Recommended Free Tools
To read dig output, start with the DNS response status and flags, then check the section counts and records. An empty ANSWER section does not automatically mean failure: the response may be a referral, an alias-related result, or a successful response with no record of the requested type. The status describes the DNS response; the command’s shell exit code is a separate signal.
How do I read dig output?
A typical response has a command banner, a header, a question, one or more record sections, and a footer. The header tells you the response status, flags, and how many records appear in each section. The QUESTION section shows what was requested; ANSWER contains returned records; AUTHORITY and ADDITIONAL can supply context. The footer reports details such as query time, responding server, and message size. BIND’s dig manual and DNSSEC guide show these fields in examples.
- Read the status. For example,
status: NOERRORmeans the DNS response code indicates no error, but does not guarantee that the requested record appears in ANSWER. - Read the flags. These describe aspects of the response and server behavior; interpret them in light of which server you queried.
- Check the counts.
QUERY,ANSWER,AUTHORITY, andADDITIONALare message-section counts, not a score for whether the lookup succeeded. - Inspect the sections. Confirm the queried name and type in QUESTION, then look for returned data or referral information in the other sections.
- Check the footer. Note which server responded and the query time when diagnosing differences between resolver paths.
A common answer record looks like www.example.com. 60 IN A 10.1.0.1. Read the fields as owner name, TTL, class, type, and record data. This example format appears in BIND’s DNSSEC guide.
As an Amazon Associate I earn from qualifying purchases.
What does NXDOMAIN mean in dig?
NXDOMAIN is a DNS response status meaning the name does not exist according to the responding DNS process. It is not the same as receiving no reply. A timeout or no reply means there was no DNS response to interpret; NXDOMAIN is itself a DNS response.
Do not confuse the status with the shell exit code. BIND documents dig exit code 0 as “DNS response received, including NXDOMAIN status.” Its documented code 9 means no reply; code 1 indicates a usage error, code 8 failure to open a batch file, and code 10 an internal error. Thus, a zero exit code does not prove the requested name or record exists. See the BIND manual’s Return Codes section.
#1 Best Overall
- Used Book in Good Condition
What do the flags in dig mean?
Two useful flags are aa and ra. BIND defines aa as an authoritative answer and ra as recursion available. The presence of a record alone does not tell you whether it came from an authoritative server or a recursive resolver.
A recursive resolver may return data obtained from elsewhere, potentially from cache; an authoritative server answers from its zone data. BIND’s examples show a recursive-resolver response with ra and without aa, and a direct authoritative-server response with aa. A server can also indicate that recursion was requested but is unavailable. Check the responding server and query path rather than treating one flag as a complete explanation. See the BIND DNSSEC guide.
Why is the ANSWER section empty?
An empty ANSWER section can still be a meaningful response. First look at the status, then inspect AUTHORITY and ADDITIONAL. A referral is one possible explanation: the queried server does not provide the answer in ANSWER and instead points toward authoritative nameservers in AUTHORITY, often with their addresses in ADDITIONAL. BIND describes a referral as indicating that the queried server does not know the answer; see its introduction to DNS and BIND.
- QUESTION: the requested name, class, and record type.
- ANSWER: resource records returned as the answer.
- AUTHORITY: authority information, which can identify nameservers in a referral.
- ADDITIONAL: related data, often address records for nameservers named in a referral.
NOERROR with no requested record in ANSWER is not automatically contradictory: aliases, referrals, and successful empty responses are reasons to examine all sections before drawing a conclusion.
What does the TTL in dig mean?
The TTL is the time value shown alongside a returned record. In www.example.com. 60 IN A 10.1.0.1, 60 is the TTL displayed for that record. It is not a guarantee that every client or cache will observe the same value or behavior. BIND’s manual also documents display options that affect whether TTLs are printed.
Which dig output should I use for a quick check or diagnosis?
Use concise output when you only need the returned value. Use full output when diagnosing an unexpected result, because it preserves status, flags, sections, and server metadata. BIND documents these commands in its dig manual.
Quick wins for a faster PC:
Clear out junk files and repair common Windows errorsFree Scan →Scan for outdated or missing drivers - takes under a minuteDriver Scan →| Goal | Command | What it shows |
|---|---|---|
| Get a short result | dig +short example.com |
Condensed response; less diagnostic context. |
| Show only answer records | dig +noall +answer example.com |
Answer section without the rest of the normal output. |
| Query a named server | dig @f.gtld-servers.net example.com |
Response from the explicitly selected server. |
| Request TXT data | dig txt example.com |
TXT records, if returned. |
| Perform a reverse lookup | dig -x 192.0.2.1 |
Reverse-DNS query for the address. |
When comparing servers, record which server each command queried and inspect the full responses. A concise output can answer “what value came back?” but hide why a resolver returned it or what happened when the requested data was absent.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Could SERVFAIL be a DNSSEC problem?
It could, but SERVFAIL alone does not establish DNSSEC as the cause. BIND’s DNSSEC guide shows a validating recursive resolver returning SERVFAIL when a response fails validation, while cautioning that the visible symptom does not identify the underlying fault.
For a diagnostic comparison, BIND documents the +cd option, which asks the server to disable checking for that query. If the response succeeds with checking disabled, a validation-path issue may be involved. That comparison does not identify the broken record, signature, trust chain, or responsible operator, and it is not a security fix or recommendation to leave checking disabled.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
