isitdns? wiki/Tools/The dig-along
Tools

The dig-along

Every command pins the resolver with @1.1.1.1 so you and this page ask the same server; drop it and the query goes to whatever resolver your system is set to. The records live under example.isitdns.net. Explanation of each type is on its own record page, linked below each block; TTLs are published at 300 seconds and count down, so a lower number means a cache answered.

Asks an alias for its default type, which is A.

 dig @1.1.1.1 cname.example.isitdns.net
; <<>> DiG 9.20.11-0ubuntu0.2-Ubuntu <<>> @1.1.1.1 cname.example.isitdns.net
; (1 server found)
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 63913
;; flags: qr rd ra ad; QUERY: 1, ANSWER: 2, AUTHORITY: 0, ADDITIONAL: 1
;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 1232
;; QUESTION SECTION:
;cname.example.isitdns.net. IN A
;; ANSWER SECTION:
cname.example.isitdns.net. 300 IN CNAME example.isitdns.net.
example.isitdns.net. 300 IN A 192.0.2.1
;; Query time: 37 msec
;; SERVER: 1.1.1.1#53(1.1.1.1) (UDP)
;; WHEN: Mon Sep 14 17:42:31 CDT 2026
;; MSG SIZE rcvd: 84

GO NOERROR, the CNAME, then the A it points at

NO GO NOERROR with only the CNAME, which means the target did not resolve

run this query in the dig tool →

what each part of this output means →

1. A: the IPv4 record#

dig @1.1.1.1 +short A example.isitdns.net
192.0.2.1

Read: one IPv4 address. 192.0.2.0/24 is documentation space (RFC 5737). See A record reference.

2. AAAA: the IPv6 record#

dig @1.1.1.1 +short AAAA example.isitdns.net
2001:db8::1

Read: one IPv6 address. 2001:db8::/32 is the IPv6 documentation prefix (RFC 3849). See AAAA record reference.

3. CNAME: aliases#

dig @1.1.1.1 chain.example.isitdns.net
chain.example.isitdns.net.  300 IN CNAME  cname.example.isitdns.net.
cname.example.isitdns.net.  300 IN CNAME  example.isitdns.net.
example.isitdns.net.        300 IN A      192.0.2.1

Read: a two-hop chain, resolved transparently down to the A record. See CNAME record reference for the apex rule, the chain-length behavior, and why this is not a redirect.

4. Wildcard: * matches anything#

dig @1.1.1.1 +short A one.two.wildcard.example.isitdns.net
192.0.2.1

Read: *.wildcard.example.isitdns.net synthesizes an answer for any name below it with no closer explicit match, at any depth (RFC 4592). See wildcard record definition.

5. TXT: arbitrary text#

dig @1.1.1.1 +short TXT txt.example.isitdns.net
"It was DNS. It is always DNS."

Read: one quoted string. A longer one, split across the wire's 255-byte string limit:

dig @1.1.1.1 +short TXT long.example.isitdns.net
"This TXT string is longer than 255 bytes, so DNS splits it into multiple character strings that get re-joined on the client side. It is the same wire-format trick used heavily by SPF, DKIM, and DMARC, whose records routinely exceed the" " 255-byte single-string cap and must be chunked the same way."

Read: two quoted segments, joined back into one string by the consumer, not by dig. See TXT record reference.

6. MX: mail exchange#

dig @1.1.1.1 +short MX mx.example.isitdns.net
10 mx.example.com.

Read: 10 is the preference; lowest wins. See MX record reference.

7. SRV: service location#

dig @1.1.1.1 +short SRV _xmpp-server._tcp.example.isitdns.net
10 5 5269 example.com.

Read: priority weight port target (RFC 2782). See SRV record reference.

8. CAA: who's allowed to issue certs#

dig @1.1.1.1 +short CAA caa.example.isitdns.net
0 issue "letsencrypt.org"

Read: only the named CA is authorized to issue for this name. See CAA record reference and caa-policy for the policy model.

9. NS: delegation#

dig @1.1.1.1 +short NS isitdns.net
coleman.ns.cloudflare.com.
hera.ns.cloudflare.com.

Read: the authoritative nameservers for the whole zone. See NS record reference and delegations.

10. SOA: zone authority#

dig @1.1.1.1 +short SOA isitdns.net
coleman.ns.cloudflare.com. dns.cloudflare.com. 2406968847 10000 2400 604800 1800

Read: primary NS, admin email, serial, refresh, retry, expire, minimum. The serial you see will differ; it increments on every zone change. See SOA record reference.

11. The DNSSEC ad flag#

dig @1.1.1.1 +dnssec isitdns.net A | grep -E "flags:|RRSIG"
;; flags: qr rd ra ad; QUERY: 1, ANSWER: 3, AUTHORITY: 0, ADDITIONAL: 1
isitdns.net.  300 IN RRSIG A 13 2 300 20260718135341 20260716115341 34505 isitdns.net. ...

Read: the RRSIG confirms the zone is signed; the ad flag means a validating resolver checked the whole chain. A local proxy or router can strip ad without breaking anything; dnssec covers the DoH way to see it reliably.

To see a broken chain fail closed:

dig @1.1.1.1 dnssec-failed.org
;; ->>HEADER<<- opcode: QUERY, status: SERVFAIL, id: ...

Read: SERVFAIL because the zone's DNSKEYs don't match its parent DS record. See dnssec-troubleshooting.

12. PTR: reverse DNS#

dig @1.1.1.1 +short PTR 2.1.1.1.in-addr.arpa
security.cloudflare-dns.com.

Read: 1.1.1.2 reversed onto the wire as 2.1.1.1.in-addr.arpa (dig -x 1.1.1.2 does the flip for you). 192.0.2.1 has no reverse zone; nobody owns documentation space. See PTR record reference and reverse-dns.

See also#