Tag Info

Hot answers tagged

55

Yes, the number there is the number of seconds left until that record expires (providing we're not querying the authoritative nameserver). Obviously with a CNAME there's a level of redirection, so the TTL for the A record it points to in this case may be important as well. If you wait a couple of seconds and run dig again on your local nameserver, you ...


52

The short answer is to your specific question of listing CNAMEs is that you can't without permission to do zone transfers (see How to list all CNAME records for a given domain?). That said, you can use dig to list the other records by doing: dig +nocmd yourdomain.com any +multiline +noall +answer


32

Try: dig -tAXFR mycompany.com This may or may not work. Many DNS servers will deny a DNS Zone Transfer like this. For more information, see How the AXFR protocol works


21

You can use the @ syntax to look up the domain from a particular server. If the DNS server is authoritative for that domain, the response will not be a cached result. dig @ns1.example.com example.com You can find the authoritative servers by asking for the NS records for a domain: dig example.com NS


15

This is obviously a staged Q&A, but this tends to confuse people often and I can't find a canonical question covering the topic. dig +trace is a great diagnostic tool, but one aspect of its design is widely misunderstood: the IP of every server that will be queried is obtained from your resolver library. This is very easily overlooked and often only ...


11

It's the default behaviour of dig not to use the search-option. From the manual page: +[no]search Use [do not use] the search list defined by the searchlist or domain directive in resolv.conf (if any). The search list is not used by default. Edit: Just add +search to make it work, like dig +search myhost.


10

Your query is incorrect, or to put it differently - no, there is no entry for socialimpactportfolio.com. Dig is telling you about the problem. The domain works in the browser, because it will helpfully try and add the www. prefix, and lo and behold: dig www.socialimpactportfolio.com ... www.socialimpactportfolio.com. 1783 IN CNAME ...


9

You can also use host DNS lookup utility with -l switch: host -l domain.com Of course you need DNS zone transfer rights for this to work.


8

A much easier command to remember (and more informative) is: > dig google.com ANY Which returns the following: ; <<>> DiG 9.8.3-P1 <<>> google.com ANY ;; global options: +cmd ;; Got answer: ;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 31013 ;; flags: qr rd ra; QUERY: 1, ANSWER: 22, AUTHORITY: 0, ADDITIONAL: 3 ...


8

Is the value '43200' the TTL for this DNS record? Yes - as reported to you by the server that answered your query (if you're asking a caching server it will return the remaining time in its cache). To see the TTL set on the actual record query the authoritative nameserver (dig @some.dns.server host.example.gov - The authoritative DNS servers will be listed ...


8

To get authoritative information using dig you usually use a combination of +trace and @server. For example, if I want authorative information about www.google.com I would do it like this: # dig +trace NS google.com ; <<>> DiG 9.4.2-P2 <<>> +trace NS google.com ;; global options: printcmd . 3600000 IN NS ...


8

Use dig(1) with the +short flag instead: $ host -t txt google.com google.com descriptive text "v=spf1 include:_spf.google.com ip4:216.73.93.70/31 ip4:216.73.93.72/31 ~all" $ dig -t txt google.com +short "v=spf1 include:_spf.google.com ip4:216.73.93.70/31 ip4:216.73.93.72/31 ~all" If you want to remove the quotes, just filter the output through sed: $ ...


7

If you happen to be stuck on a windows box and only have access to nslookup: nslookup -qa=A -debug host.example.com authoritiative-dns-host-here.com


7

On the CentOS box I have to hand dig +short www.google.com 74.125.132.147 74.125.132.99 74.125.132.103 74.125.132.104 74.125.132.105 74.125.132.106 If you only want one address then dig +short www.google.com | head -1 or dig +short www.google.com | tail -1


7

You can only ask a DNS-Server if it has a specific record. So, no there will be no such tool for DNS. Edit Zonetransfer is of course a possibility if it is available.


6

dig wants the '-x' flag for reverse lookups on an IP. Alternately, you can use the full form, 'dig PTR 122.56.74.71.in-addr.arpa.'


6

There's a hint about this on http://docstore.mik.ua/orelly/networking_2ndEd/dns/ch06_01.htm: In other words, an instance of the resolver still queries the first name server in resolv.conf first, but for the next domain name it looks up, it queries the second name server first, and so on. Note that many programs can't take advantage of this since most ...


6

You probably need to open port 53 in your firewall to allow DNS traffic into your server. As you are using CentOS 5 iptables -I RH-Firewall-1-INPUT -p udp -m udp --dport 53 -j ACCEPT iptables -I RH-Firewall-1-INPUT -p tcp -m tcp --dport 53 -j ACCEPT Should get you going. If this works then service iptables save Will save your current firewall ...


6

The timeout value is per try so setting a +time=5 would result in a 15 seconds delay as the default for +tries is 3. If you set +tries=1 then your command will timeout in 5 seconds e.g. time dig +time=5 @hii.com hello.me ; <<>> DiG 9.3.6-P1-RedHat-9.3.6-16.P1.el5_7.1 <<>> +time=5 @hii.com hello.me ; (1 server found) ;; global ...


6

Use sed -e "s/[[:space:]]\+/ /g" Here's an explanation: [ # start of character class [:space:] # The POSIX character class for whitespace characters. It's # functionally identical to [ \t\r\n\v\f] which matches a space, # tab, carriage return, newline, vertical tab, or form feed. See # ...


6

The in-addr.arpa zone is delegated in much the same way as other zones: by using delegation NS records. Accordingly, suppose you were curious as to who had the authoritative DNS server for 192.0.2.0/24. This subnet mask is divisible by 8, and so you can do: dig in ns 2.0.192.in-addr.arpa Your answer will contain a list of nameservers serving the rDNS ...


6

Is there any way to query a dns server to find out all the domains it is the authoritative server? Short of doing millions and millions of queries in a brute-force style, no there is no way to do this. If you know one of the domains, and if they have enabled axfr for your IP, you can get a list of records for a single domain.


6

You are being trolled by root hints. This one is tricky to troubleshoot, and it hinges on understanding that the . IN NS query sent at the start of a trace does not set the RD (recursion desired) flag on the packet. When Microsoft's DNS server receives a non-recursive request for the root nameservers, it's possible that they will return the configured root ...


5

The dig command is simple: % dig +dnssec www.isoc.org. ; <<>> DiG 9.6.0-APPLE-P2 <<>> +dnssec www.isoc.org. ;; global options: +cmd ;; Got answer: ;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 49304 ;; flags: qr rd ra ad; QUERY: 1, ANSWER: 2, AUTHORITY: 7, ADDITIONAL: 1 ;; OPT PSEUDOSECTION: ; EDNS: version: 0, ...


5

Practically speaking, it's highly unlikely that the results you obtain from dig will have been falsified. If you want some sort of absolute assurance, though, you're out of luck -- without something like DNSSEC, spoofing is entirely possible.


5

Root servers don't answer queries for second-level domains. gTLD servers don't answer queries for second-level domains (other than returning the name servers for second-level domains). The authoratative name servers for the second-level domain answer queries for that second-level domain. You can query a gTLD to find the name servers for a specific domain and ...


5

Google is not going to let you do a zone transfer from them. Zone transfer permissions are in most cases granted only to a very specific subset of other hosts, and almost never to the public at large.


5

The primary problem is most likely that the DNS port 53 will be filtered out at some point before your server (or even with a firewall rule on your server). Some other hints: It's usually not a good idea to run both name servers on the same machine and network. Also, it's very unusual to run the DNS server for your domain in the first place. It's not ...


5

This happens in dual stack IPv4/IPv6 environments where the machine doing a DNS lookup sends requests for AAAA and A records on the same socket, expecting to receive two replies back. This is default behavior for relatively recent versions of glibc. The Juniper firewall, however, drops the connection after the first reply comes back. The Juniper knowledge ...


4

RFC 1035 says: MNAME The of the name server that was the original or primary source of data for this zone. although in practise this MNAME field in the SOA is mostly unused these days. However if you're using DNS dynamic updates then it must refer to the name of the DNS server which is to receive the dynamic update messages. See also this ...



Only top voted, non community-wiki answers of a minimum length are eligible