dig: DNS record lookups from the command line
Query A/MX/NS/TXT records, do reverse lookups, trace resolution paths, and attempt zone transfers.
bash·1 min read··INE Certification
dig is the general purpose DNS querying tool. It’s useful for legitimate troubleshooting and equally useful for recon, since misconfigured DNS servers leak far more than they should.
Common lookups
dig example.com # basic A record lookup
dig example.com MX # specific record type
dig @8.8.8.8 example.com # query a specific nameserver instead of your default resolver
dig +short example.com # answer only, no header noise
dig -x 8.8.8.8 # reverse lookup (PTR record)
dig +trace example.com # show every hop from root servers downZone transfer
dig axfr @<nameserver> <domain> # attempt a zone transferRelated
- Passive information gathering & OSINT: where DNS lookups fit in the recon sequence
- OSINT and DNS recon toolbelt: dnsenum, dnsrecon and fierce also attempt zone transfers
- Gobuster: its
dnsmode brute-forces subdomains