogus nameserver records in cache. – Andrew B Feb 27 '13 at 16:50
So what's the solution? Use "dig ... @server" and follow the delegation manually? – Raman Sep 19 at 0:12
@Raman Yes, it's either that or you have to empty the cache of a recursive server that you have handy, make the query, and dump the cache. (which defeats the idea of a lightweight client) dig is doing this to exponentially reduce the number of queries required. – Andrew B Sep 19 at 0:19

Another way of tracing DNS resolution without using the local resolver for anything except finding the root nameservers, is using dnsgraph (Full disclosure: I wrote this). It has a command line tool and a web version, of which you can find an instance at

Example for, which actually has a DNS problem right now:

enter image description here

share|improve this answer
The stuffy pedant in me wants to say that this technically isn't an answer. The DNS admin in me thinks it's awesome and totally doesn't care. – Andrew B Apr 27 '14 at 10:37
I was going to post it as a comment, but wanted to include the image. Feel free to merge it into your answer if you think that's better. – Dennis Kaarsemaker Apr 27 '14 at 10:41
I'm fine with things as they are. If a mod feels otherwise I'll consolidate though, sure. – Andrew B Apr 27 '14 at 17:48

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.