Tools
dig flag reference
Header flags#
| Flag | Meaning | RFC |
|---|---|---|
qr | 0 = query, 1 = response | RFC 1035 §4.1.1 |
aa | Authoritative answer: the responder is the zone's source of truth, not a cache | RFC 1035 §4.1.1 |
tc | Truncated: the answer did not fit, retry over TCP | RFC 1035 §4.1.1 |
rd | Recursion desired, set by the client and echoed back | RFC 1035 §4.1.1 |
ra | Recursion available: the server offers it | RFC 1035 §4.1.1 |
ad | Authentic data: the resolver validated the answer with DNSSEC | RFC 4035 §3.2.3 |
cd | Checking disabled: asks the resolver to skip DNSSEC validation | RFC 4035 §3.2.2 |
A response carrying rd ra with no aa, from a server you named directly, can mean a middlebox answered port 53 itself instead of the named server.
Asks the zone authority itself, so the aa flag is set.
dig -4 @coleman.ns.cloudflare.com example.isitdns.net; <<>> DiG 9.20.11-0ubuntu0.2-Ubuntu <<>> -4 @coleman.ns.cloudflare.com example.isitdns.net
; (3 servers found)
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 19959
;; flags: qr aa rd; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 1
;; WARNING: recursion requested but not available
;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 1232
;; QUESTION SECTION:
;example.isitdns.net. IN A
;; ANSWER SECTION:
example.isitdns.net. 300 IN A 192.0.2.1
;; Query time: 35 msec
;; SERVER: 172.64.35.64#53(coleman.ns.cloudflare.com) (UDP)
;; WHEN: Mon Sep 14 17:52:09 CDT 2026
;; MSG SIZE rcvd: 64
GO aa on the flags line, and no ra, because this authority does not recurse
NO GO ra with no aa, which means you reached a resolver and not the authority
Reading the output#
What each part of a dig answer says, in one line each. Every dig block on this wiki links here.
| In the output | What it says |
|---|---|
qr | This message is the answer coming back, not the question going out. |
aa | This server says it is the authority for this name, not a cache holding a copy. |
tc | What came back is cut short. Ask again over TCP to get all of it. |
rd | You asked this server to go and find the answer for you. |
ra | This server says it is willing to go and find answers for you. |
ad | This server says it checked the signatures, and they held up. |
cd | You told the server to hand the answer over even if its signatures do not check out. |
IN A | You asked for the IPv4 address this name points at. |
300 | How many seconds this answer can be reused before asking again. From a cache it is the time left, so it counts down. |
Query time | How long this one lookup took, start to finish. |
The flags are the server's own word (RFC 1035 section 4.1.1, RFC 4035 section 3.2.3), not a measurement this page made. What the status word means: glossary.
Which server to ask#
| Flag | What it does |
|---|---|
@server | Ask server (IP or hostname). Default is /etc/resolv.conf. |
-4 | IPv4 only |
-6 | IPv6 only |
+tcp | Force TCP; default is UDP with a retry over TCP on tc (BIND 9 manpage) |
+ignore | Keep a truncated UDP answer instead of retrying over TCP, for testing the UDP path. +notcp does not do this: the manpage names +ignore, not +notcp, as the way to stop the TCP retry (BIND 9 manpage) |
+tls | DoT (RFC 7858); requires kdig from knot-dnsutils, or BIND dig 9.18+ |
+https=/dns-query | DoH (RFC 8484); requires kdig from knot-dnsutils, or BIND dig 9.18+. The served next: and repro commands print the endpoint's own path when it is not /dns-query, for example +https=/doh/security-filter/ (CleanBrowsing) or +https=/p2 (Control D) |
What kind of query#
| Flag | What it does |
|---|---|
+norecurse (+nordflag) | Clear the RD bit: ask the server not to recurse for you. Authoritative servers answer RD=0 normally, since that is exactly what recursive resolvers send them. Useful for asking a resolver to answer only from what it already has cached. |
+trace | Walk the delegation chain from root yourself. Skips the resolver's cache. |
+nssearch | Find the SOA at each authoritative NS and compare serials: a quick replication-health check |
-x <IP> | Reverse lookup. Shorthand for dig PTR <reversed-IP>.in-addr.arpa. See ptr. |
DNSSEC#
| Flag | What it does |
|---|---|
+dnssec | Set the DO (DNSSEC OK) bit: the server may return RRSIG records alongside the answer (RFC 6891 §6.1.4). See dnssec. |
+cd | Set CD (Checking Disabled): ask the resolver to skip DNSSEC validation (RFC 4035 §3.2.2). Useful for seeing the raw answer when validation is breaking things. |
+adflag | Set the AD bit in the query; the resolver echoes AD=1 in the response if it validated the answer (RFC 4035 §3.2.3). Set by default in modern dig (BIND 9 manpage: "This bit is set by default"). |
+nocrypto | In dig and delv, suppress the cryptographic fields in DNSSEC records (BIND 9 manpage) |
delv | Validates DNSSEC against its own built-in trust anchor instead of trusting the resolver's AD bit. See dnssec-troubleshooting. |
EDNS / buffer#
| Flag | What it does |
|---|---|
+bufsize=N | Advertise an EDNS0 UDP buffer of N bytes. Default 1232 in modern dig. |
+nsid | Ask the server to identify itself via EDNS NSID: useful when querying anycast pools. Requires the server to support and advertise NSID; many public resolvers do not respond with one. |
+subnet=<CIDR> | Send EDNS Client Subnet (the resolver-injects-client-location feature) |
+noedns | Strip the OPT record from the query. The response then has nowhere to carry an Extended DNS Error, so the reason for a failure disappears with it. See extended-dns-errors. |
There is no flag for Extended DNS Errors (RFC 8914). dig prints the EDE: line whenever the response carries the option, from BIND 9.16.4 onward (CHANGES entry 5408, "Print Extended DNS Errors if present in OPT record"), and +ede is rejected as an invalid option on DiG 9.20.24.
Output volume#
| Flag | What it does |
|---|---|
+short | One line per record, only the data: best for scripts |
| (default) | Full sections: question, answer, authority, additional, plus timing |
+noall +answer | Only the answer section, but still formatted |
+stats | Force the stats footer (default on, but useful with +noall) |
+nostats | Hide the stats footer |
+comments / +nocomments | Toggle the ;; header lines |