Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

When the accuracy of a DNS cache is in question, dig +trace tends to be the recommended way of determining the authoritative answer for an internet facing DNS record. This seems to be particularly useful when also paired with +additional, which also shows the glue records.

Occasionally there seems to be some disagreement on this point -- some people say that it relies on the local resolver to look up the IP addresses of the intermediate nameservers, but the command output offers no indication that this is happening beyond the initial list of root nameservers. It seems logical to assume that this wouldn't be the case if the purpose of +trace is to start at the root servers and trace your way down. (at least if you have the right list of root nameservers)

Does dig +trace really use the local resolver for anything past the root nameservers?

share|improve this question

2 Answers 2

up vote 18 down vote accepted

This is obviously a staged Q&A, but this tends to confuse people often and I can't find a canonical question covering the topic.

dig +trace is a great diagnostic tool, but one aspect of its design is widely misunderstood: the IP of every server that will be queried is obtained from your resolver library. This is very easily overlooked and often only ends up becoming a problem when your local cache has the wrong answer for a nameserver cached.

Detailed Analysis

This is easier to break down with a sample of the output; I'll omit everything past the first NS delegation.

; <<>> DiG 9.7.3 <<>> +trace +additional serverfault.com                                                                      

;; global options: +cmd
.                   121459  IN      NS      d.root-servers.net.
.                   121459  IN      NS      e.root-servers.net.
.                   121459  IN      NS      f.root-servers.net.
.                   121459  IN      NS      g.root-servers.net.
.                   121459  IN      NS      h.root-servers.net.
.                   121459  IN      NS      i.root-servers.net.
.                   121459  IN      NS      j.root-servers.net.
.                   121459  IN      NS      k.root-servers.net.
.                   121459  IN      NS      l.root-servers.net.
.                   121459  IN      NS      m.root-servers.net.
.                   121459  IN      NS      a.root-servers.net.
.                   121459  IN      NS      b.root-servers.net.
.                   121459  IN      NS      c.root-servers.net.
e.root-servers.net. 354907  IN      A
f.root-servers.net. 100300  IN      A
f.root-servers.net. 123073  IN      AAAA    2001:500:2f::f
g.root-servers.net. 354527  IN      A
h.root-servers.net. 354295  IN      A
h.root-servers.net. 108245  IN      AAAA    2001:500:1::803f:235
i.root-servers.net. 355208  IN      A
i.root-servers.net. 542090  IN      AAAA    2001:7fe::53
j.root-servers.net. 354526  IN      A
j.root-servers.net. 488036  IN      AAAA    2001:503:c27::2:30
k.root-servers.net. 354968  IN      A
k.root-servers.net. 431621  IN      AAAA    2001:7fd::1
l.root-servers.net. 354295  IN      A
;; Received 496 bytes from in 10 ms

com.                        172800  IN      NS      m.gtld-servers.net.
com.                        172800  IN      NS      k.gtld-servers.net.
com.                        172800  IN      NS      f.gtld-servers.net.
com.                        172800  IN      NS      g.gtld-servers.net.
com.                        172800  IN      NS      b.gtld-servers.net.
com.                        172800  IN      NS      e.gtld-servers.net.
com.                        172800  IN      NS      j.gtld-servers.net.
com.                        172800  IN      NS      c.gtld-servers.net.
com.                        172800  IN      NS      l.gtld-servers.net.
com.                        172800  IN      NS      d.gtld-servers.net.
com.                        172800  IN      NS      i.gtld-servers.net.
com.                        172800  IN      NS      h.gtld-servers.net.
com.                        172800  IN      NS      a.gtld-servers.net.
a.gtld-servers.net. 172800  IN      A
a.gtld-servers.net. 172800  IN      AAAA    2001:503:a83e::2:30
b.gtld-servers.net. 172800  IN      A
b.gtld-servers.net. 172800  IN      AAAA    2001:503:231d::2:30
c.gtld-servers.net. 172800  IN      A
d.gtld-servers.net. 172800  IN      A
e.gtld-servers.net. 172800  IN      A
f.gtld-servers.net. 172800  IN      A
g.gtld-servers.net. 172800  IN      A
h.gtld-servers.net. 172800  IN      A
i.gtld-servers.net. 172800  IN      A
j.gtld-servers.net. 172800  IN      A
k.gtld-servers.net. 172800  IN      A
l.gtld-servers.net. 172800  IN      A
;; Received 505 bytes from in 13 ms
  • The initial query for . IN NS (root nameservers) hits the local resolver, which in this case is Comcast. ( This is easy to spot.
  • The next query is for serverfault.com. IN A and runs against e.root-servers.net., randomly selected from the list of root nameservers we just got. It has an IP address of, and since we have +additional enabled it appears to be coming from the glue.
  • Since it is not authoritative for serverfault.com, this gets delegated to the com. TLD nameservers.
  • What isn't obvious from the output here is that dig did not derive the IP address of e.root-servers.net. from the glue.

In the background, this is what really happened:

tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
listening on eth1, link-type EN10MB (Ethernet), capture size 65535 bytes
02:03:43.301022 IP > 63418 NS? . (17)
02:03:43.327327 IP > 63418 13/0/14 NS k.root-servers.net., NS l.root-servers.net., NS m.root-servers.net., NS a.root-servers.net., NS b.root-servers.net., NS c.root-servers.net., NS d.root-servers.net., NS e.root-servers.net., NS f.root-servers.net., NS g.root-servers.net., NS h.root-servers.net., NS i.root-servers.net., NS j.root-servers.net. (512)
02:03:43.333047 IP > 41110+ A? e.root-servers.net. (36)
02:03:43.333096 IP > 5696+ AAAA? e.root-servers.net. (36)
02:03:43.344301 IP > 41110 1/0/0 A (52)
02:03:43.344348 IP > 5696 0/1/0 (96)
02:03:43.344723 IP > 28583 A? serverfault.com. (33)
02:03:43.423299 IP > 28583- 0/13/14 (493)

+trace cheated and consulted the local resolver to obtain the IP address of the next hop nameserver instead of consulting the glue. Sneaky!

This is usually "good enough" and won't cause a problem for most people. Unfortunately, there are edge cases. If for whatever reason your upstream DNS cache is providing the wrong answer for the nameserver, this model breaks down entirely.

Real world example:

  • domain expires
  • glue is repointed at registrar redirection nameservers
  • bogus IPs are cached for ns1 and ns2.yourdomain.com
  • domain is renewed with restored glue
  • any caches with the bogus nameserver IPs continue to send people to a website that says the domain is for sale

In the above case, +trace will suggest that the domain owner's own nameservers are the source of the problem, and you're one call away from incorrectly telling a customer that their servers are misconfigured. Whether it's something you can (or are willing to) do something about is another story, but it's important to have the right information.

dig +trace is a great tool, but like any tool, you need to know what it does and doesn't do, and how to troubleshoot the issue manually when it proves insufficient.

share|improve this answer
What about +nssearch? –  vonbrand Feb 27 '13 at 13:14
@vonbrand +nssearch performs a NS record lookup against your local resolver for the requested record, followed by a series of A/AAAA lookups against the local resolver for each of the returned nameservers. It's likewise susceptible to bogus nameserver records in cache. –  Andrew B Feb 27 '13 at 16:50

Another way of tracing DNS resolution without using the local resolver for anything except finding the root nameservers, is using dnsgraph (Full disclosure: I wrote this). It has a command line tool and a web version, of which you can find an instance at http://ip.seveas.net/dnsgraph/

Example for serverfault.com, which actually has a DNS problem right now:

enter image description here

share|improve this answer
The stuffy pedant in me wants to say that this technically isn't an answer. The DNS admin in me thinks it's awesome and totally doesn't care. –  Andrew B Apr 27 '14 at 10:37
I was going to post it as a comment, but wanted to include the image. Feel free to merge it into your answer if you think that's better. –  Dennis Kaarsemaker Apr 27 '14 at 10:41
I'm fine with things as they are. If a mod feels otherwise I'll consolidate though, sure. –  Andrew B Apr 27 '14 at 17:48

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.