402 lines
15 KiB
Groff
402 lines
15 KiB
Groff
.\" Copyright (C) 2004 Internet Systems Consortium, Inc. ("ISC")
|
|
.\" Copyright (C) 2000-2003 Internet Software Consortium.
|
|
.\"
|
|
.\" Permission to use, copy, modify, and distribute this software for any
|
|
.\" purpose with or without fee is hereby granted, provided that the above
|
|
.\" copyright notice and this permission notice appear in all copies.
|
|
.\"
|
|
.\" THE SOFTWARE IS PROVIDED "AS IS" AND ISC DISCLAIMS ALL WARRANTIES WITH
|
|
.\" REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
|
|
.\" AND FITNESS. IN NO EVENT SHALL ISC BE LIABLE FOR ANY SPECIAL, DIRECT,
|
|
.\" INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
|
|
.\" LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE
|
|
.\" OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
|
|
.\" PERFORMANCE OF THIS SOFTWARE.
|
|
.\"
|
|
.\" $Id: dig.1,v 1.14.2.4.2.6 2004/06/23 09:11:01 marka Exp $
|
|
.\"
|
|
.TH "DIG" "1" "Jun 30, 2000" "BIND9" ""
|
|
.SH NAME
|
|
dig \- DNS lookup utility
|
|
.SH SYNOPSIS
|
|
.sp
|
|
\fBdig\fR [ \fB@server\fR ] [ \fB-b \fIaddress\fB\fR ] [ \fB-c \fIclass\fB\fR ] [ \fB-f \fIfilename\fB\fR ] [ \fB-k \fIfilename\fB\fR ] [ \fB-p \fIport#\fB\fR ] [ \fB-t \fItype\fB\fR ] [ \fB-x \fIaddr\fB\fR ] [ \fB-y \fIname:key\fB\fR ] [ \fB-4\fR ] [ \fB-6\fR ] [ \fBname\fR ] [ \fBtype\fR ] [ \fBclass\fR ] [ \fBqueryopt\fR\fI...\fR ]
|
|
.sp
|
|
\fBdig\fR [ \fB-h\fR ]
|
|
.sp
|
|
\fBdig\fR [ \fBglobal-queryopt\fR\fI...\fR ] [ \fBquery\fR\fI...\fR ]
|
|
.SH "DESCRIPTION"
|
|
.PP
|
|
\fBdig\fR (domain information groper) is a flexible tool
|
|
for interrogating DNS name servers. It performs DNS lookups and
|
|
displays the answers that are returned from the name server(s) that
|
|
were queried. Most DNS administrators use \fBdig\fR to
|
|
troubleshoot DNS problems because of its flexibility, ease of use and
|
|
clarity of output. Other lookup tools tend to have less functionality
|
|
than \fBdig\fR.
|
|
.PP
|
|
Although \fBdig\fR is normally used with command-line
|
|
arguments, it also has a batch mode of operation for reading lookup
|
|
requests from a file. A brief summary of its command-line arguments
|
|
and options is printed when the \fB-h\fR option is given.
|
|
Unlike earlier versions, the BIND9 implementation of
|
|
\fBdig\fR allows multiple lookups to be issued from the
|
|
command line.
|
|
.PP
|
|
Unless it is told to query a specific name server,
|
|
\fBdig\fR will try each of the servers listed in
|
|
\fI/etc/resolv.conf\fR.
|
|
.PP
|
|
When no command line arguments or options are given, will perform an
|
|
NS query for "." (the root).
|
|
.PP
|
|
It is possible to set per-user defaults for \fBdig\fR via
|
|
\fI${HOME}/.digrc\fR. This file is read and any options in it
|
|
are applied before the command line arguments.
|
|
.SH "SIMPLE USAGE"
|
|
.PP
|
|
A typical invocation of \fBdig\fR looks like:
|
|
.sp
|
|
.nf
|
|
dig @server name type
|
|
.sp
|
|
.fi
|
|
where:
|
|
.TP
|
|
\fBserver\fR
|
|
is the name or IP address of the name server to query. This can be an IPv4
|
|
address in dotted-decimal notation or an IPv6
|
|
address in colon-delimited notation. When the supplied
|
|
\fIserver\fR argument is a hostname,
|
|
\fBdig\fR resolves that name before querying that name
|
|
server. If no \fIserver\fR argument is provided,
|
|
\fBdig\fR consults \fI/etc/resolv.conf\fR
|
|
and queries the name servers listed there. The reply from the name
|
|
server that responds is displayed.
|
|
.TP
|
|
\fBname\fR
|
|
is the name of the resource record that is to be looked up.
|
|
.TP
|
|
\fBtype\fR
|
|
indicates what type of query is required \(em
|
|
ANY, A, MX, SIG, etc.
|
|
\fItype\fR can be any valid query type. If no
|
|
\fItype\fR argument is supplied,
|
|
\fBdig\fR will perform a lookup for an A record.
|
|
.SH "OPTIONS"
|
|
.PP
|
|
The \fB-b\fR option sets the source IP address of the query
|
|
to \fIaddress\fR. This must be a valid address on
|
|
one of the host's network interfaces or "0.0.0.0" or "::". An optional port
|
|
may be specified by appending "#<port>"
|
|
.PP
|
|
The default query class (IN for internet) is overridden by the
|
|
\fB-c\fR option. \fIclass\fR is any valid
|
|
class, such as HS for Hesiod records or CH for CHAOSNET records.
|
|
.PP
|
|
The \fB-f\fR option makes \fBdig \fR operate
|
|
in batch mode by reading a list of lookup requests to process from the
|
|
file \fIfilename\fR. The file contains a number of
|
|
queries, one per line. Each entry in the file should be organised in
|
|
the same way they would be presented as queries to
|
|
\fBdig\fR using the command-line interface.
|
|
.PP
|
|
If a non-standard port number is to be queried, the
|
|
\fB-p\fR option is used. \fIport#\fR is
|
|
the port number that \fBdig\fR will send its queries
|
|
instead of the standard DNS port number 53. This option would be used
|
|
to test a name server that has been configured to listen for queries
|
|
on a non-standard port number.
|
|
.PP
|
|
The \fB-4\fR option forces \fBdig\fR to only
|
|
use IPv4 query transport. The \fB-6\fR option forces
|
|
\fBdig\fR to only use IPv6 query transport.
|
|
.PP
|
|
The \fB-t\fR option sets the query type to
|
|
\fItype\fR. It can be any valid query type which is
|
|
supported in BIND9. The default query type "A", unless the
|
|
\fB-x\fR option is supplied to indicate a reverse lookup.
|
|
A zone transfer can be requested by specifying a type of AXFR. When
|
|
an incremental zone transfer (IXFR) is required,
|
|
\fItype\fR is set to ixfr=N.
|
|
The incremental zone transfer will contain the changes made to the zone
|
|
since the serial number in the zone's SOA record was
|
|
\fIN\fR.
|
|
.PP
|
|
Reverse lookups - mapping addresses to names - are simplified by the
|
|
\fB-x\fR option. \fIaddr\fR is an IPv4
|
|
address in dotted-decimal notation, or a colon-delimited IPv6 address.
|
|
When this option is used, there is no need to provide the
|
|
\fIname\fR, \fIclass\fR and
|
|
\fItype\fR arguments. \fBdig\fR
|
|
automatically performs a lookup for a name like
|
|
11.12.13.10.in-addr.arpa and sets the query type and
|
|
class to PTR and IN respectively. By default, IPv6 addresses are
|
|
looked up using nibble format under the IP6.ARPA domain.
|
|
To use the older RFC1886 method using the IP6.INT domain
|
|
specify the \fB-i\fR option. Bit string labels (RFC2874)
|
|
are now experimental and are not attempted.
|
|
.PP
|
|
To sign the DNS queries sent by \fBdig\fR and their
|
|
responses using transaction signatures (TSIG), specify a TSIG key file
|
|
using the \fB-k\fR option. You can also specify the TSIG
|
|
key itself on the command line using the \fB-y\fR option;
|
|
\fIname\fR is the name of the TSIG key and
|
|
\fIkey\fR is the actual key. The key is a base-64
|
|
encoded string, typically generated by \fBdnssec-keygen\fR(8).
|
|
Caution should be taken when using the \fB-y\fR option on
|
|
multi-user systems as the key can be visible in the output from
|
|
\fBps\fR(1) or in the shell's history file. When
|
|
using TSIG authentication with \fBdig\fR, the name
|
|
server that is queried needs to know the key and algorithm that is
|
|
being used. In BIND, this is done by providing appropriate
|
|
\fBkey\fR and \fBserver\fR statements in
|
|
\fInamed.conf\fR.
|
|
.SH "QUERY OPTIONS"
|
|
.PP
|
|
\fBdig\fR provides a number of query options which affect
|
|
the way in which lookups are made and the results displayed. Some of
|
|
these set or reset flag bits in the query header, some determine which
|
|
sections of the answer get printed, and others determine the timeout
|
|
and retry strategies.
|
|
.PP
|
|
Each query option is identified by a keyword preceded by a plus sign
|
|
(+). Some keywords set or reset an option. These may be preceded
|
|
by the string no to negate the meaning of that keyword. Other
|
|
keywords assign values to options like the timeout interval. They
|
|
have the form \fB+keyword=value\fR.
|
|
The query options are:
|
|
.TP
|
|
\fB+[no]tcp\fR
|
|
Use [do not use] TCP when querying name servers. The default
|
|
behaviour is to use UDP unless an AXFR or IXFR query is requested, in
|
|
which case a TCP connection is used.
|
|
.TP
|
|
\fB+[no]vc\fR
|
|
Use [do not use] TCP when querying name servers. This alternate
|
|
syntax to \fI+[no]tcp\fR is provided for backwards
|
|
compatibility. The "vc" stands for "virtual circuit".
|
|
.TP
|
|
\fB+[no]ignore\fR
|
|
Ignore truncation in UDP responses instead of retrying with TCP. By
|
|
default, TCP retries are performed.
|
|
.TP
|
|
\fB+domain=somename\fR
|
|
Set the search list to contain the single domain
|
|
\fIsomename\fR, as if specified in a
|
|
\fBdomain\fR directive in
|
|
\fI/etc/resolv.conf\fR, and enable search list
|
|
processing as if the \fI+search\fR option were given.
|
|
.TP
|
|
\fB+[no]search\fR
|
|
Use [do not use] the search list defined by the searchlist or domain
|
|
directive in \fIresolv.conf\fR (if any).
|
|
The search list is not used by default.
|
|
.TP
|
|
\fB+[no]defname\fR
|
|
Deprecated, treated as a synonym for \fI+[no]search\fR
|
|
.TP
|
|
\fB+[no]aaonly\fR
|
|
Sets the "aa" flag in the query.
|
|
.TP
|
|
\fB+[no]aaflag\fR
|
|
A synonym for \fI+[no]aaonly\fR.
|
|
.TP
|
|
\fB+[no]adflag\fR
|
|
Set [do not set] the AD (authentic data) bit in the query. The AD bit
|
|
currently has a standard meaning only in responses, not in queries,
|
|
but the ability to set the bit in the query is provided for
|
|
completeness.
|
|
.TP
|
|
\fB+[no]cdflag\fR
|
|
Set [do not set] the CD (checking disabled) bit in the query. This
|
|
requests the server to not perform DNSSEC validation of responses.
|
|
.TP
|
|
\fB+[no]cl\fR
|
|
Display [do not display] the CLASS when printing the record.
|
|
.TP
|
|
\fB+[no]ttlid\fR
|
|
Display [do not display] the TTL when printing the record.
|
|
.TP
|
|
\fB+[no]recurse\fR
|
|
Toggle the setting of the RD (recursion desired) bit in the query.
|
|
This bit is set by default, which means \fBdig\fR
|
|
normally sends recursive queries. Recursion is automatically disabled
|
|
when the \fI+nssearch\fR or
|
|
\fI+trace\fR query options are used.
|
|
.TP
|
|
\fB+[no]nssearch\fR
|
|
When this option is set, \fBdig\fR attempts to find the
|
|
authoritative name servers for the zone containing the name being
|
|
looked up and display the SOA record that each name server has for the
|
|
zone.
|
|
.TP
|
|
\fB+[no]trace\fR
|
|
Toggle tracing of the delegation path from the root name servers for
|
|
the name being looked up. Tracing is disabled by default. When
|
|
tracing is enabled, \fBdig\fR makes iterative queries to
|
|
resolve the name being looked up. It will follow referrals from the
|
|
root servers, showing the answer from each server that was used to
|
|
resolve the lookup.
|
|
.TP
|
|
\fB+[no]cmd\fR
|
|
toggles the printing of the initial comment in the output identifying
|
|
the version of \fBdig\fR and the query options that have
|
|
been applied. This comment is printed by default.
|
|
.TP
|
|
\fB+[no]short\fR
|
|
Provide a terse answer. The default is to print the answer in a
|
|
verbose form.
|
|
.TP
|
|
\fB+[no]identify\fR
|
|
Show [or do not show] the IP address and port number that supplied the
|
|
answer when the \fI+short\fR option is enabled. If
|
|
short form answers are requested, the default is not to show the
|
|
source address and port number of the server that provided the answer.
|
|
.TP
|
|
\fB+[no]comments\fR
|
|
Toggle the display of comment lines in the output. The default is to
|
|
print comments.
|
|
.TP
|
|
\fB+[no]stats\fR
|
|
This query option toggles the printing of statistics: when the query
|
|
was made, the size of the reply and so on. The default behaviour is
|
|
to print the query statistics.
|
|
.TP
|
|
\fB+[no]qr\fR
|
|
Print [do not print] the query as it is sent.
|
|
By default, the query is not printed.
|
|
.TP
|
|
\fB+[no]question\fR
|
|
Print [do not print] the question section of a query when an answer is
|
|
returned. The default is to print the question section as a comment.
|
|
.TP
|
|
\fB+[no]answer\fR
|
|
Display [do not display] the answer section of a reply. The default
|
|
is to display it.
|
|
.TP
|
|
\fB+[no]authority\fR
|
|
Display [do not display] the authority section of a reply. The
|
|
default is to display it.
|
|
.TP
|
|
\fB+[no]additional\fR
|
|
Display [do not display] the additional section of a reply.
|
|
The default is to display it.
|
|
.TP
|
|
\fB+[no]all\fR
|
|
Set or clear all display flags.
|
|
.TP
|
|
\fB+time=T\fR
|
|
Sets the timeout for a query to
|
|
\fIT\fR seconds. The default time out is 5 seconds.
|
|
An attempt to set \fIT\fR to less than 1 will result
|
|
in a query timeout of 1 second being applied.
|
|
.TP
|
|
\fB+tries=T\fR
|
|
Sets the number of times to try UDP queries to server to
|
|
\fIT\fR instead of the default, 3. If
|
|
\fIT\fR is less than or equal to zero, the number of
|
|
tries is silently rounded up to 1.
|
|
.TP
|
|
\fB+retry=T\fR
|
|
Sets the number of times to retry UDP queries to server to
|
|
\fIT\fR instead of the default, 2. Unlike
|
|
\fI+tries\fR, this does not include the initial
|
|
query.
|
|
.TP
|
|
\fB+ndots=D\fR
|
|
Set the number of dots that have to appear in
|
|
\fIname\fR to \fID\fR for it to be
|
|
considered absolute. The default value is that defined using the
|
|
ndots statement in \fI/etc/resolv.conf\fR, or 1 if no
|
|
ndots statement is present. Names with fewer dots are interpreted as
|
|
relative names and will be searched for in the domains listed in the
|
|
\fBsearch\fR or \fBdomain\fR directive in
|
|
\fI/etc/resolv.conf\fR.
|
|
.TP
|
|
\fB+bufsize=B\fR
|
|
Set the UDP message buffer size advertised using EDNS0 to
|
|
\fIB\fR bytes. The maximum and minimum sizes of this
|
|
buffer are 65535 and 0 respectively. Values outside this range are
|
|
rounded up or down appropriately.
|
|
.TP
|
|
\fB+[no]multiline\fR
|
|
Print records like the SOA records in a verbose multi-line
|
|
format with human-readable comments. The default is to print
|
|
each record on a single line, to facilitate machine parsing
|
|
of the \fBdig\fR output.
|
|
.TP
|
|
\fB+[no]fail\fR
|
|
Do not try the next server if you receive a SERVFAIL. The default is
|
|
to not try the next server which is the reverse of normal stub resolver
|
|
behaviour.
|
|
.TP
|
|
\fB+[no]besteffort\fR
|
|
Attempt to display the contents of messages which are malformed.
|
|
The default is to not display malformed answers.
|
|
.TP
|
|
\fB+[no]dnssec\fR
|
|
Requests DNSSEC records be sent by setting the DNSSEC OK bit (DO)
|
|
in the OPT record in the additional section of the query.
|
|
.TP
|
|
\fB+[no]sigchase\fR
|
|
Chase DNSSEC signature chains. Requires dig be compiled with
|
|
-DDIG_SIGCHASE.
|
|
.TP
|
|
\fB+trusted-key=####\fR
|
|
Specify a trusted key to be used with \fB+sigchase\fR.
|
|
Requires dig be compiled with -DDIG_SIGCHASE.
|
|
.TP
|
|
\fB+[no]topdown\fR
|
|
When chasing DNSSEC signature chains perform a top down validation.
|
|
Requires dig be compiled with -DDIG_SIGCHASE.
|
|
.SH "MULTIPLE QUERIES"
|
|
.PP
|
|
The BIND 9 implementation of \fBdig \fR supports
|
|
specifying multiple queries on the command line (in addition to
|
|
supporting the \fB-f\fR batch file option). Each of those
|
|
queries can be supplied with its own set of flags, options and query
|
|
options.
|
|
.PP
|
|
In this case, each \fIquery\fR argument represent an
|
|
individual query in the command-line syntax described above. Each
|
|
consists of any of the standard options and flags, the name to be
|
|
looked up, an optional query type and class and any query options that
|
|
should be applied to that query.
|
|
.PP
|
|
A global set of query options, which should be applied to all queries,
|
|
can also be supplied. These global query options must precede the
|
|
first tuple of name, class, type, options, flags, and query options
|
|
supplied on the command line. Any global query options (except
|
|
the \fB+[no]cmd\fR option) can be
|
|
overridden by a query-specific set of query options. For example:
|
|
.sp
|
|
.nf
|
|
dig +qr www.isc.org any -x 127.0.0.1 isc.org ns +noqr
|
|
.sp
|
|
.fi
|
|
shows how \fBdig\fR could be used from the command line
|
|
to make three lookups: an ANY query for www.isc.org, a
|
|
reverse lookup of 127.0.0.1 and a query for the NS records of
|
|
isc.org.
|
|
A global query option of \fI+qr\fR is applied, so
|
|
that \fBdig\fR shows the initial query it made for each
|
|
lookup. The final query has a local query option of
|
|
\fI+noqr\fR which means that \fBdig\fR
|
|
will not print the initial query when it looks up the NS records for
|
|
isc.org.
|
|
.SH "FILES"
|
|
.PP
|
|
\fI/etc/resolv.conf\fR
|
|
.PP
|
|
\fI${HOME}/.digrc\fR
|
|
.SH "SEE ALSO"
|
|
.PP
|
|
\fBhost\fR(1),
|
|
\fBnamed\fR(8),
|
|
\fBdnssec-keygen\fR(8),
|
|
\fIRFC1035\fR.
|
|
.SH "BUGS"
|
|
.PP
|
|
There are probably too many query options.
|