Tag Info

Hot answers tagged

70

Yes, the number there is the number of seconds left until that record expires (providing we're not querying the authoritative nameserver). Obviously with a CNAME there's a level of redirection, so the TTL for the A record it points to in this case may be important as well. If you wait a couple of seconds and run dig again on your local nameserver, you ...


67

The short answer is to your specific question of listing CNAMEs is that you can't without permission to do zone transfers (see How to list all CNAME records for a given domain?). That said, you can use dig to list the other records by doing: dig +nocmd yourdomain.com any +multiline +noall +answer


36

Try: dig -tAXFR mycompany.com This may or may not work. Many DNS servers will deny a DNS Zone Transfer like this. For more information, see How the AXFR protocol works


31

You can use the @ syntax to look up the domain from a particular server. If the DNS server is authoritative for that domain, the response will not be a cached result. dig @ns1.example.com example.com You can find the authoritative servers by asking for the NS records for a domain: dig example.com NS


18

This is obviously a staged Q&A, but this tends to confuse people often and I can't find a canonical question covering the topic. dig +trace is a great diagnostic tool, but one aspect of its design is widely misunderstood: the IP of every server that will be queried is obtained from your resolver library. This is very easily overlooked and often only ...


15

You can also use host DNS lookup utility with -l switch: host -l domain.com Of course you need DNS zone transfer rights for this to work.


14

If you happen to be stuck on a windows box and only have access to nslookup: nslookup -qa=A -debug host.example.com authoritiative-dns-host-here.com


13

A much easier command to remember (and more informative) is: > dig google.com ANY Which returns the following: ; <<>> DiG 9.8.3-P1 <<>> google.com ANY ;; global options: +cmd ;; Got answer: ;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 31013 ;; flags: qr rd ra; QUERY: 1, ANSWER: 22, AUTHORITY: 0, ADDITIONAL: 3 ...


13

It's the default behaviour of dig not to use the search-option. From the manual page: +[no]search Use [do not use] the search list defined by the searchlist or domain directive in resolv.conf (if any). The search list is not used by default. Edit: Just add +search to make it work, like dig +search myhost.


10

Use sed -e "s/[[:space:]]\+/ /g" Here's an explanation: [ # start of character class [:space:] # The POSIX character class for whitespace characters. It's # functionally identical to [ \t\r\n\v\f] which matches a space, # tab, carriage return, newline, vertical tab, or form feed. See # ...


10

Is the value '43200' the TTL for this DNS record? Yes - as reported to you by the server that answered your query (if you're asking a caching server it will return the remaining time in its cache). To see the TTL set on the actual record query the authoritative nameserver (dig @some.dns.server host.example.gov - The authoritative DNS servers will be listed ...


10

Your query is incorrect, or to put it differently - no, there is no entry for socialimpactportfolio.com. Dig is telling you about the problem. The domain works in the browser, because it will helpfully try and add the www. prefix, and lo and behold: dig www.socialimpactportfolio.com ... www.socialimpactportfolio.com. 1783 IN CNAME ...


8

Use dig(1) with the +short flag instead: $ host -t txt google.com google.com descriptive text "v=spf1 include:_spf.google.com ip4:216.73.93.70/31 ip4:216.73.93.72/31 ~all" $ dig -t txt google.com +short "v=spf1 include:_spf.google.com ip4:216.73.93.70/31 ip4:216.73.93.72/31 ~all" If you want to remove the quotes, just filter the output through sed: $ ...


8

The timeout value is per try so setting a +time=5 would result in a 15 seconds delay as the default for +tries is 3. If you set +tries=1 then your command will timeout in 5 seconds e.g. time dig +time=5 @hii.com hello.me ; <<>> DiG 9.3.6-P1-RedHat-9.3.6-16.P1.el5_7.1 <<>> +time=5 @hii.com hello.me ; (1 server found) ;; global ...


8

To get authoritative information using dig you usually use a combination of +trace and @server. For example, if I want authorative information about www.google.com I would do it like this: # dig +trace NS google.com ; <<>> DiG 9.4.2-P2 <<>> +trace NS google.com ;; global options: printcmd . 3600000 IN NS ...


7

There's a hint about this on http://docstore.mik.ua/orelly/networking_2ndEd/dns/ch06_01.htm: In other words, an instance of the resolver still queries the first name server in resolv.conf first, but for the next domain name it looks up, it queries the second name server first, and so on. Note that many programs can't take advantage of this since most ...


7

On the CentOS box I have to hand dig +short www.google.com 74.125.132.147 74.125.132.99 74.125.132.103 74.125.132.104 74.125.132.105 74.125.132.106 If you only want one address then dig +short www.google.com | head -1 or dig +short www.google.com | tail -1


7

Dig reports the time left until the TTL expires rather than the actual TTL value. If the number varies, it is most likely that you're querying different DNS servers (for example, round robin) which have the record cached for different amounts of time, and therefore have different expiry times. If you run the same query against the same DNS server, you will ...


7

I'm not sure i get the whole picture but since you are writing about websites i think you are using a tool that is not exactly suitable for the task. imho you are looking for that information (the visited domain name) at the wrong level: you should have a proxy and analyze its logs to gather that info. A proxy is 'near' the client and has the exact and ...


6

You are being trolled by root hints. This one is tricky to troubleshoot, and it hinges on understanding that the . IN NS query sent at the start of a trace does not set the RD (recursion desired) flag on the packet. When Microsoft's DNS server receives a non-recursive request for the root nameservers, it's possible that they will return the configured root ...


6

The in-addr.arpa zone is delegated in much the same way as other zones: by using delegation NS records. Accordingly, suppose you were curious as to who had the authoritative DNS server for 192.0.2.0/24. This subnet mask is divisible by 8, and so you can do: dig in ns 2.0.192.in-addr.arpa Your answer will contain a list of nameservers serving the rDNS ...


6

Is there any way to query a dns server to find out all the domains it is the authoritative server? Short of doing millions and millions of queries in a brute-force style, no there is no way to do this. If you know one of the domains, and if they have enabled axfr for your IP, you can get a list of records for a single domain.


6

You can only ask a DNS-Server if it has a specific record. So, no there will be no such tool for DNS. Edit Zonetransfer is of course a possibility if it is available.


6

You can get a full list of entries in a zone with a zone transfer; you'd need to allow this for authorized systems in your DNS server. Once that's done, you can run the transfer and grep the result: dig axfr localdomain.com | grep -i miller


6

A name server will not, by design, let you search a zone or query what zones it is authoritative for. Beyond the obvious reason of reducing attack vectors (you can't make a HTTP/1.1 request to a host if you don't know its name), there is a very good reason for this: a zone can contain wildcards itself, so asking for every host in such a zone is like dividing ...


6

You probably need to open port 53 in your firewall to allow DNS traffic into your server. As you are using CentOS 5 iptables -I RH-Firewall-1-INPUT -p udp -m udp --dport 53 -j ACCEPT iptables -I RH-Firewall-1-INPUT -p tcp -m tcp --dport 53 -j ACCEPT Should get you going. If this works then service iptables save Will save your current firewall ...


6

dig wants the '-x' flag for reverse lookups on an IP. Alternately, you can use the full form, 'dig PTR 122.56.74.71.in-addr.arpa.'


6

The dig command is simple: % dig +dnssec www.isoc.org. ; <<>> DiG 9.6.0-APPLE-P2 <<>> +dnssec www.isoc.org. ;; global options: +cmd ;; Got answer: ;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 49304 ;; flags: qr rd ra ad; QUERY: 1, ANSWER: 2, AUTHORITY: 7, ADDITIONAL: 1 ;; OPT PSEUDOSECTION: ; EDNS: version: 0, ...


5

RFC 1035 says: MNAME The of the name server that was the original or primary source of data for this zone. although in practise this MNAME field in the SOA is mostly unused these days. However if you're using DNS dynamic updates then it must refer to the name of the DNS server which is to receive the dynamic update messages. See also this ...


5

Practically speaking, it's highly unlikely that the results you obtain from dig will have been falsified. If you want some sort of absolute assurance, though, you're out of luck -- without something like DNSSEC, spoofing is entirely possible.



Only top voted, non community-wiki answers of a minimum length are eligible