dig prints a DNS message in a stable, top-to-bottom layout. Learning that layout is most of the skill: every answer, whether a clean lookup or a puzzling failure, uses the same blocks in the same order.

The blocks, in order

A typical answer looks like this:

; <<>> DiG 9.18.1 <<>> example.com A
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 4321
;; flags: qr rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 1

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 1232
;; QUESTION SECTION:
;example.com.			IN	A

;; ANSWER SECTION:
example.com.		3600	IN	A	93.184.216.34

;; Query time: 12 msec
;; SERVER: 1.1.1.1#53(1.1.1.1) (UDP)
;; MSG SIZE  rcvd: 56

Reading down: the first line echoes the dig version and the query you ran. The ->>HEADER<<- line carries the opcode, the status (the RCODE), and the message id. The flags line lists which header bits are set and gives the record count in each of the four sections. The OPT pseudo-section is EDNS metadata, not a real record. Then come the sections themselves: QUESTION (what you asked), ANSWER (the records that answer it), AUTHORITY (which servers are authoritative, or the SOA for a negative answer), and ADDITIONAL (helper records). The ;; lines at the bottom are the query statistics.

Where to look first

For a failure, start at the status. NOERROR with an answer record is the happy path. NXDOMAIN means the name does not exist. SERVFAIL usually means a broken delegation, a DNSSEC validation failure, or an upstream timeout. REFUSED is almost always policy. If the status is NOERROR but the ANSWER count is zero, the name exists but not for the type you asked (this is NODATA), and the SOA in the AUTHORITY section tells you how long that negative result will be cached.

The other early tell is the flags line. aa means the answering server is authoritative. ra tells you the server offers recursion. tc means the UDP answer was truncated and dig will normally retry over TCP; if you see it, the UDP result you are reading is incomplete.

The rest of this series takes each block in turn: the header and flags, the record types you see in answers, the EDNS OPT pseudo-section, and the DNSSEC records.