dig is a troubleshooting tool, so it sends DNS queries and receives DNS answers and as Andreas said the answer is both CNAME and A records, as designed. Your wish is to give "Just the IP, ma'am.", so that is not a DNS troubleshooting, it is "just" the resolution, for which
dig is too much.
nslookup is inferior to
dig but will still give you too much:
$ nslookup docs.sbonds.org
docs.sbonds.org canonical name = ghs.google.com.
host is simpler but will still return "too much" for you (but note that it returns also the IPv6 address which is good):
$ host docs.sbonds.org
docs.sbonds.org is an alias for ghs.google.com.
ghs.google.com has address 126.96.36.199
ghs.google.com has IPv6 address 2607:f8b0:4004:815::2013
Depending on your Unix system,
getent can be used. Note however that this may or may not do a DNS query because you configure in
/etc/nsswitch.conf the source of data per service, and for
hosts it will probably be a mix of both
files (which is the venerable
/etc/hosts) and the DNS.
$ getent hosts docs.sbonds.org
2607:f8b0:4007:801::2013 ghs.google.com docs.sbonds.org
Observe also that on a proper Unix setup it will favor IPv6 over IPv4 so that may be a problem for you (this should depend on the configuration in
hosts does not honor
/etc/gai.conf, you need to use
ahosts instead, which will use
getaddrinfo and hence
gai.conf. Observe that you get a list (whose order depends on
$ getent ahosts docs.sbonds.org
188.8.131.52 STREAM ghs.google.com
If you are allowed to write a simple script, you have many solutions, like:
$ perl -MSocket -E 'say inet_ntoa(inet_aton("docs.sbonds.org"))'
Or use any DOH (DNS over HTTPS) endpoint (or similar) with any HTTP client. Examples:
$ curl --silent 'https://dns.google.com/resolve?name=docs.sbonds.org&type=A' | jq -c '.Answer | select(.type == 1) | .data'
$ curl --silent -H 'accept: application/dns-json' 'https://cloudflare-dns.com/dns-query?name=docs.sbonds.org&type=A' | jq -c '.Answer | select(.type == 1) | .data'
Systemd has its own resolver application:
$ systemd-resolve docs.sbonds.org
-- Information acquired via protocol DNS in 239.1ms.
-- Data is authenticated: no
You still need to parse it in some way, but it does give the direct final IP addresses (there is a flag when you invoke it to make it not follow
CNAME records for whatever use cases that need that)