ronutz

dig command builder

Say what to look up, where to ask and how, and get one copy-pasteable dig command with every token explained, the combinations the manual calls redundant or contradictory flagged, and a summary of what the query will carry: transport, port, RD, DO, CD, EDNS and cookie. The inverse of the dig output explainer. Runs nothing; built in your browser from the BIND 9 manual and the DNS RFCs.

Redes
Documentation
The query you want

Fill in what you know; everything else keeps dig's default and is not written. The command updates as you type. Nothing is run here.

What to look up

A is dig's default type and IN its default class, so neither is written. With -x, dig derives the PTR name itself and the name, type and class fields are not used. ANY, AXFR and IXFR are query types dig accepts in the type field.

Where to ask
Transport
Address family

dig's default: UDP to port 53, retrying over TCP when the answer comes back truncated (unless +ignore). Type ANY and ixfr=N default to TCP, and AXFR always uses TCP.

How to ask
EDNS (the OPT record)
Timing
What to print
Output
On your machine

Only a key file is offered. dig also has -y, which takes the shared secret on the command line; the manual says to use -k instead, because the secret would show in ps output and in the shell's history.

The command
dig @192.0.2.53 example.com MX +dnssec +multiline

Written for a POSIX shell (tokens that need it are single-quoted). In Windows cmd.exe, quote with double quotes instead.

What the query will carry

Question
example.com MX IN
Asked
the server named with @
Transport
UDP, port 53 (retries over TCP if truncated)
RD, recursion desired
yes
DO, DNSSEC OK
yes
CD, checking disabled
no
AD, authentic data
yes set by dig by default
EDNS OPT record
yes advertising dig's default size, 1232 bytes in BIND 9.18 and later
DNS COOKIE option
yes
Signed (TSIG)
no

Derived from the manual's stated defaults and interactions, not from running dig: RD set by default, cleared by +norecurse, +trace and +nssearch; DO set by +dnssec or +trace; EDNS version 0 by default; the cookie on by default and off with +nocookie or +noedns; type ANY and ixfr=N over TCP by default, AXFR always.

Every token
digThe BIND 9 DNS lookup utility.
@192.0.2.53@server: ask this name server instead of the ones in /etc/resolv.conf. A host name is resolved first; an IPv4 or IPv6 address is used as is.
example.comThe owner name to look up.
MXThe record type (dig's default, A, is omitted).
+dnssec+dnssec: set the DNSSEC OK (DO) bit in the OPT record, asking for the RRSIG and other DNSSEC records.
+multiline+multiline: print records such as SOA and DNSKEY over several lines with comments.

Built entirely in your browser from the intent above. Nothing is resolved, sent or stored.

API endpointGEThttps://ronutz.com/api/v1/dig-command-builderDocumented, not served. Opens the specification.

Referencias