dig (which stands for domain information groper) is a flexible tool for interrogating DNS name servers. It performs DNS lookups and displays the answers that are returned from the name server(s) that were queried. Most DNS administrators use dig to troubleshoot DNS problems because of its flexibility, ease of use and clarity of output. Other lookup tools tend to have less functionality than dig.
Although dig is normally used with command-linearguments, it also has a batch mode of operation for reading lookup requests from a file. A summary of its command-line arguments and options is printed when the -h option is given. Unlike earlier versions, the BIND 9 implementation of dig allows multiple lookups to be issued from the command line.
Unless it is told to query a specific name server, dig will try each of the servers listed in /etc/resolv.conf.
When no command line arguments or options are given, dig will perform an NS query for "." (the root).
It is possible to set per-user defaults for dig via ${HOME}/.digrc. This file is read and any options in it are applied before the command line arguments.
The IN and CH class names overlap with the IN and CH top level domains names. Either use the -t and -c options to specify the type and class, use the -q the specify the domain name, or use "IN." and "CH." when looking up these top level domains.
該-t選項設置查詢類型為類型。它可以是BIND9支持的任何有效查詢類型。缺省查詢類型“ A ”，除非提供了-x選項以指示反向查找。甲區轉移可以通過指定一個請求AXFR。當增量區域傳輸（IXFR是必需的），類型被設置為IXFR = N。增量區域傳輸將包含自到區域所做的更改序列號，在該區域的SOA記錄是?。
The -b option sets the source IP address of the query to address. This must be a valid address on one of the host's network interfaces or "0.0.0.0" or "::". An optional port may be specified by appending "#"
-cclass
The default query class (IN for Internet) is overridden by the -c option. class is any valid class, such as HS for Hesiod records or CH for CHAOSNET records.
-ffilename
The -f option makes dig operate in batch mode by reading a list of lookup requests to process from the file filename. The file contains many queries, one per line. Each entry in the file should be organized in the same way they would be presented as queries to dig using the command-line interface.
-pport#
If a non-standard port number is to be queried, the -p option is used. port# is the port number that dig will send its queries instead of the standard DNS port number 53. This option would be used to test a name server that was configured to listen for queries on a non-standard port number.
-4
The -4 option forces dig to only use IPv4 query transport.
-6
The -6 option forces dig to only use IPv6 query transport.
-ttype
The -t option sets the query type to type. It can be any valid query type that is supported in BIND9. The default query type "A", unless the -x option is supplied to indicate a reverse lookup. A zone transfer can be requested by specifying a AXFR. When an incremental zone transfer (IXFR) is required, type is set to ixfr=N. The incremental zone transfer will contain the changes made to the zone since the serial number in the zone's SOA record was N.
-xaddr
Reverse lookups (mapping addresses to names) are simplified by the -x option. addr is an IPv4 address in dotted-decimal notation, or a colon-delimited IPv6 address. When this option is used, there is no need to provide the name, class, and type arguments. The dig automatically performs a lookup for a name like 11.12.13.10.in-addr.arpa and sets the query type and class to PTR and IN respectively. By default, IPv6 addresses are looked up using nibble format under the IP6.ARPA domain. To use the older RFC1886 method using the IP6.INT domain specify the -i option. Bit string labels (RFC2874) are now experimental and are not attempted.
-kfilename
To sign the DNS queries sent by dig and their responses using TSIG (transaction signatures), specify a TSIG key file using the -k option.
-y [hmac:]name:key
You can also specify the TSIG key itself on the command line using the -y option; name is the name of the TSIG key and key is the actual key. The key is a base-64 encoded string, generated by dnssec-keygen. Caution should be taken when using the -y option on multi-user systems as the key can be visible in the output from ps or in the shell'shistory file. When using TSIG authentication with dig, the name server that is queried needs to know the key and algorithm that is being used. In BIND, this is done by providing appropriate key and server statements in named.conf.
Simple usage
A typical invocation of dig looks like:
dig @server name type
where:
server is the name or IP address of the name server to query. This can be an IPv4 address in dotted-decimal notation or an IPv6 address in colon-delimited notation. When the supplied server argument is a hostname, dig resolves that name before querying that name server. If no server argument is provided, dig consults /etc/resolv.conf and queries the name servers listed there. The reply from the name server that responds is displayed.
name is the name of the resource record that is to be looked up.
type indicates what type of query is required - ANY, A, MX, SIG, etc. type can be any valid query type. If no type argument is supplied, dig will perform a lookup for an A record.
Query options
dig provides many query options which affect the way in which lookups are made and the results displayed. Some of these set or reset flag bits in the query header, some determine which sections of the answer get printed, and others determine the timeout and retry strategies.
Each query option is identified by a keyword preceded by a plus sign (+). Some keywords set or reset an option. These may be preceded by the string no to negate the meaning of that keyword. Other keywords assign values to options like the timeout interval. They have the form +keyword=value. The query options are:
+[no]tcp
Use [do not use] TCP when querying name servers. The default behavior is to use UDP unless an AXFR or IXFR query is requested, in which case a TCP connection is used.
+[no]vc
Use [do not use] TCP when querying name servers. This alternate syntax to +[no]tcp is provided for backward compatibility. The "vc" stands for "virtual circuit".
+[no]ignore
Ignore truncation in UDP responses instead of retrying with TCP. By default, TCP retries are performed.
+domain=somename
Set the search list to contain the single domain somename, as if specified in a domain directive in /etc/resolv.conf, and enable search list processing as if the +search option were given.
+[no]search
Use [do not use] the search list defined by the searchlist or domain directive in resolv.conf (if any). The search list is not used by default.
+[no]showsearch
Perform [do not perform] a search showing intermediate results.
+[no]defname
Deprecated, treated as a synonym for +[no]search
+[no]aaonly
Sets the "aa" flag in the query.
+[no]aaflag
A synonym for +[no]aaonly.
+[no]adflag
Set [do not set] the AD (authentic data) bit in the query. This requests the server to return whether all of the answer and authority sections have all been validated as secure according to the security policy of the server. AD=1 indicates that all records have been validated as secure and the answer is not from an OPT-OUT range. AD=0 indicate that some part of the answer was insecure or not validated.
+[no]cdflag
Set [do not set] the CD (checking disabled) bit in the query. This requests the server to not perform DNSSEC validation of responses.
+[no]cl
Display [do not display] the CLASS when printing the record.
+[no]ttlid
Display [do not display] the TTL when printing the record.
+[no]recurse
Toggle the setting of the RD (recursion desired) bit in the query. This bit is set by default, which means dig normally sends recursive queries. Recursion is automatically disabled when the +nssearch or +trace query options are used.
+[no]nssearch
When this option is set, dig attempts to find the authoritative name servers for the zone containing the name being looked up and display the SOA record that each name server has for the zone.
+[no]trace
Toggle tracing of the delegation path from the root name servers for the name being looked up. Tracing is disabled by default. When tracing is enabled, dig makes iterative queries to resolve the name being looked up. It will follow referrals from the root servers, showing the answer from each server that was used to resolve the lookup.
+[no]cmd
Toggles the printing of the initial comment in the output identifying the version of dig and the query options that have been applied. This comment is printed by default.
+[no]short
Provide a terse answer. The default is to print the answer in a verbose form.
+[no]identify
Show [or do not show] the IP address and port number that supplied the answer when the +short option is enabled. If short form answers are requested, the default is not to show the source address and port number of the server that provided the answer.
+[no]comments
Toggle the display of comment lines in the output. The default is to print comments.
+[no]stats
This query option toggles the printing of statistics: when the query was made, the size of the reply, etc. The default behavior is to print the query statistics.
+[no]qr
Print [do not print] the query as it is sent. By default, the query is not printed.
+[no]question
Print [do not print] the question section of a query when an answer is returned. The default is to print the question section as a comment.
+[no]answer
Display [do not display] the answer section of a reply. The default is to display it.
+[no]authority
Display [do not display] the authority section of a reply. The default is to display it.
+[no]additional
Display [do not display] the additional section of a reply. The default is to display it.
+[no]all
Set or clear all display flags.
+time=T
Sets the timeout for a query to T seconds. The default timeout is 5 seconds. An attempt to set T to less than 1 will result in a query timeout of 1 second being applied.
+tries=T
Sets the number of times to try UDP queries to server to T instead of the default, 3. If T is less than or equal to zero, the number of tries is silently rounded up to 1.
+retry=T
Sets the number of times to retry UDP queries to server to T instead of the default, 2. Unlike +tries, this does not include the initial query.
+ndots=D
Set the number of dots that have to appear in name to D for it to be considered absolute. The default value is that defined using the ndots statement in /etc/resolv.conf, or 1 if no ndots statement is present. Names with fewer dots are interpreted as relative names and will be searched for in the domains listed in the search or domain directive in /etc/resolv.conf.
+bufsize=B
Set the UDP message buffer size advertised using EDNS0 to Bbytes. The maximum and minimum sizes of this buffer are 65535 and 0 respectively. Values outside this range are rounded up or down appropriately. Values other than zero will cause an EDNS query to be sent.
+edns=#
Specify the EDNS version to use in a query. Valid values are 0 to 255. Setting the EDNS version will cause an EDNS query to be sent. +noedns clears the remembered EDNS version.
+[no]multiline
Print records like the SOA records in a verbose multi-line format with human-readable comments. The default is to print each record on a single line, to facilitate machine parsing of the dig output.
+[no]onesoa
Print only one (starting) SOA record when performing an AXFR. The default is to print both the starting and ending SOA records.
+[no]fail
Do not try the next server if you receive a SERVFAIL. The default is to not try the next server that is the reverse of normal stub resolver behavior.
+[no]besteffort
Attempt to display the contents of messages that are malformed. The default is to not display malformed answers.
+[no]dnssec
Requests DNSSEC records be sent by setting the DO (DNSSEC OK) bit in the OPT record in the additional section of the query.
+[no]sigchase
Chase DNSSEC signature chains. Requires dig be compiled with -DDIG_SIGCHASE.
+trusted-key=####
Specifies a file containing trusted keys to be used with +sigchase. Each DNSKEY record must be on its own line.
If not specified, dig will look for /etc/trusted-key.key then trusted-key.key in the current directory.
Requires dig be compiled with -DDIG_SIGCHASE.
+[no]topdown
When chasing DNSSEC signature chains perform a top-down validation. Requires dig be compiled with -DDIG_SIGCHASE.
+[no]nsid
Include an EDNS name server ID request when sending a query.
Multiple queries
The BIND 9 implementation of dig supports specifying multiple queries on the command line (in addition to supporting the -f batch file option). Each of those queries can be supplied with its own set of flags, options, and query options.
In this case, each query argument represents an individual query in the command-line syntax described above. Each consists of any of the standard options and flags, the name to be looked up, an optional query type and class and any query options that should be applied to that query.
A global set of query options, which should be applied to all queries, can also be supplied. These global query options must precede the first tuple of name, class, type, options, flags, and query options supplied on the command line. Any global query options (except the +[no]cmd option) can be overridden by a query-specific set of query options. For example:
dig +qr www.isc.org any -x 127.0.0.1 isc.org ns +noqr
shows how dig could be used from the command line to make three lookups: an ANY query for www.isc.org, a reverse lookup of 127.0.0.1 and a query for the NS records of isc.org. A global query option of +qr is applied, so that dig shows the initial query it made for each lookup. The final query has a local query option of +noqr which means that dig will not print the initial query when it looks up the NS records for isc.org.
IDN support
If dig was built with IDN (internationalized domain name) support, it can accept and display non-ASCII domain names. dig appropriately converts character encoding of domain name before sending a request to DNS server or displaying a reply from the server. If you'd like to turn off the IDN support for some reason, defines the IDN_DISABLE environment variable. The IDN support is disabled if the variable is set when dig runs.
查看英文版
查看中文版
dig 例子
dig computerhope.com
在上面的命令中鍵入將顯示類似于以下內容的信息：
; <<>> DiG 9.8.3-P1 <<>> computerhope.com
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 23826
;; flags: qr rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 0
;; QUESTION SECTION:
;computerhope.com. IN A
;; ANSWER SECTION:
computerhope.com. 86400 IN A 104.20.56.118
;; Query time: 51 msec
;; SERVER: 192.168.1.1#53(192.168.1.1)
;; WHEN: Sun Mar 23 11:16:37 2014
;; MSG SIZE rcvd: 50
dig computerhope.com
Typing in the above command would display information similar to the following:
; <<>> DiG 9.8.3-P1 <<>> computerhope.com
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 23826
;; flags: qr rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 0
;; QUESTION SECTION:
;computerhope.com. IN A
;; ANSWER SECTION:
computerhope.com. 86400 IN A 104.20.56.118
;; Query time: 51 msec
;; SERVER: 192.168.1.1#53(192.168.1.1)
;; WHEN: Sun Mar 23 11:16:37 2014
;; MSG SIZE rcvd: 50
dig (執行網絡DNS查找)
在類似Unix的操作系統上，dig命令執行網絡DNS查找。
On Unix-like operating systems, the dig command performs network DNS lookups.
查看英文版
查看中文版
1 dig 運行系統環境
2 dig 描述
3 dig 語法
4 dig 例子
dig 運行系統環境
Unix&Linux
dig 描述
dig（代表域信息groper）是一種用于查詢DNS名稱服務器的靈活工具。它執行DNS查找，并顯示從被名稱服務器（一個或多個）返回的答案查詢。由于DNS的靈活性，易用性和輸出的清晰度，大多數DNS管理員都使用dig來解決DNS問題。其他查找工具的功能往往比挖掘少。
盡管dig通常與命令行 參數一起使用，但它也具有批處理操作模式，用于從文件讀取查詢請求。給定-h選項時，將打印其命令行參數和選項的摘要。與早期版本不同，dig的BIND 9實現允許從命令行發出多個查詢。
除非被告知要查詢特定的名稱服務器，否則dig將嘗試/etc/resolv.conf中列出的每個服務器。
如果未提供任何命令行參數或選項，dig將執行NS查詢“ 。 ”（根目錄）。
可以通過$ {HOME} /。digrc為每個用戶設置默認的dig 。將讀取此文件，并在命令行參數之前應用其中的所有選項。
IN和CH類名稱與IN和CH頂級域名重疊。使用-t和-c選項指定類型和類，或者使用-q指定域名，或者使用“ IN”。和“ CH”。在查找這些頂級域時。
dig (which stands for domain information groper) is a flexible tool for interrogating DNS name servers. It performs DNS lookups and displays the answers that are returned from the name server(s) that were queried. Most DNS administrators use dig to troubleshoot DNS problems because of its flexibility, ease of use and clarity of output. Other lookup tools tend to have less functionality than dig.
Although dig is normally used with command-line arguments, it also has a batch mode of operation for reading lookup requests from a file. A summary of its command-line arguments and options is printed when the -h option is given. Unlike earlier versions, the BIND 9 implementation of dig allows multiple lookups to be issued from the command line.
Unless it is told to query a specific name server, dig will try each of the servers listed in /etc/resolv.conf.
When no command line arguments or options are given, dig will perform an NS query for "." (the root).
It is possible to set per-user defaults for dig via ${HOME}/.digrc. This file is read and any options in it are applied before the command line arguments.
The IN and CH class names overlap with the IN and CH top level domains names. Either use the -t and -c options to specify the type and class, use the -q the specify the domain name, or use "IN." and "CH." when looking up these top level domains.
查看英文版
查看中文版
dig 語法
dig [@server] [-b address] [-c class] [-f filename] [-k filename] [-m] [-p port#] [-q name] [-t type] [-x addr] [-y [hmac:]name:key] [-4] [-6] [name] [type] [class] [queryopt...]選件
-b address
該-b選項設置查詢的源IP地址地址。這必須是主機網絡接口之一上的有效地址，或者是“ 0.0.0.0”或“ ::”?？梢酝ㄟ^附加“＃ ”來指定可選端口
-c class
默認查詢類（IN為互聯網）被覆蓋由-c選項。class是任何有效的類，例如Hesiod記錄的HS或CHAOSNET記錄的CH。
-f filename
在-f選項使挖掘從文件讀取查找請求的列表，以處理在批處理模式下運行的文件名。該文件包含許多查詢，每行一個。文件中的每個條目都應以與使用命令行界面進行挖掘的查詢相同的方式組織。
-p port＃
如果要查詢非標準端口號，則使用-p選項。port＃是dig將發送其查詢的端口號，而不是標準DNS端口號53。此選項將用于測試配置為偵聽非標準端口號上的查詢的名稱服務器。
-4
在-4選項強制挖只使用IPv4的查詢運輸。
-6
該-6選項強制挖僅使用IPv6的查詢運輸。
-t type
該-t選項設置查詢類型為類型。它可以是BIND9支持的任何有效查詢類型。缺省查詢類型“ A ”，除非提供了-x選項以指示反向查找。甲區轉移可以通過指定一個請求AXFR。當增量區域傳輸（IXFR是必需的），類型被設置為IXFR = N。增量區域傳輸將包含自到區域所做的更改序列號，在該區域的SOA記錄是?。
-x addr
-x選項簡化了反向查詢（將地址映射到名稱）。addr是點分十進制格式的IPv4地址，或冒號分隔的IPv6地址。使用此選項時，無需提供名稱，類和類型參數。挖掘將自動對諸如11.12.13.10.in-addr.arpa之類的名稱執行查找，并將查詢類型和類分別設置為PTR和IN。默認情況下，在IP6.ARPA域下使用半字節格式查找IPv6地址。要使用IP6.INT域使用較舊的RFC1886方法，請指定-i選項。位字符串標簽（RFC2874）現在處于試驗階段，不再嘗試。
-k filename
要使用TSIG（事務簽名）對dig發送的DNS查詢及其響應進行簽名，請使用-k選項指定一個TSIG密鑰文件。
-y [ hmac ： ]name：key
您也可以使用-y選項在命令行上指定TSIG密鑰本身。name是TSIG密鑰的名稱，而key是實際密鑰。密鑰是由dnssec-keygen生成的base-64編碼的字符串。在多用戶系統上使用-y選項時應小心，因為該鍵在ps的輸出或外殼的歷史記錄文件中可見。將TSIG身份驗證與dig結合使用時，查詢的名稱服務器需要知道所使用的密鑰和算法。在BIND中，這是通過在named.conf中提供適當的key和server語句來完成的。
使用簡單
典型的dig調用如下：
哪里：
查詢選項
dig提供了許多查詢選項，這些選項會影響查找方式和結果顯示方式。查詢標頭中的這些設置或重置標志位中的一些，一些確定打印答案的哪些部分，其他確定超時和重試策略。
每個查詢選項都由一個關鍵字加一個加號（+）標識。一些關鍵字設置或重置選項?？梢栽谒鼈兦懊婕由献址畁o來否定該關鍵字的含義。其他關鍵字為諸如超時間隔之類的選項分配值。它們的格式為+ keyword = value。查詢選項為：
+ [no] tcp
查詢名稱服務器時，請使用[不使用] TCP。除非請求AXFR或IXFR查詢，否則默認行為是使用UDP，在這種情況下，將使用TCP連接。
+ [no] vc
查詢名稱服務器時，請使用[不使用] TCP。提供了+ [no] tcp的備用語法以實現向后兼容?！?vc”代表“虛擬電路”。
+ [no]忽略
忽略UDP響應中的截斷，而不是使用TCP重試。默認情況下，執行TCP重試。
+ domain =somename
設置搜索列表以包含單個域somename，就像在/etc/resolv.conf中的domain指令中指定的那樣，并啟用搜索列表處理，就好像給出了+ search選項一樣。
+ [no]search
使用[請勿使用]由resolv.conf中的searchlist或domain指令定義的搜索列表（如果有）。默認情況下不使用搜索列表。
+ [ no ] showsearch
執行[不執行]顯示中間結果的搜索。
+ [ no ] defname
已過時，視為+ [no] search的同義詞
+ [ no ] aaonly
在查詢中設置“ aa ”標志。
+ [ no ] aaflag
僅+ [no] aa的同義詞。
+ [ no ] adflag
設置[不設置]查詢中的AD（真實數據）位。這要求服務器返回是否已根據服務器的安全性策略將所有答案和權限部分都全部確認為安全性。AD = 1表示所有記錄都已被確認為安全記錄，并且答案不在OPT-OUT范圍內。AD = 0表示答案的某些部分不安全或未通過驗證。
+ [ no ] cdflag
在查詢中設置[不設置] CD（禁用檢查）位。這要求服務器不執行響應的DNSSEC驗證。
+ [ no ] cl
打印記錄時顯示[不顯示] CLASS。
+ [no] ttlid
打印記錄時顯示[不顯示] TTL。
+ [no]recurse
切換查詢中的RD（需要遞歸）位的設置。該位是默認設置的，這意味著dig通常會發送遞歸查詢。使用+ nssearch或+ trace查詢選項時，將自動禁用遞歸。
+ [no] nssearch
設置此選項后，dig將嘗試查找包含正在查找的名稱的區域的權威名稱服務器，并顯示每個名稱服務器對該區域具有的SOA記錄。
+ [no]trace
從根名稱服務器切換對要查找的名稱的委派路徑的跟蹤。默認情況下，跟蹤是禁用的。啟用跟蹤后，dig會進行迭代查詢以解析要查找的名稱。它將遵循來自根服務器的引用，顯示來自用于解析該查詢的每個服務器的答案。
+ [no] cmd
切換輸出中初始注釋的打印，以標識dig的版本和已應用的查詢選項。默認情況下，此注釋是打印的。
+ [ no ]short
提供一個簡短的答案。默認為以詳細形式打印答案。
+ [no]identify
顯示[或不顯示]啟用+ short選項時提供答案的IP地址和端口號。如果要求提供簡短的答案，則默認為不顯示提供答案的服務器的源地址和端口號。
+ [no]comments
切換輸出中注釋行的顯示。默認為打印注釋。
+ [no]stats
此查詢選項可切換統計信息的打?。哼M行查詢時，答復的大小等。默認行為是打印查詢統計信息。
+ [no] qr
在發送查詢時打印[不打印]查詢。默認情況下，不打印查詢。
+ [no]question
返回答案時，打印[不打印]查詢的問題部分。默認設置是將問題部分打印為注釋。
+ [no]answer
顯示[不顯示]答復的答案部分。默認是顯示它。
+ [no]authority
顯示[不顯示]回復的權限部分。默認是顯示它。
+ [no]additional
顯示[不顯示]答復的其他部分。默認是顯示它。
+ [no]all
設置或清除所有顯示標志。
+time= T
將查詢超時設置為T秒。默認超時為5秒。嘗試將T設置為小于1將導致應用查詢超時1秒。
+tries= T
將嘗試對服務器的UDP查詢的次數設置為T，而不是默認值3。如果T小于或等于零，則嘗試次數將自動舍入為1。
+retry= T
將重試到服務器的UDP查詢的次數設置為T，而不是默認值2。與+ tries不同，它不包括初始查詢。
+ ndots = D
將必須出現在名稱中的點數設置為D，才能將其視為絕對值。缺省值是使用所定義的ndots語句/etc/resolv.conf中，或1，如果沒有的ndots語句存在。點號較少的名稱將被解釋為相對名稱，并將在/etc/resolv.conf的search或domain指令中列出的域中進行搜索。
+ bufsize = B
將使用EDNS0通告的UDP消息緩沖區大小設置為B 字節。該緩沖區的最大和最小大小分別為65535和0。超出此范圍的值將適當向上或向下取整。非零值將導致發送EDNS查詢。
+ edns = ＃
指定要在查詢中使用的EDNS版本。有效值為0到255。設置EDNS版本將導致發送EDNS查詢。+ noedns清除記住的EDNS版本。
+ [ no ]multiline
以冗長的多行格式打印記錄，如SOA記錄，并帶有易于閱讀的注釋。默認設置是將每條記錄打印在一行上，以便于計算機分析挖掘輸出。
+ [no] onesoa
執行AXFR時僅打印一個（開始）SOA記錄。默認設置是同時打印開始和結束SOA記錄。
+ [no]fail
如果收到SERVFAIL，請不要嘗試下一個服務器。默認設置是不嘗試與普通存根解析器行為相反的下一個服務器。
+ [no]besteffort
嘗試顯示格式錯誤的消息的內容。默認為不顯示格式錯誤的答案。
+ [no] dnssec
通過在查詢的附加部分中的OPT記錄中設置DO（DNSSEC OK）位來發送請求DNSSEC記錄。
+ [ no ] sigchase
追逐DNSSEC簽名鏈。需要使用-DDIG_SIGCHASE編譯dig。
+ trusted-key = ####
指定包含與+ sigchase一起使用的受信任密鑰的文件。每個DNSKEY記錄必須位于其自己的行上。
如果未指定，dig將在當前目錄中查找/etc/trusted-key.key，然后查找trust-key.key。
需要使用-DDIG_SIGCHASE編譯dig。
+ [no]topdown
追蹤DNSSEC簽名鏈時，請執行自頂向下的驗證。需要使用-DDIG_SIGCHASE編譯dig。
+ [no] nsid
發送查詢時，請包含EDNS名稱服務器ID請求。
多個查詢
dig的BIND 9實現支持在命令行上指定多個查詢（除了支持-f批處理文件選項之外）?？梢詾槊總€查詢提供自己的一組標志，選項和查詢選項。
在這種情況下，每個查詢參數代表上述命令行語法中的單個查詢。每個選項都包含任何標準選項和標志，要查找的名稱，可選的查詢類型和類以及應應用于該查詢的所有查詢選項。
還可以提供應應用于所有查詢的全局查詢選項集。這些全局查詢選項必須在命令行上提供的名稱，類，類型，選項，標志和查詢選項的第一個元組之前。特定于查詢的一組查詢選項可以覆蓋所有全局查詢選項（+ [ no ] cmd選項除外）。例如：
dig +qr www.isc.org any -x 127.0.0.1 isc.org ns +noqr
顯示了如何從命令行使用dig進行三個查詢：對www.isc.org的ANY查詢，對127.0.0.1的反向查詢以及對isc.org的NS記錄的查詢。應用了+ qr的全局查詢選項，因此dig顯示了它為每次查找所做的初始查詢。最終查詢的本地查詢選項為+ noqr，這意味著dig在查詢isc.org的NS記錄時不會打印初始查詢。
IDN支持
如果dig是使用IDN（國際化域名）支持構建的，則它可以接受和顯示非ASCII域名。dig在向DNS服務器發送請求或顯示來自服務器的答復之前，會適當地轉換域名的字符編碼。如果您出于某種原因想要關閉IDN支持，請定義IDN_DISABLE環境變量。如果在運行dig時設置了變量，則將禁用IDN支持。
dig [@server] [-b address] [-c class] [-f filename] [-k filename] [-m] [-p port#] [-q name] [-t type] [-x addr] [-y [hmac:]name:key] [-4] [-6] [name] [type] [class] [queryopt...]Options
-b address
The -b option sets the source IP address of the query to address. This must be a valid address on one of the host's network interfaces or "0.0.0.0" or "::". An optional port may be specified by appending "#"
-c class
The default query class (IN for Internet) is overridden by the -c option. class is any valid class, such as HS for Hesiod records or CH for CHAOSNET records.
-f filename
The -f option makes dig operate in batch mode by reading a list of lookup requests to process from the file filename. The file contains many queries, one per line. Each entry in the file should be organized in the same way they would be presented as queries to dig using the command-line interface.
-p port#
If a non-standard port number is to be queried, the -p option is used. port# is the port number that dig will send its queries instead of the standard DNS port number 53. This option would be used to test a name server that was configured to listen for queries on a non-standard port number.
-4
The -4 option forces dig to only use IPv4 query transport.
-6
The -6 option forces dig to only use IPv6 query transport.
-t type
The -t option sets the query type to type. It can be any valid query type that is supported in BIND9. The default query type "A", unless the -x option is supplied to indicate a reverse lookup. A zone transfer can be requested by specifying a AXFR. When an incremental zone transfer (IXFR) is required, type is set to ixfr=N. The incremental zone transfer will contain the changes made to the zone since the serial number in the zone's SOA record was N.
-x addr
Reverse lookups (mapping addresses to names) are simplified by the -x option. addr is an IPv4 address in dotted-decimal notation, or a colon-delimited IPv6 address. When this option is used, there is no need to provide the name, class, and type arguments. The dig automatically performs a lookup for a name like 11.12.13.10.in-addr.arpa and sets the query type and class to PTR and IN respectively. By default, IPv6 addresses are looked up using nibble format under the IP6.ARPA domain. To use the older RFC1886 method using the IP6.INT domain specify the -i option. Bit string labels (RFC2874) are now experimental and are not attempted.
-k filename
To sign the DNS queries sent by dig and their responses using TSIG (transaction signatures), specify a TSIG key file using the -k option.
-y [hmac:]name:key
You can also specify the TSIG key itself on the command line using the -y option; name is the name of the TSIG key and key is the actual key. The key is a base-64 encoded string, generated by dnssec-keygen. Caution should be taken when using the -y option on multi-user systems as the key can be visible in the output from ps or in the shell's history file. When using TSIG authentication with dig, the name server that is queried needs to know the key and algorithm that is being used. In BIND, this is done by providing appropriate key and server statements in named.conf.
Simple usage
A typical invocation of dig looks like:
where:
Query options
dig provides many query options which affect the way in which lookups are made and the results displayed. Some of these set or reset flag bits in the query header, some determine which sections of the answer get printed, and others determine the timeout and retry strategies.
Each query option is identified by a keyword preceded by a plus sign (+). Some keywords set or reset an option. These may be preceded by the string no to negate the meaning of that keyword. Other keywords assign values to options like the timeout interval. They have the form +keyword=value. The query options are:
+[no]tcp
Use [do not use] TCP when querying name servers. The default behavior is to use UDP unless an AXFR or IXFR query is requested, in which case a TCP connection is used.
+[no]vc
Use [do not use] TCP when querying name servers. This alternate syntax to +[no]tcp is provided for backward compatibility. The "vc" stands for "virtual circuit".
+[no]ignore
Ignore truncation in UDP responses instead of retrying with TCP. By default, TCP retries are performed.
+domain=somename
Set the search list to contain the single domain somename, as if specified in a domain directive in /etc/resolv.conf, and enable search list processing as if the +search option were given.
+[no]search
Use [do not use] the search list defined by the searchlist or domain directive in resolv.conf (if any). The search list is not used by default.
+[no]showsearch
Perform [do not perform] a search showing intermediate results.
+[no]defname
Deprecated, treated as a synonym for +[no]search
+[no]aaonly
Sets the "aa" flag in the query.
+[no]aaflag
A synonym for +[no]aaonly.
+[no]adflag
Set [do not set] the AD (authentic data) bit in the query. This requests the server to return whether all of the answer and authority sections have all been validated as secure according to the security policy of the server. AD=1 indicates that all records have been validated as secure and the answer is not from an OPT-OUT range. AD=0 indicate that some part of the answer was insecure or not validated.
+[no]cdflag
Set [do not set] the CD (checking disabled) bit in the query. This requests the server to not perform DNSSEC validation of responses.
+[no]cl
Display [do not display] the CLASS when printing the record.
+[no]ttlid
Display [do not display] the TTL when printing the record.
+[no]recurse
Toggle the setting of the RD (recursion desired) bit in the query. This bit is set by default, which means dig normally sends recursive queries. Recursion is automatically disabled when the +nssearch or +trace query options are used.
+[no]nssearch
When this option is set, dig attempts to find the authoritative name servers for the zone containing the name being looked up and display the SOA record that each name server has for the zone.
+[no]trace
Toggle tracing of the delegation path from the root name servers for the name being looked up. Tracing is disabled by default. When tracing is enabled, dig makes iterative queries to resolve the name being looked up. It will follow referrals from the root servers, showing the answer from each server that was used to resolve the lookup.
+[no]cmd
Toggles the printing of the initial comment in the output identifying the version of dig and the query options that have been applied. This comment is printed by default.
+[no]short
Provide a terse answer. The default is to print the answer in a verbose form.
+[no]identify
Show [or do not show] the IP address and port number that supplied the answer when the +short option is enabled. If short form answers are requested, the default is not to show the source address and port number of the server that provided the answer.
+[no]comments
Toggle the display of comment lines in the output. The default is to print comments.
+[no]stats
This query option toggles the printing of statistics: when the query was made, the size of the reply, etc. The default behavior is to print the query statistics.
+[no]qr
Print [do not print] the query as it is sent. By default, the query is not printed.
+[no]question
Print [do not print] the question section of a query when an answer is returned. The default is to print the question section as a comment.
+[no]answer
Display [do not display] the answer section of a reply. The default is to display it.
+[no]authority
Display [do not display] the authority section of a reply. The default is to display it.
+[no]additional
Display [do not display] the additional section of a reply. The default is to display it.
+[no]all
Set or clear all display flags.
+time=T
Sets the timeout for a query to T seconds. The default timeout is 5 seconds. An attempt to set T to less than 1 will result in a query timeout of 1 second being applied.
+tries=T
Sets the number of times to try UDP queries to server to T instead of the default, 3. If T is less than or equal to zero, the number of tries is silently rounded up to 1.
+retry=T
Sets the number of times to retry UDP queries to server to T instead of the default, 2. Unlike +tries, this does not include the initial query.
+ndots=D
Set the number of dots that have to appear in name to D for it to be considered absolute. The default value is that defined using the ndots statement in /etc/resolv.conf, or 1 if no ndots statement is present. Names with fewer dots are interpreted as relative names and will be searched for in the domains listed in the search or domain directive in /etc/resolv.conf.
+bufsize=B
Set the UDP message buffer size advertised using EDNS0 to B bytes. The maximum and minimum sizes of this buffer are 65535 and 0 respectively. Values outside this range are rounded up or down appropriately. Values other than zero will cause an EDNS query to be sent.
+edns=#
Specify the EDNS version to use in a query. Valid values are 0 to 255. Setting the EDNS version will cause an EDNS query to be sent. +noedns clears the remembered EDNS version.
+[no]multiline
Print records like the SOA records in a verbose multi-line format with human-readable comments. The default is to print each record on a single line, to facilitate machine parsing of the dig output.
+[no]onesoa
Print only one (starting) SOA record when performing an AXFR. The default is to print both the starting and ending SOA records.
+[no]fail
Do not try the next server if you receive a SERVFAIL. The default is to not try the next server that is the reverse of normal stub resolver behavior.
+[no]besteffort
Attempt to display the contents of messages that are malformed. The default is to not display malformed answers.
+[no]dnssec
Requests DNSSEC records be sent by setting the DO (DNSSEC OK) bit in the OPT record in the additional section of the query.
+[no]sigchase
Chase DNSSEC signature chains. Requires dig be compiled with -DDIG_SIGCHASE.
+trusted-key=####
Specifies a file containing trusted keys to be used with +sigchase. Each DNSKEY record must be on its own line.
If not specified, dig will look for /etc/trusted-key.key then trusted-key.key in the current directory.
Requires dig be compiled with -DDIG_SIGCHASE.
+[no]topdown
When chasing DNSSEC signature chains perform a top-down validation. Requires dig be compiled with -DDIG_SIGCHASE.
+[no]nsid
Include an EDNS name server ID request when sending a query.
Multiple queries
The BIND 9 implementation of dig supports specifying multiple queries on the command line (in addition to supporting the -f batch file option). Each of those queries can be supplied with its own set of flags, options, and query options.
In this case, each query argument represents an individual query in the command-line syntax described above. Each consists of any of the standard options and flags, the name to be looked up, an optional query type and class and any query options that should be applied to that query.
A global set of query options, which should be applied to all queries, can also be supplied. These global query options must precede the first tuple of name, class, type, options, flags, and query options supplied on the command line. Any global query options (except the +[no]cmd option) can be overridden by a query-specific set of query options. For example:
dig +qr www.isc.org any -x 127.0.0.1 isc.org ns +noqr
shows how dig could be used from the command line to make three lookups: an ANY query for www.isc.org, a reverse lookup of 127.0.0.1 and a query for the NS records of isc.org. A global query option of +qr is applied, so that dig shows the initial query it made for each lookup. The final query has a local query option of +noqr which means that dig will not print the initial query when it looks up the NS records for isc.org.
IDN support
If dig was built with IDN (internationalized domain name) support, it can accept and display non-ASCII domain names. dig appropriately converts character encoding of domain name before sending a request to DNS server or displaying a reply from the server. If you'd like to turn off the IDN support for some reason, defines the IDN_DISABLE environment variable. The IDN support is disabled if the variable is set when dig runs.
查看英文版
查看中文版
dig 例子
在上面的命令中鍵入將顯示類似于以下內容的信息：
Typing in the above command would display information similar to the following:
查看英文版
查看中文版
其他命令行
date | du | dpost | dmesg | dirname | dircmp | dd | deluser | depmod | deroff | df | dhclient | diff | dos2unix |