How to query DNS records with dig

DNS troubleshooting starts with a precise question: one owner name, one record type, and one resolver view. dig keeps the response code and resource-record sections visible, which makes an empty Answer section interpretable instead of treating every blank lookup as the same failure.

Without an @server argument, dig sends the query through a resolver listed in /etc/resolv.conf. The selected output view retains the DNS header, submitted question, returned records, and negative-response authority data while omitting timing and server statistics.

The header status and section counts distinguish three common outcomes. NOERROR with answer rows returns the requested RRset, NOERROR with no answer rows and an SOA authority record indicates NODATA for that type, and NXDOMAIN means the queried owner name does not exist.

1. Query the A RRset while retaining the response status, question, and answer rows.

   $ dig example.com A +noall +comments +question +answer
   ;; Got answer:
   ;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 53426
   ;; flags: qr rd ra ad; QUERY: 1, ANSWER: 2, AUTHORITY: 0, ADDITIONAL: 1
   
   ##### snipped #####
   ;; QUESTION SECTION:
   ;example.com.            IN      A
   
   ;; ANSWER SECTION:
   example.com.             242     IN      A       172.66.147.243
   example.com.             242     IN      A       104.20.23.154

   +noall clears the default display sections. The later +comments, +question, and +answer options restore the DNS header, submitted question, and returned records, so their order matters.

2. Read each answer row from owner name through record data.

   The fields are owner name, TTL in seconds, class, record type, and type-specific data. ANSWER: 2 matches the two resource records shown in the Answer section.

3. Query the AAAA RRset for the same owner name.

   $ dig example.com AAAA +noall +comments +question +answer
   ;; Got answer:
   ;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 44025
   ;; flags: qr rd ra ad; QUERY: 1, ANSWER: 2, AUTHORITY: 0, ADDITIONAL: 1
   
   ##### snipped #####
   ;; QUESTION SECTION:
   ;example.com.            IN      AAAA
   
   ;; ANSWER SECTION:
   example.com.             252     IN      AAAA    2606:4700:10::ac42:93f3
   example.com.             252     IN      AAAA    2606:4700:10::6814:179a

   The same query position accepts types such as MX, TXT, CNAME, NS, or CAA. Each type returns its own record-data format.

4. Inspect the authority data when an existing name has no record of the requested type.

   $ dig example.com CAA +noall +comments +question +answer +authority
   ;; Got answer:
   ;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 7949
   ;; flags: qr rd ra ad; QUERY: 1, ANSWER: 0, AUTHORITY: 1, ADDITIONAL: 1
   
   ##### snipped #####
   ;; QUESTION SECTION:
   ;example.com.            IN      CAA
   
   ;; AUTHORITY SECTION:
   example.com.             1000    IN      SOA     elliott.ns.cloudflare.com. dns.cloudflare.com. 2407636105 10000 2400 604800 1800

   NOERROR with ANSWER: 0 and the zone's SOA record is a NODATA response: the owner name exists, but this resolver found no CAA RRset.

5. Confirm that a nonexistent owner name reports NXDOMAIN.

   $ dig missing.invalid A +noall +comments +question +answer +authority
   ;; Got answer:
   ;; ->>HEADER<<- opcode: QUERY, status: NXDOMAIN, id: 47031
   ;; flags: qr rd ra ad; QUERY: 1, ANSWER: 0, AUTHORITY: 1, ADDITIONAL: 1
   
   ##### snipped #####
   ;; QUESTION SECTION:
   ;missing.invalid.        IN      A
   
   ;; AUTHORITY SECTION:
   .                        86400   IN      SOA     a.root-servers.net. nstld.verisign-grs.com. 2026071201 1800 900 604800 86400

   NXDOMAIN identifies a missing owner name, unlike the NOERROR NODATA response for an existing name without the requested record type.