Dig命令使用大全（转自别人翻译），稍加整理 - longyongzhen - 博客园
Dig简介：& &Dig是一个在类Unix命令行模式下查询DNS包括NS记录，A记录，MX记录等相关信息的工具。由于一直缺失Dig man page文档，本文就权当一个dig使用向导吧。& &Dig的源码是ISC BIND大包的一部分，但是大多编译和安装Bind的文档都不把它包括在内，但是在linux系统下，它通常是某个包的一部分，在Gentoo下是bind-tools，在Redhat/Fedora下是 bind-utils，或者在Debian下是 dnsutils。& & & & & & & & & & & & & & & &&如果你要查找Bind的配置相关的信息，你参考我的文章：Bind for the mall LAN（）。看懂默认输出：最简单最常见的查询是查询一台主机，但是默认情况下，Dig的输出信息很详细。你可能不需要所有的输出，但是它确实值得知道
=======================================================================
下面是一个带有注释的查询：$ dig&上面是我调用dig 的命令行。; &&&& DiG 9.2.3 &&&&&;; global options:&&printcmdDig的部分输出告诉我们一些有关于它的版本信息(version 9.2.3)和全局的设置选项，如果+nocmd在命令行下是第一个参数的话，那么这部分输出可以通过加+nocmd的方式查询出来。;; Got answer:;; -&&HEADER&&- opcode: QUERY, status: NOERROR, id: 43071;; flags: QUERY: 1, ANSWER: 1, AUTHORITY: 3, ADDITIONAL: 3在这里，Dig告诉我们一些从DNS返回的技术信息，这段信息可以用选项 +[no]comments来控制显示，但是小心，禁止掉comments也可能关闭一些其它的选项。;; QUESTION SECTION:;& && && && && && & IN& && &A在这个查询段中，Dig显示出我们查询的输出，默认的查询是查询A记录，你可以显示或者禁止掉这些用+[no]question选项;; ANSWER SECTION:& && && && &600& &&&IN& && &A& && & 204.152.184.88最后，我们得到我们查询的结果。&的地址是204.152.184.8，我不知道为什么你们更喜欢过滤掉这些输出，但是你可以用+[no]answer保留这些选项。;; AUTHORITY SECTION:isc.org.& && && && && & 2351& & IN& && &NS& && &ns-int.isc.org.isc.org.& && && && && & 2351& & IN& && &NS& && &ns1.gnac.com.isc.org.& && && && && & 2351& & IN& && &NS& && &ns-ext.isc.org.这段权威说明告诉我们哪个DNS服务器给我们提供权威的答案。在这个例子中，isc.org有3个Name Server，你可以用+[no]authority选项保留这段输出。;; ADDITIONAL SECTION:ns1.gnac.com.& && && &&&171551&&IN& && &A& && & 209.182.216.75ns-int.isc.org.& && && &2351& & IN& && &A& && & 204.152.184.65ns-int.isc.org.& && && &2351& & IN& && &AAAA& & :0:2::15这些额外选项很有代表性地包含了列出的权威DNS的IP地址，这段输出可以用+[no]additional选项保留。;; Query time: 2046 msec;; SERVER: 127.0.0.1#53(127.0.0.1);; WHEN: Fri Aug 27 08:22:26 2004;; MSG SIZE&&rcvd: 173最后一段默认输出包含了查询的统计数据，可以用+[no]stats保留。
===========================================================================
我们可以查询什么？Dig可以让你有效地查询DNS，最常用的查询是A记录，TXT（文本注释），MX记录，NS记录，或者任意综合查询。
查找yahoo.com的A记录：（此处一定是域而不是主机，如我公司为xinpindao.com)dig yahoo.com A +noall +answer
查找yahoo.com MX记录的列表：dig yahoo.com MX +noall +answer
查找yahoo.com的权威DNS：dig yahoo.com NS +noall +answer
查询上面所有的记录：dig yahoo.com ANY +noall +answer
在现在这种IPv4和IPV6混用的情况下，你也可以使用AAAA的选项查询主机的IPv6 AAAA记录：dig&&AAAA +short如果你要查询的域允许转发，你也可以查询到相关的信息，比如DNS记录在internet上的生存周期，但是，现在只有很少的DNS允许无限制转发。
我们怎样查询？获得精简答案？当我们需要一个快速回答时，+short选项是你最好的朋友:dig&&+short204.152.184.88
获得一个不是十分精简的答案？精简答案和只有一个答案是不一样的，
获得没有附加信息的详细答案的方法是使用+noall选项，这样就只保留你想要的输出。下面是只有一个答案的精简查询，最后包含所有的配置信息，包括TTL数据，格式化的BIND配置信息。$ dig fsf.org mx +short20 mx20.gnu.org.30 mx30.gnu.org.10 mx10.gnu.org.$ dig +nocmd fsf.org mx +noall +answerfsf.org.& && && && && & 3583& & IN& && &MX& && &30 mx30.gnu.org.fsf.org.& && && && && & 3583& & IN& && &MX& && &10 mx10.gnu.org.fsf.org.& && && && && & 3583& & IN& && &MX& && &20 mx20.gnu.org.
获得一个详细答案？通过它的man page，你可以通过+multiline选项获得冗长的多行模式人性化注释的DSN的SOA记录，一般来说，用+multiline选项获得的信息可以显示很多，就像BIND配置文件一样。$ dig +nocmd ogi.edu any +multiline +noall +answerogi.edu.& &14267 IN A 129.95.59.31ogi.edu.& &14267 IN MX 5 cse.ogi.edu.ogi.edu.& &14267 IN MX 15 hermes.admin.ogi.edu.ogi.edu.& &14267 IN SOA zeal.admin.ogi.edu. hostmaster.admin.ogi.edu. (& && && && && && & &&; serial& && && && && && & 14400& && &; refresh (4 hours)& && && && && && & 900& && &&&; retry (15 minutes)& && && && && && & 3600000& & ; expire (5 weeks 6 days 16 hours)& && && && && && & 14400& && &; minimum (4 hours)& && && && && && & )ogi.edu.& &14267 IN NS zeal.admin.ogi.edu.ogi.edu.& &14267 IN NS cse.ogi.edu.ogi.edu.& &14267 IN NS fork.admin.ogi.edu.
查找PTR记录？可以用 -x的选项查找IP地址的主机名。$ dig -x 204.152.184.167 +shortmx-1.isc.org.在这个循环中，脚本很灵活地在给出的子网中映射出名字。#!/bin/bashNET=18.7.22for n in $(seq 1 254); do&&ADDR=${NET}.${n}&&echo -e "${ADDR}\t$(dig -x ${ADDR} +short)"done
查询一个不同的命名服务器？查询命令如下：dig @ns1.google.com&使用/etc/resolv.conf里面的记录查询主机将从/etc/resolv.conf文件里面自动查询DNS记录$ host www&has address 65.102.49.170但是，默认情况下，dig会产生出一些意想不到的输出。如果你想查询本地主机名而不是全域名时候，使用+search 选项dig www +search
处理大部分的查询？如果你想查询大量的主机名，你可以把它们存放在一个文本文件中(一条记录一行)，使用带-f参数的dig来依次查询。# 查询大量的主机名dig -f /path/to/host-list.txt# 相同的，更明确的输出dig -f /path/to/host-list.txt +noall +answer但是我要告诉你的是，dig 9.2.3以及以后的版本都不支持使用-f的选项反向查询了。验证DNS映射不正确的DNS配置会给你带来很多苦恼，你可以通过如下两种方式验证你的DNS配置：1.每个主机名应该被解析到一个IP地址，而且那个IP地址也应该反指向那个主机名。2.如果你子网上一个地址被反指向一个主机名，那么那个主机名也必须指向这个IP。对于这两条规则来说，还有一些例外情况，比如CNAME应该首先解析到另外一个主机名，而且只能指向一个IP，有时多个主机名指向了相同的IP地址，但是那个IP只能有一个PTR记录。综上，这些有助于你检查你的DNS映射是否像你想象的那样工作。你也可以编写一个测试脚本写入你已知的主机名，如下所示，内容很简单；它执行时当捕捉到一个CNAME时它就会中断，如果多个主机名指向同一个IP地址它会报错。我们假设这个文件包含你的主机名叫做named-hosts。#!/bin/bash## test DNS forward- and reverse-mapping## edit this variable to reflect local class C subnet(s)NETS="192.168.1 192.168.2"# Test name to address to name validityechoecho -e "\tname -& address -& name"echo '----------------------------------'while read H; do&&ADDR=$(dig $H +short)&&if test -n "$ADDR"; then& & HOST=$(dig -x $ADDR +short)& & if test "$H" = "$HOST"; then& && &echo -e "ok\t$H -& $ADDR -& $HOST"& & elif test -n "$HOST"; then& && &echo -e "fail\t$H -& $ADDR -& $HOST"& & else& && &echo -e "fail\t$H -& $ADDR -& [unassigned]"& & fi&&else& & echo -e "fail\t$H -& [unassigned]"&&fidone & named-hosts# Test address to name to address validityechoecho -e "\taddress -& name -& address"echo '-------------------------------------'for NET in $NETS; do&&for n in $(seq 1 254); do& & A=${NET}.${n}& & HOST=$(dig -x $A +short)& & if test -n "$HOST"; then& && &ADDR=$(dig $HOST +short)& && &if test "$A" = "$ADDR"; then& && &&&echo -e "ok\t$A -& $HOST -& $ADDR"& && &elif test -n "$ADDR"; then& && &&&echo -e "fail\t$A -& $HOST -& $ADDR"& && &else& && &&&echo -e "fail\t$A -& $HOST -& [unassigned]"& && &fi& & fi&&donedone
有趣的dig创建属于你自己的named.root文件任何连接到internet 的DNS服务器肯定会有InterNIC的named.root文件的拷贝，文件列出所有internet的根DNS，如果你不怕麻烦的话，你可以经常从InterNIC的ftp服务器上把它下载下来，或者，你可以使用dig命令创建属于你自己的时髦的named.root# compare with&dig +nocmd . NS +noall +answer +additional你的TTL值在这边可能会很小，但是它是你找到最新的named.root文件！
跟踪dig的查询路径你可能是个traceroute的狂热爱好者，经常喜欢查看如何从点A连接点B。那你可以使用dig +trace选项做类似的事。dig gentoo.de +trace你可以在dig输出的头部分看到根DNS，然后找到负责解析所有*.de的DNS，最后找到gentoo.de的域名IP。
获取SOA记录作为一个DNS管理员，我有时会（对DNS配置）做一些改变，并且想知道我的DNS解析是否推送的还是旧数据，这个+nssearch选项可以给你的公众服务器提供清楚的统计信息。# the unvarnished truthdig cse.ogi.edu +nssearch# the same, displaying only serial number and hostnamedig cse.ogi.edu +nssearch | cut -d' ' -f4,11
解释TTL数值我喜爱google有很多原因，其中一个原因就是它在我的WEB日志中提供了精确的链接，它会使我很容易地指出哪种类型的查询引导人们来访问这个站点的页面。出乎意料的是，我已经看到很多请求要求查询TTL数值，我从来没想到TTL会成为最受欢迎的东东，但是你每天都在学习新东西，所以，应大家的要求，这里稍微介绍一下TTL。如果你从本地DNS查询互联网地址，服务器指出从哪里获得权威的答案并获得地址，一旦服务器获知答案，它将这个答案保存在本地缓存中以免你在稍后的时间内再次查询同样的地址，这样它就会很快地从缓存中获取你要的答案，比你再次从internet查询要快很多。当域管理员配置DNS记录时，他们可以决定这个记录可以在缓存中保存多长时间，这就是TTL数值（通常用多少秒来表示）。通常地，远端服务器一般对记录的缓存只保存TTL数值长的时间。时间过期后，服务器会刷新它的本地缓存并重新查询一个权威答案。当你用dig来查询DNS服务器某条记录时，服务器会告诉dig这条记录可以在缓存中保持的时间长短。举个例子，像上面写的那样，gmail.com域的MX记录的TTL值是300s，gmail.com域的管理员要求远端服务器缓存它的MX记录不能高于5分钟，所以当你第一次查询那个记录（gmail.com的MX记录）时，dig会告诉你一个300的TTL。$ dig +nocmd gmail.com MX +noall +answergmail.com.& && &&&300& &&&IN& && &MX& && &20 gsmtp57.google.com.gmail.com.& && &&&300& &&&IN& && &MX& && &10 gsmtp171.google.com.如果你一段时间后再去查，你会发现TTL值减少为280（中间隔了20s）。$ dig +nocmd gmail.com MX +noall +answergmail.com.& && &&&280& &&&IN& && &MX& && &10 gsmtp171.google.com.gmail.com.& && &&&280& &&&IN& && &MX& && &20 gsmtp57.google.com.如果你的时间计算得足够好，你会获取这条记录的最后生存时间。$ dig +nocmd gmail.com MX +noall +answergmail.com.& && &&&1& && & IN& && &MX& && &10 gsmtp171.google.com.gmail.com.& && &&&1& && & IN& && &MX& && &20 gsmtp57.google.com.在那之后，你查询的DNS服务器会“忘记”这个问题的答案，在你下次查询这条记录时，整个循环又将开始（本例子中是300s）。使用dig的+trace选项追踪DNS解析过程
[root@mgtlnx101 ~]# dig @202.106.0.20 sina.com.cn +trace
@202.106.0.20 sina.com.cn +trace
; (1 server found)
;; global options:& printcmd
l.root-servers.net.
a.root-servers.net.
m.root-servers.net.
h.root-servers.net.
c.root-servers.net.
e.root-servers.net.
j.root-servers.net.
b.root-servers.net.
i.root-servers.net.
k.root-servers.net.
f.root-servers.net.
d.root-servers.net.
g.root-servers.net.
;; Received 228 bytes from 202.106.0.20#53(202.106.0.20) in 2
ns.cernet.net.
;; Received 294 bytes from 199.7.83.42#53(l.root-servers.net) in
sina.com.cn.&&&
ns1.sina.com.cn.
sina.com.cn.&&&
ns2.sina.com.cn.
sina.com.cn.&&&
ns3.sina.com.cn.
sina.com.cn.&&&
ns4.sina.com.cn.
;; Received 165 bytes from 203.119.25.1#53(a.dns.cn) in 11 ms
sina.com.cn.&&&
202.108.33.60
sina.com.cn.&&&
ns1.sina.com.cn.
sina.com.cn.&&&
ns4.sina.com.cn.
sina.com.cn.&&&
ns2.sina.com.cn.
sina.com.cn.&&&
ns3.sina.com.cn.
;; Received 181 bytes from 202.106.184.166#53(ns1.sina.com.cn) in 2
[root@mgtlnx101 ~]#
已投稿到：
以上网友发言只代表其个人观点，不代表新浪网的观点或立场。关于dig命令安装与使用（经典）
以上网友发言只代表其个人观点，不代表新浪网的观点或立场。一般来说linux下查询域名解析有两种选择，nslookup或者dig，而在使用上我觉得dig更加方便顺手。如果是在debian下的话，只要装上dnsutils这个包就可以使用dig命令了。
最基本的使用方式就是
dig www.oolec.com
即查询域名的A记录，查询的dns服务器将采用系统配置的服务器，即/etc/resovle.conf 中的。
如果要查询其他类型的记录，比如MX，CNAME，NS，PTR等，只需将类型加在命令后面即可
dig www.oolec.com mxdig www.oolec.com ns
此外，如果你是一个系统管理员，部署好了一台dns服务器之后想对它进行解析测试，就必须要显式指定待测试的dns服务器地址了，例如
dig @202.106.0.20 www.oolec.com a
默认情况下dig将采用udp协议进行查询，如果要采用tcp方式，可以加上 +tcp参数
dig www.oolec.com a +tcp
另外一个重要的功能是+trace参数，使用这个参数之后将显示从根域逐级查询的过程
dig www.oolec.com a +trace
比如，对本站域名www.linuxers.cn A记录的trace查询可以看到根域.，顶级域.cn，以及linuxers.cn的域名权威服务器的地址及其各自的返回结果，这样对于追踪dns解析中的问题有很大的帮助。
leconte@localhost:~$ dig www.linuxers.cn a +trace&; &&&& DiG 9.5.1-P3 &&&& www.linuxers.cn a +trace;; global options:
E.ROOT-SERVERS.NET..
B.ROOT-SERVERS.NET..
J.ROOT-SERVERS.NET..
K.ROOT-SERVERS.NET..
L.ROOT-SERVERS.NET..
F.ROOT-SERVERS.NET..
G.ROOT-SERVERS.NET..
I.ROOT-SERVERS.NET..
M.ROOT-SERVERS.NET..
A.ROOT-SERVERS.NET..
C.ROOT-SERVERS.NET..
H.ROOT-SERVERS.NET..
D.ROOT-SERVERS.NET.;; Received 228 bytes from 192.168.127.2#53(192.168.127.2) in 12 ms&cn.
a.dns.cn.cn.
b.dns.cn.cn.
c.dns.cn.cn.
d.dns.cn.cn.
e.dns.cn.cn.
ns.cernet.net.;; Received 298 bytes from 199.7.83.42#53(L.ROOT-SERVERS.NET) in 496 ms&linuxers.cn.
ns1.dnspood.net.linuxers.cn.
ns2.dnspood.net.;; Received 80 bytes from 202.112.0.44#53(ns.cernet.net) in 12 ms&www.linuxers.cn.
218.240.42.72;; Received 49 bytes from 222.186.26.115#53(ns2.dnspood.net) in 1132 ms
今天刚好是百度出问题时候。
关于dig的更进一步的使用方式请参考
dig (1) - BIND9
(Updated: Jun 30, 2000)&&
dig - DNS lookup utility&&
dig&[@server] [-b&address] [-c&class] [-f&filename] [-k&filename] [-m] [-p&port#] [-q&name] [-t&type] [-x&addr] [-y&[hmac:]name:key] [-4] [-6] [name] [type] [class] [queryopt...]dig&[-h]dig&[global-queryopt...] [query...]
DESCRIPTION
dig&(domain information groper) is a flexible tool for interrogating DNS name servers. It performs DNS lookups and displays the answers that are returned from the name server(s) that were queried. Most DNS administrators use&dig
to troubleshoot DNS problems because of its flexibility, ease of use and clarity of output. Other lookup tools tend to have less functionality than&dig.
Although&digis normally used with command-line arguments, it also has a batch mode of operation for reading lookup requests from a file. A brief summary of its command-line arguments and options is printed when the&-h&option is given. Unlike earlier versions, the BIND 9 implementation of&dig&allows multiple lookups to be issued from the command line.
Unless it is told to query a specific name server,&dig&will try each of the servers listed in&/etc/resolv.conf.
When no command line arguments or options are given,&dig&will perform an NS query for "." (the root).
It is possible to set per-user defaults for&dig&via&${HOME}/.digrc. This file is read and any options in it are applied before the command line arguments.
The IN and CH class names overlap with the IN and CH top level domains names. Either use the&-t&and&-c&options to specify the type and class, use the&-q&the specify the domain name, or use "IN." and "CH." when looking up these top level domains.&&
SIMPLE USAGE
A typical invocation of&dig&looks like:
dig @server name type
is the name or IP address of the name server to query. This can be an IPv4 address in dotted-decimal notation or an IPv6 address in colon-delimited notation. When the supplied&server&argument is a hostname,&dig&resolves that name before querying that name server. If no&server&argument is provided,&dig&consults&/etc/resolv.conf&and queries the name servers listed there. The reply from the name server that responds is displayed.
is the name of the resource record that is to be looked up.
indicates what type of query is required --- ANY, A, MX, SIG, etc.&type&can be any valid query type. If no&type&argument is supplied,&dig&will perform a lookup for an A record.
The&-b&option sets the source IP address of the query to&address. This must be a valid address on one of the host's network interfaces or "0.0.0.0" or "::". An optional port may be specified by appending "#"
The default query class (IN for internet) is overridden by the&-c&option.&class&is any valid class, such as HS for Hesiod records or CH for Chaosnet records.
The&-f&option makes&dig&operate in batch mode by reading a list of lookup requests to process from the file&filename. The file contains a number of queries, one per line. Each entry in the file should be organized in the same way they would be presented as queries to&dig&using the command-line interface.
The&-m&option enables memory usage debugging.
If a non-standard port number is to be queried, the&-p&option is used.&port#&is the port number that&digwill send its queries instead of the standard DNS port number 53. This option would be used to test a name server that has been configured to listen for queries on a non-standard port number.
The&-4&option forces&dig&to only use IPv4 query transport. The&-6&option forces&dig&to only use IPv6 query transport.
The&-t&option sets the query type to&type. It can be any valid query type which is supported in BIND 9. The default query type is "A", unless the&-xoption is supplied to indicate a reverse lookup. A zone transfer can be requested by specifying a type of AXFR. When an incremental zone transfer (IXFR) is required,&typeis set to ixfr=N. The incremental zone transfer will contain the changes made to the zone since the serial number in the zone's SOA record was&N.
The&-q&option sets the query name to&name. This useful do distinguish the&name&from other arguments.
Reverse lookups --- mapping addresses to names --- are simplified by the&-x&option.&addris an IPv4 address in dotted-decimal notation, or a colon-delimited IPv6 address. When this option is used, there is no need to provide the&name,&class&and&type&arguments.&digautomatically performs a lookup for a name like 11.12.13.10.in-addr.arpa and sets the query type and class to PTR and IN respectively. By default, IPv6 addresses are looked up using nibble format under the IP6.ARPA domain. To use the older RFC1886 method using the IP6.INT domain specify the&-i&option. Bit string labels (RFC2874) are now experimental and are not attempted.
To sign the DNS queries sent by&dig&and their responses using transaction signatures (TSIG), specify a TSIG key file using the&-k&option. You can also specify the TSIG key itself on the command line using the&-y&&hmac&is the type of the TSIG, default HMAC-MD5,&name&is the name of the TSIG key and&key&is the actual key. The key is a base-64 encoded string, typically generated by&(8). Caution should be taken when using the&-y&option on multi-user systems as the key can be visible in the output from&(1) or in the shell's history file. When using TSIG authentication with&dig, the name server that is queried needs to know the key and algorithm that is being used. In BIND, this is done by providing appropriate&key&and&server&statements in&named.conf.&&
QUERY OPTIONS
digprovides a number of query options which affect the way in which lookups are made and the results displayed. Some of these set or reset flag bits in the query header, some determine which sections of the answer get printed, and others determine the timeout and retry strategies.
Each query option is identified by a keyword preceded by a plus sign (+). Some keywords set or reset an option. These may be preceded by the string no to negate the meaning of that keyword. Other keywords assign values to options like the timeout interval. They have the form&+keyword=value. The query options are:
Use [do not use] TCP when querying name servers. The default behavior is to use UDP unless an AXFR or IXFR query is requested, in which case a TCP connection is used.
Use [do not use] TCP when querying name servers. This alternate syntax to&+[no]tcp&is provided for backwards compatibility. The "vc" stands for "virtual circuit".
+[no]ignore
Ignore truncation in UDP responses instead of retrying with TCP. By default, TCP retries are performed.
+domain=somename
Set the search list to contain the single domain&somename, as if specified in a&domain&directive in&/etc/resolv.conf, and enable search list processing as if the&+search&option were given.
+[no]search
Use [do not use] the search list defined by the searchlist or domain directive in&resolv.conf&(if any). The search list is not used by default.
+[no]showsearch
Perform [do not perform] a search showing intermediate results.
+[no]defname
Deprecated, treated as a synonym for&+[no]search
+[no]aaonly
Sets the "aa" flag in the query.
+[no]aaflag
A synonym for&+[no]aaonly.
+[no]adflag
Set [do not set] the AD (authentic data) bit in the query. The AD bit currently has a standard meaning only in responses, not in queries, but the ability to set the bit in the query is provided for completeness.
+[no]cdflag
Set [do not set] the CD (checking disabled) bit in the query. This requests the server to not perform DNSSEC validation of responses.
Display [do not display] the CLASS when printing the record.
+[no]ttlid
Display [do not display] the TTL when printing the record.
+[no]recurse
Toggle the setting of the RD (recursion desired) bit in the query. This bit is set by default, which means&dig&normally sends recursive queries. Recursion is automatically disabled when the&+nssearchor&+trace&query options are used.
+[no]nssearch
When this option is set,&digattempts to find the authoritative name servers for the zone containing the name being looked up and display the SOA record that each name server has for the zone.
+[no]trace
Toggle tracing of the delegation path from the root name servers for the name being looked up. Tracing is disabled by default. When tracing is enabled,&digmakes iterative queries to resolve the name being looked up. It will follow referrals from the root servers, showing the answer from each server that was used to resolve the lookup.
Toggles the printing of the initial comment in the output identifying the version of&dig&and the query options that have been applied. This comment is printed by default.
+[no]short
Provide a terse answer. The default is to print the answer in a verbose form.
+[no]identify
Show [or do not show] the IP address and port number that supplied the answer when the&+shortoption is enabled. If short form answers are requested, the default is not to show the source address and port number of the server that provided the answer.
+[no]comments
Toggle the display of comment lines in the output. The default is to print comments.
+[no]stats
This query option toggles the printing of statistics: when the query was made, the size of the reply and so on. The default behavior is to print the query statistics.
Print [do not print] the query as it is sent. By default, the query is not printed.
+[no]question
Print [do not print] the question section of a query when an answer is returned. The default is to print the question section as a comment.
+[no]answer
Display [do not display] the answer section of a reply. The default is to display it.
+[no]authority
Display [do not display] the authority section of a reply. The default is to display it.
+[no]additional
Display [do not display] the additional section of a reply. The default is to display it.
Set or clear all display flags.
Sets the timeout for a query to&T&seconds. The default timeout is 5 seconds. An attempt to set&T&to less than 1 will result in a query timeout of 1 second being applied.
Sets the number of times to try UDP queries to server to&T&instead of the default, 3. If&T&is less than or equal to zero, the number of tries is silently rounded up to 1.
Sets the number of times to retry UDP queries to server to&T&instead of the default, 2. Unlike&+tries, this does not include the initial query.
Set the number of dots that have to appear in&name&to&D&for it to be considered absolute. The default value is that defined using the ndots statement in&/etc/resolv.conf, or 1 if no ndots statement is present. Names with fewer dots are interpreted as relative names and will be searched for in the domains listed in the&search&or&domain&directive in&/etc/resolv.conf.
+bufsize=B
Set the UDP message buffer size advertised using EDNS0 to&Bbytes. The maximum and minimum sizes of this buffer are 65535 and 0 respectively. Values outside this range are rounded up or down appropriately. Values other than zero will cause a EDNS query to be sent.
Specify the EDNS version to query with. Valid values are 0 to 255. Setting the EDNS version will cause a EDNS query to be sent.&+noedns&clears the remembered EDNS version.
+[no]multiline
Print records like the SOA records in a verbose multi-line format with human-readable comments. The default is to print each record on a single line, to facilitate machine parsing of the&dig&output.
Do not try the next server if you receive a SERVFAIL. The default is to not try the next server which is the reverse of normal stub resolver behavior.
+[no]besteffort
Attempt to display the contents of messages which are malformed. The default is to not display malformed answers.
+[no]dnssec
Requests DNSSEC records be sent by setting the DNSSEC OK bit (DO) in the OPT record in the additional section of the query.
+[no]sigchase
Chase DNSSEC signature chains. Requires dig be compiled with -DDIG_SIGCHASE.
+trusted-key=####
Specifies a file containing trusted keys to be used with&+sigchase. Each DNSKEY record must be on its own line.
If not specified&dig&will look for&/etc/trusted-key.key&then&trusted-key.key&in the current directory.
Requires dig be compiled with -DDIG_SIGCHASE.
+[no]topdown
When chasing DNSSEC signature chains perform a top-down validation. Requires dig be compiled with -DDIG_SIGCHASE.
Include an EDNS name server ID request when sending a query.
MULTIPLE QUERIES
The BIND 9 implementation of&dig&supports specifying multiple queries on the command line (in addition to supporting the&-f&batch file option). Each of those queries can be supplied with its own set of flags, options and query options.
In this case, each&queryargument represent an individual query in the command-line syntax described above. Each consists of any of the standard options and flags, the name to be looked up, an optional query type and class and any query options that should be applied to that query.
A global set of query options, which should be applied to all queries, can also be supplied. These global query options must precede the first tuple of name, class, type, options, flags, and query options supplied on the command line. Any global query options (except the&+[no]cmd&option) can be overridden by a query-specific set of query options. For example:
any -x 127.0.0.1 isc.org ns +noqr
shows how&dig&could be used from the command line to make three lookups: an ANY query for&, a reverse lookup of 127.0.0.1 and a query for the NS records of isc.org. A global query option of&+qr&is applied, so that&dig&shows the initial query it made for each lookup. The final query has a local query option of&+noqr&which means that&dig&will not print the initial query when it looks up the NS records for isc.org.&&
IDN SUPPORT
If&dig&has been built with IDN (internationalized domain name) support, it can accept and display non-ASCII domain names.&digappropriately converts character encoding of domain name before sending a request to DNS server or displaying a reply from the server. If you'd like to turn off the IDN support for some reason, defines the&IDN_DISABLE&environment variable. The IDN support is disabled if the variable is set when&dig&runs.&&
/etc/resolv.conf
${HOME}/.digrc&&
(1),&(8),&(8), RFC1035.&&
There are probably too many query options.&&
Copyright &
Internet Systems Consortium, Inc. ("ISC")&Copyright &
Internet Software Consortium.
阅读(...) 评论()}