<aside> ⚡

Daily Ops Cheat Sheet — DNS & Linux Networking

The commands you actually type, grouped by what you are trying to do rather than by tool. Built for 3am: find the section that matches your question, copy the line, move on.

Companion to the DNS track — every command here is explained in depth in one of its nine modules, and the module is cited so you can go and read why when you have time.

</aside>

<aside> 🔑

Three rules that make everything below work.

1. Read status: first. Not the answer, not the IP — the status line. Five outcomes, five different owners
2. No status: line at all means DNS told you nothing. Nothing responded; you are debugging the network
3. dig and your application do not take the same path. When they disagree, that is the diagnosis </aside>

A · Look something up

<aside> 📖

Official docs: dig · host · getent(1) — DNS track Modules 01–02

</aside>

A1 · What does this name resolve to?

dig +short example.com                  # values only - for scripts, but see the WARNING
dig +noall +answer example.com          # values + TTL + type - the everyday form
dig example.com                         # everything, when you need the header

# a specific type
dig +noall +answer example.com MX
dig +noall +answer example.com TXT
dig +noall +answer example.com AAAA     # ALWAYS check this too - see A5

<aside> ⚠️

Never use dig +short in a check or an alert. An empty result means NXDOMAIN or NODATA or SERVFAIL or REFUSED or a timeout — five different problems, four different teams, one identical empty string.

</aside>

A2 · Everything this name has, in one sweep

D=example.com
for t in SOA NS A AAAA MX TXT CAA DNSKEY; do
  out=$(dig +noall +answer "$D" "$t")
  [ -n "$out" ] && echo "$out" || printf '%-8s  (none)\n' "$t"
done

<aside> 🔑

Print the (none) lines. The absences are findings: no AAAA means IPv6-only clients cannot reach you; no CAA means every CA on earth may issue for you; no DNSKEY means the zone is unsigned.

</aside>

A3 · Does this exact name exist?

N=admin.example.com

# 1. wildcard check FIRST - without this, nothing below means anything
dig "zz$RANDOM-probe.example.com" +noall +comments | grep -o 'status: [A-Z]*'
#    NXDOMAIN  -> no wildcard, results are trustworthy
#    anything else -> a wildcard exists, every name "resolves", stop here

# 2. the name itself, with status visible
dig "$N" +noall +comments +answer

# 3. other types - a name can exist as CNAME or TXT only
dig "$N" AAAA +short ; dig "$N" CNAME +short ; dig "$N" TXT +short

# 4. confirm against an AUTHORITATIVE server - no cache involved
dig @"$(dig +short example.com NS | head -1)" "$N" +noall +comments +answer

A4 · Follow a CNAME chain to the end

dig +noall +answer www.example.com      # shows the CNAME AND the resolved target
dig +short www.example.com              # first line a hostname = it is a chain

<aside> 🔑

If +short's first line is a name rather than an IP, you are looking at a CNAME chain. Each hop is latency on a cache miss and a third party who can break you.

</aside>