What are nslookup and dig, and how do you use them to troubleshoot DNS issues?

Question

Accepted Answer

Nslookup and dig are command-line tools used to query DNS servers and troubleshoot name resolution problems. Since DNS is often the cause of connectivity issues ("the internet is down" is frequently actually "DNS is not resolving"), knowing how to use these tools is essential for every network engineer.

Nslookup (name server lookup) is available on all major operating systems. In its simplest form, nslookup example.com queries your configured DNS server for the A record of example.com and returns the IP address. The output shows which DNS server answered the query and the resulting IP address. You can query a specific DNS server by adding it as a second argument: nslookup example.com 8.8.8.8 asks Google's DNS server directly. This is useful for determining if the problem is with your local DNS server or DNS in general.

Nslookup has an interactive mode (just type nslookup and press enter) where you can change settings and run multiple queries. Use set type=mx to query MX records, set type=ns for name server records, or set type=any to see all record types. The server command changes which DNS server you are querying.

Dig (Domain Information Groper) is a more powerful and flexible DNS query tool, standard on Linux and macOS (available for Windows via BIND installation). The basic syntax is dig example.com which returns detailed output including the question section (what was asked), answer section (the response), authority section (which name servers are authoritative), and additional section (extra helpful information). The output also shows the query time in milliseconds, which server responded, and the TTL values.

Useful dig options include dig example.com MX for mail server records, dig example.com +short for a concise answer-only output, dig -x 93.184.216.34 for reverse DNS lookup, dig example.com @8.8.8.8 to query a specific server, and dig +trace example.com to follow the entire DNS resolution chain from root servers to authoritative servers. The trace option is particularly valuable because it shows each step of the resolution process, helping you identify exactly where a DNS problem occurs.

Common DNS troubleshooting scenarios where these tools are useful include: verifying a DNS record was updated correctly after a change (check the TTL to know when the old record will expire), comparing results from different DNS servers to identify propagation delays, testing if a specific DNS server is responding at all, checking for incorrect CNAME chains or missing records, and verifying reverse DNS (PTR) records which are important for email delivery.

When troubleshooting, always test with both the local DNS server and a public one like 8.8.8.8 or 1.1.1.1. If the public server works but the local one does not, the problem is with the local DNS configuration. If neither works, the issue is either with the domain's DNS records or connectivity to DNS servers.