What it does

You describe the query; the page writes the dig command line. Four groups of controls map onto the four things a dig invocation says:

  • What to look up: a name and a record type (A by default, any mnemonic in the IANA registry, TYPEnn, or the query types ANY, AXFR and IXFR with the serial you hold), a class (IN by default; CH and HS), or an address for a reverse lookup with -x, in which case dig derives the PTR name itself and the name, type and class are not written.
  • Where to ask: the server (@server, a host name or a bare IPv4 or IPv6 address), a non-standard port (-p), the transport (UDP, +tcp, +tls, +https with its endpoint), one address family (-4, -6) and a source address (-b).
  • How to ask: +trace, +nssearch, +norecurse, +dnssec, +cd, +ignore; the EDNS controls +bufsize, +subnet, +nsid, +nocookie, +noedns; and the timers +timeout, +tries, +retry.
  • What to print: the whole message, +short (with +identify), +noall +answer, or +yaml; plus +multiline, +ttlunits and +qr.
  • On your machine: -k keyfile for a signed query and -r to ignore ~/.digrc.

Three things come back: the command, in one canonical order, with a Copy button; findings, where a combination is contradictory, redundant or likely to surprise; and a summary of what the query will carry, derived from the manual's stated defaults and interactions: the question dig will put in the message, which servers are asked, the transport and port after the type defaults, whether a truncated UDP answer is retried over TCP, and the RD, DO, CD and AD bits, the EDNS OPT record and its buffer size, the cookie, and whether the query is signed. Every token is explained underneath.

The order of the command

dig reads the whole line and does not care much about order, with two exceptions the manual states: query options (the + words) are order sensitive, and +short and +cmd are global. The builder writes one fixed order so the same intent always gives the same bytes: dig, @server, the options (-r, -4/-6, -b, -p, -k), the question (-x address, or the name, then the type, then the class), then the query options grouped as transport, mode, header bits, EDNS, timers, output. +noall is always written before +answer because they apply in sequence.

Defaults are not written: type A, class IN, port 53 (853 for TLS, 443 for HTTPS), UDP. A name that is also a type or class mnemonic (the ch top-level domain, a host literally called mx) is written with -q, because dig reads bare words as types and classes before names; the manual's own note about the IN and CH top-level domains is the reason the option exists.

What the findings check

Each rule points at the sentence in the manual or the RFC that justifies it:

  • +trace sets +dnssec and +cookie and disables recursion; @server then affects only the initial query for the root servers. Asking for +dnssec or +norecurse alongside is flagged as redundant, and the server note is shown.
  • +nssearch disables recursion too.
  • Type ANY and ixfr=N default to TCP; AXFR always uses TCP, and a transfer with no @server would go to the resolvers in /etc/resolv.conf rather than to a server that holds the zone (RFC 5936). ANY may be answered minimally or with a synthesised HINFO record (RFC 8482).
  • +bufsize is 0 to 65535; a value under 512 is treated as 512 by the receiver (RFC 6891, section 6.2.3); above 4096 is more than RFC 6891's suggested starting point; DNS Flag Day 2020 names 1232 as the minimum safe size.
  • +bufsize=0 is flagged as a check: it advertises a 0-byte EDNS UDP buffer, which the receiver treats as 512. It does not restore the default; the manual gives that job to +bufsize with no value. dig's default is 1232 bytes (DEFAULT_EDNS_BUFSIZE in the 9.20.29 source). The change from 4096 to 1232 is BIND CHANGES entry 5516, released in 9.17.6 and so in every release from 9.18.0; in the 9.16 branch the same entry reached named but not dig, which kept 4096 through 9.16.50.
  • +dnssec, +trace, +bufsize, +nsid and +subnet live in the OPT record (RFC 6891; the DO bit is RFC 3225), so +noedns cannot be combined with them and is not written when they are present.
  • +subnet=0 (or a prefix length of 0) asks the resolver not to use your address (RFC 7871).
  • -4 against an IPv6 server literal, or -6 against an IPv4 one, leaves dig with nowhere to send the query.
  • +timeout below 1 and +tries of 0 are silently raised to 1 by dig.
  • +identify does nothing without +short; +ignore does nothing without UDP.
  • Only -k is offered for TSIG. The manual says to use it rather than -y, because -y puts the shared secret on the command line where ps and the shell history can see it.

Limits

  • The builder emits one lookup per command. dig can take several queries on one line, each with its own options, and a batch file with -f; neither is modelled.
  • It does not run dig, resolve anything or check that a server exists. The summary is derived from the manual's statements, not observed.
  • Options not offered (+aaonly, +besteffort, +cmd, +comments, +crypto, +domain, +ednsopt, +expire, +header-only, +keepopen, +ndots, +onesoa, +opcode, +padding, +proxy, +qid, +search, +split, +stats, +tls-ca and the other TLS files, +unknownformat, +zoneversion, -c as an option, -f, -F, -m, -t as an option, -u, -y) are documented in the manual; the common ones are here.
  • Names are checked for shape (labels of letters, digits, hyphens and underscores, at most 63 characters each, at most 253 in all; a lone asterisk as a wildcard label); the builder does not know whether a name exists.
  • The dig manual read for this page is the BIND 9 "latest" documentation (9.21), and for +bufsize the stable 9.20.29 manual (read 2026-10-19). Older dig versions lack some query options (+tls, +https, +yaml are recent); dig prints "Invalid option" for a word it does not know.

API

The same engine answers the /api/v1/dig-command-builder operation of the site's HTTP API, written out field by field in the OpenAPI contract on the API page, with examples taken from the golden vectors. The contract also says whether this site serves the API.

  • Request. A JSON object with the form's fields: name, type, ixfrSerial, klass, reverse, server, port, ipv, source, transport, httpsEndpoint, bufsize, subnet, timeout, tries, retry, output and keyfile as strings, and the switches trace, nssearch, norecurse, dnssec, cd, noedns, nocookie, nsid, ignore, identify, multiline, ttlunits, qr and norc as booleans.
  • Response. ok, command, parts (text, kind and explain, the id of the explanation), findings (code, severity and params) and effective, what the query carries.
  • Errors. An error finding is not an HTTP error: ok is false, command is empty and effective is null. A body that is not a JSON object answers HTTP 400.

Since 2026-10-19, {"name": "example.com", "bufsize": "0"} returns the finding bufsize-default with severity warning; it was an info that said 0 restores the default.

Sources