nslookup and dig for DNS in Linux CLI - Mini Project: Build & Apply

Using nslookup and dig for DNS Queries

📖 Scenario: You are working as a network technician. You need to check the IP address of a website and verify DNS records using command-line tools.

🎯 Goal: Learn how to use nslookup and dig commands to find DNS information about a domain.

📋 What You'll Learn

Use nslookup to find the IP address of example.com

Use dig to query the A record of example.com

Use dig to query the MX record of example.com

Display the results clearly in the terminal

💡 Why This Matters

🌍 Real World

Network administrators and IT support use nslookup and dig to check DNS records and troubleshoot domain name issues.

💼 Career

Knowing how to use these commands is essential for roles in network management, cybersecurity, and system administration.

1

Use nslookup to find the IP address

Type the command nslookup example.com to find the IP address of example.com.

Linux CLI

# Type the command nslookup example.com and press Enter

Hint

Type nslookup example.com exactly to get the IP address.

2

Use dig to query the A record

Type the command dig example.com A to query the A record (IPv4 address) of example.com.

Linux CLI

nslookup example.com
# Type the command dig example.com A and press Enter

Hint

Use dig example.com A to get the IPv4 address record.

3

Use dig to query the MX record

Type the command dig example.com MX to find the mail exchange servers for example.com.

Linux CLI

nslookup example.com
dig example.com A
# Type the command dig example.com MX and press Enter

Hint

Use dig example.com MX to find mail servers.

4

Display the results clearly

Type the commands again to display all results in the terminal: nslookup example.com dig example.com A dig example.com MX

Linux CLI

nslookup example.com
dig example.com A
dig example.com MX
# Run all commands again to show output

Hint

Run all three commands one after another to see the DNS information clearly.

Practice

1. What is the primary purpose of the nslookup command in Linux?

easy

A. To monitor network traffic

B. To edit DNS server settings

C. To find the IP address of a domain name quickly

D. To create new domain names

Solution

1. Step 1: Understand nslookup's function

   The nslookup command is used to query DNS to find IP addresses or domain names.

2. Step 2: Identify the main use case

   Its main use is to quickly find the IP address of a given domain name.

3. Final Answer:

   To find the IP address of a domain name quickly -> Option C

4. Quick Check:

   nslookup = quick IP lookup [OK]

Hint: nslookup quickly shows IP for a domain [OK]

Common Mistakes:

• Thinking nslookup edits DNS settings
• Confusing nslookup with network monitoring tools
• Assuming nslookup creates domains

2. Which of the following is the correct syntax to use dig to query the A record of example.com?

easy

A. dig -A example.com

B. dig example.com -t A

C. dig example.com A

D. dig -query=A example.com

Solution

1. Step 1: Recall dig syntax for record type

   The correct syntax uses the -t option to specify the record type, e.g., dig example.com -t A.

2. Step 2: Match syntax to options

   dig example.com -t A matches this syntax.

3. Final Answer:

   dig example.com -t A -> Option B

4. Quick Check:

   dig -t TYPE domain = query record [OK]

Hint: Use -t to specify record type: dig example.com -t A [OK]

Common Mistakes:

• Placing record type without -t option
• Using invalid -A flag
• Using nonexistent -query flag

3. What will be the output of the command nslookup google.com if the DNS server is reachable and working?

medium

A. The IP address(es) of google.com along with DNS server info

B. A list of all DNS servers on the internet

C. A blank output with no information

D. An error message saying 'server can't find google.com'

Solution

1. Step 1: Understand nslookup output on success

   If the DNS server is reachable, nslookup returns the IP address(es) of the domain and info about the DNS server used.

2. Step 2: Eliminate incorrect options

   An error message saying 'server can't find google.com' is an error message, which won't appear if DNS works. A blank output with no information is blank output, unlikely. A list of all DNS servers on the internet is unrelated.

3. Final Answer:

   The IP address(es) of google.com along with DNS server info -> Option A

4. Quick Check:

   nslookup success = IP + server info [OK]

Hint: Successful nslookup shows IP and server info [OK]

Common Mistakes:

• Expecting nslookup to list all DNS servers
• Thinking nslookup outputs blank on success
• Confusing error messages with normal output

4. You run dig example.com MX but get no answer section in the output. What is the most likely reason?

medium

A. The dig command syntax is incorrect

B. The DNS server is blocking all queries

C. Your internet connection is down

D. The domain example.com has no MX records configured

Solution

1. Step 1: Analyze dig output with no answer section

   If dig shows no answer section for MX query, it usually means no MX records exist for that domain.

2. Step 2: Check other options

   The syntax is correct, eliminating A. Internet down would cause timeout or no response. DNS blocking would cause errors like REFUSED, not empty answer.

3. Final Answer:

   The domain example.com has no MX records configured -> Option D

4. Quick Check:

   No MX answer = no MX records [OK]

Hint: No answer section means no such DNS record exists [OK]

Common Mistakes:

• Assuming syntax error when command is correct
• Blaming internet connection without checking
• Thinking DNS server blocks cause empty answers

5. You want to write a script that uses dig to check if a domain has an A record and print "Exists" or "Not Found" accordingly. Which command snippet correctly checks this?

hard

A. if dig example.com A +short | grep -q '.'; then echo "Exists"; else echo "Not Found"; fi

B. if dig example.com A | grep -q 'NXDOMAIN'; then echo "Exists"; else echo "Not Found"; fi

C. if nslookup example.com | grep -q 'Address'; then echo "Exists"; else echo "Not Found"; fi

D. if dig example.com MX +short | grep -q '.'; then echo "Exists"; else echo "Not Found"; fi

Solution

1. Step 1: Understand how to check A record existence with dig

   Using dig example.com A +short returns IP addresses if A records exist; empty if none.

2. Step 2: Use grep to check output

   Using grep -q '.' checks if output has any character (non-empty). If yes, print "Exists", else "Not Found".

3. Step 3: Evaluate options

   if dig example.com A +short | grep -q '.'; then echo "Exists"; else echo "Not Found"; fi correctly uses this logic. if dig example.com A | grep -q 'NXDOMAIN'; then echo "Exists"; else echo "Not Found"; fi checks for NXDOMAIN incorrectly. if nslookup example.com | grep -q 'Address'; then echo "Exists"; else echo "Not Found"; fi uses nslookup, not dig. if dig example.com MX +short | grep -q '.'; then echo "Exists"; else echo "Not Found"; fi checks MX records, not A.

4. Final Answer:

   if dig example.com A +short | grep -q '.'; then echo "Exists"; else echo "Not Found"; fi -> Option A

5. Quick Check:

   dig +short output empty means no record [OK]

Hint: Use dig +short and grep for quick record check [OK]

Common Mistakes:

• Checking wrong record type (MX instead of A)
• Misinterpreting NXDOMAIN in grep
• Using nslookup output with dig logic