online dig

The answer in dig's output format.

isitdns.net/#dig adds DoT, Do53 over TCP and UDP, IPv6, any public resolver address, the flags below, and the dig, kdig and nslookup command for each query.

the tool

Dig one record

Asks a public resolver, or four side by side, for one record and shows the answer, its flags, the rcode and the time it took.

from where

The isitdns edge over DoH. With from set, that region's probe over Do53 UDP.

what it does not read

A resolver that is not on the board.
Your own resolver or network path.
A whole domain's health: that is check_domain.

inputs

input	type	default	what it is
`name` required	string		The name, e.g. _dmarc.example.com. Also as "domain"; a URL is read as its host.
`type`	string	`"A"`	Record type, e.g. A, MX, TXT, DS, HTTPS, or TYPE<n>
`resolver`	string	`"cloudflare"`	Any resolver on the board, by its id, address (8.8.8.8) or host name (dns.google), or all for Cloudflare, Google, Quad9 and AdGuard side by side
`dnssec`	boolean	`true`	Set the DO bit and read AD
`cd`	boolean	`false`	Ask the resolver not to validate
`ecs`	string		EDNS Client Subnet, e.g. 192.0.2.0/24
`norec`	boolean	`false`	Clear RD, like dig +norec
`nsid`	boolean	`false`	Request NSID (RFC 5001)
`family`	string	`"v4"`	v4 or v6 for a probe's plain-DNS ask, or both side by side. One of `v4`, `v6`, `both`
`from`	string		Ask over Do53/UDP from the probe in this region (no other transport). One of `north-america`, `europe`
`follow`	boolean	`false`	Also walk the CNAME chain from this name, hop by hop, to its addresses

the call

{"name":"dig","arguments":{"name":"example.com","type":"A","resolver":"all"}}

Over MCP at https://isitdns.net/mcp: connect a client.

examples

dig @1.1.1.1 example.com A +dnssec A records and their RRSIG
dig @1.1.1.1 example.com MX a null MX, RFC 7505: this domain takes no mail
dig @1.1.1.1 isitdns.net TXT the TXT records, SPF among them
dig @1.1.1.1 iana.org DNSKEY a signed zone's keys, KSK and ZSK
dig @1.1.1.1 nonexistent.example A NXDOMAIN, the root SOA and NSEC records in AUTHORITY
dig @94.140.14.14 doubleclick.net A an ad blocker answering 0.0.0.0, with EDE 17 Filtered

what it runs

from: the isitdns edge, not your network. Your own dig goes through your local path, where many routers and firewalls answer port 53 themselves. Where the two differ: compare resolver, transport, time and the authoritative answer.
wire: DoH, RFC 8484, application/dns-message
DO=1 (+dnssec), CD=0: an ad flag means that resolver validated the answer.
The list above is the 15 public resolvers that publish a DoH endpoint. The last option asks the four operators side by side: Cloudflare, Google, Quad9 and AdGuard.
Rate limit: 100 requests a minute per client IP address. No key, no account.
cannot: ask Cloudflare's resolvers over DoT or TCP (a Worker cannot open a TCP socket to a Cloudflare address, Cloudflare's TCP sockets docs; 1.1.1.1 works over DoH, and over UDP from a probe); see your path; retry (one query per run: 8 s for DoH, 3.5 s for DoT and TCP, 4 s for UDP, which transport=udp53 asks from a probe, not the edge).

flags

The form sends +dnssec. The URL form, /api/query?name=example.com&type=MX, takes:

dnssec=0 clears the DO bit; the default is dnssec=1.
cd=1 is +cdflag: return the answer without validating it.
norec=1 is +norec: RD=0.
nsid=1 is +nsid (RFC 5001): prints the server's NSID when it sends one.
ecs=192.0.2.0/24 is +subnet (RFC 7871): sends that client subnet.
transport=doh|dot|tcp53|udp53, default doh; udp53 is asked from a probe. family=v4|v6|both: the address family dialled over DoT and Do53, default v4; DoH ignores it.
type= also takes a number or TYPEnn (RFC 3597); a type the decoder does not know prints as \# <length> <hex>.
Extended DNS Errors (RFC 8914) print on the EDE line; EDE: none received when the server sent none.

From a terminal: curl -sL isitdns.net/dig/example.com/MX

the manual

Online dig: run dig from your browser