isitdns? dns is hard

Dig reader: paste the output of one query and read it

dig reader

Run one query where it is broken, paste what it printed, and read it here. The paste stays in this page.

1. paste dig, nslookup or Resolve-DnsName output, then read

what it reads
  • dig: full output, +short and +dnssec.
  • nslookup: Windows and BIND.
  • PowerShell Resolve-DnsName: table and list output.
  • The question, the server that answered (a private address reads as a private resolver), the rcode, each flag, EDE, TTLs, the answer and authority sections, the query time.
  • Signs: an answer in RFC 5737 space, TC set, SERVFAIL with an EDE, NXDOMAIN with an EDE or an answer such as 0.0.0.0, and AD missing on a zone the internet's answer shows signed.
example

Saved example. dig +https @1.1.1.1 example.com A, run 2026-10-30T16:09:08Z from an isitdns test machine, asked over DoH, read by this page.

format        dig (DiG 9.18.39)
question      example.com  A
answered by   a resolver at a public address over HTTPS
rcode         NOERROR: no error
flags         qr: a response
              rd: recursion desired: the query asked the server to resolve the name all the way
              ra: recursion available: the server resolves names for its clients
              ad: authenticated data: the server says it validated the answer with DNSSEC
              not set: aa tc cd
EDNS          EDNS version 0, UDP size 1232
EDE           none in this answer
TTLs          284 s
answer (2)    example.com.  284  IN  A  104.20.23.154
              example.com.  284  IN  A  172.66.147.243
authority (0) empty
query time    36 ms
size          72 bytes
signs         none of the ones this reader names
not measured  one query, at one moment, from your own network; another client, resolver or minute can read differently
from your own machine
dig example.com A
nslookup example.com
Resolve-DnsName example.com

Run it on the machine where the name fails, then paste all of what it printed.

the manual
other jobs