Reading dig and nslookup output without guessing

Most people run dig and read only the one line that holds the IP, then ignore the rest of the output that would have answered their actual question. The sections, the flags, and the TTL column each carry information you need when a lookup behaves unexpectedly. Here is how to read the whole thing.

A full dig response

;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 42901
;; flags: qr rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 1

;; QUESTION SECTION:
;example.com.            IN  A

;; ANSWER SECTION:
example.com.     276     IN  A     93.184.216.34

;; Query time: 24 msec
;; SERVER: 1.1.1.1#53(1.1.1.1)

The header and its flags

The header line reports the overall result. status: NOERROR means the query succeeded. NXDOMAIN means the name does not exist. SERVFAIL usually points at a broken authoritative server or a DNSSEC validation failure, not a typo.

The flags are the most useful part and the most ignored:

If you expected an authoritative answer and aa is missing, you queried a resolver's cache rather than the zone's nameserver.

The three answer sections

The ANSWER section holds the records that directly answer your question. The AUTHORITY section names the authoritative nameservers for the zone, which appears when you query a server that is delegating rather than answering. The ADDITIONAL section carries records the server volunteered to save you a follow up query, most often the A and AAAA records for nameservers it just listed. When you trace a delegation, AUTHORITY and ADDITIONAL together tell you where to ask next.

The TTL column

The unlabeled number in the middle of each record is the TTL in seconds: how long a resolver may cache this answer. In the example above, 276 means the resolver will serve this cached answer for another 276 seconds. Run the same query twice and watch the number count down. When it reaches zero the resolver refetches. This is why a DNS change does not take effect everywhere at once. If you are waiting on a propagation, the TTL tells you the worst case wait, and a value frozen at the record's full TTL means you hit the authoritative server directly rather than a cache.

Reading nslookup

nslookup covers the same ground with far less detail. A plain nslookup example.com prints the resolver it used, then the name and address. The line Non-authoritative answer: is the one to notice: it means the answer came from a cache, the equivalent of a missing aa flag in dig. For anything beyond a quick check, dig tells you more, which is why most operators reach for it first.

Quick workflow

• Check status first. NOERROR with an empty ANSWER means the name exists but has no record of that type.
• Read the flags to know whether the answer is authoritative or cached.
• Use the TTL to judge whether you are seeing fresh data or a cache.

To run these lookups without a terminal and see the records laid out clearly, the DNS Lookup tool queries each record type for you in the browser.