nslookup and dig for DNS in Linux CLI - Cheat Sheet & Quick Revision

Recall & Review

beginner

What is the primary purpose of the nslookup command?

nslookup is used to query DNS servers to find the IP address associated with a domain name or vice versa.

intermediate

How does dig differ from nslookup in DNS queries?

dig provides more detailed and flexible DNS query information and is preferred for troubleshooting DNS issues, while nslookup is simpler and more basic.

beginner

What does the command nslookup google.com do?

It queries the default DNS server to find the IP address(es) for google.com.

intermediate

What is the purpose of the +short option in dig?

The +short option shows only the answer section of the DNS query, making the output concise and easy to read.

beginner

Which command would you use to find the mail servers (MX records) for a domain?

You can use either nslookup -query=mx domain.com or dig mx domain.com to find mail servers for a domain.

What does the dig command primarily do?

A Check disk usage

B Display network interface details

C Query DNS servers for domain information

D Monitor system processes

dig is used to query DNS servers to get information about domain names.

Which option with dig gives a brief output showing only the IP address?

A +short

B +trace

C +all

D +stats

The +short option shows only the answer section, making output brief.

How do you specify the DNS record type in nslookup?

A Using the <code>-type</code> or <code>-query</code> option

B Using the <code>-record</code> option

C Using the <code>-dns</code> option

D You cannot specify record type in nslookup

You specify record type with -type= or -query= in nslookup.

Which command would you use to find the authoritative name servers for a domain?

A nslookup domain.com

B nslookup -query=mx domain.com

C dig a domain.com

D dig ns domain.com

dig ns domain.com queries for name server (NS) records, showing authoritative servers.

If nslookup returns 'server can't find domain.com: NXDOMAIN', what does it mean?

A The DNS server is down

B The domain does not exist

C The IP address is blocked

D The query timed out

NXDOMAIN means the domain name does not exist in DNS.

Explain how you would use nslookup and dig to troubleshoot a website that is not loading.

Think about checking if the domain name resolves and what DNS info you can get.

Describe the difference in output detail between nslookup and dig.

Consider which tool is better for quick checks vs deep troubleshooting.

Practice

1. What is the primary purpose of the nslookup command in Linux?

easy

A. To monitor network traffic

B. To edit DNS server settings

C. To find the IP address of a domain name quickly

D. To create new domain names

Solution

1. Step 1: Understand nslookup's function

   The nslookup command is used to query DNS to find IP addresses or domain names.

2. Step 2: Identify the main use case

   Its main use is to quickly find the IP address of a given domain name.

3. Final Answer:

   To find the IP address of a domain name quickly -> Option C

4. Quick Check:

   nslookup = quick IP lookup [OK]

Hint: nslookup quickly shows IP for a domain [OK]

Common Mistakes:

• Thinking nslookup edits DNS settings
• Confusing nslookup with network monitoring tools
• Assuming nslookup creates domains

2. Which of the following is the correct syntax to use dig to query the A record of example.com?

easy

A. dig -A example.com

B. dig example.com -t A

C. dig example.com A

D. dig -query=A example.com

Solution

1. Step 1: Recall dig syntax for record type

   The correct syntax uses the -t option to specify the record type, e.g., dig example.com -t A.

2. Step 2: Match syntax to options

   dig example.com -t A matches this syntax.

3. Final Answer:

   dig example.com -t A -> Option B

4. Quick Check:

   dig -t TYPE domain = query record [OK]

Hint: Use -t to specify record type: dig example.com -t A [OK]

Common Mistakes:

• Placing record type without -t option
• Using invalid -A flag
• Using nonexistent -query flag

3. What will be the output of the command nslookup google.com if the DNS server is reachable and working?

medium

A. The IP address(es) of google.com along with DNS server info

B. A list of all DNS servers on the internet

C. A blank output with no information

D. An error message saying 'server can't find google.com'

Solution

1. Step 1: Understand nslookup output on success

   If the DNS server is reachable, nslookup returns the IP address(es) of the domain and info about the DNS server used.

2. Step 2: Eliminate incorrect options

   An error message saying 'server can't find google.com' is an error message, which won't appear if DNS works. A blank output with no information is blank output, unlikely. A list of all DNS servers on the internet is unrelated.

3. Final Answer:

   The IP address(es) of google.com along with DNS server info -> Option A

4. Quick Check:

   nslookup success = IP + server info [OK]

Hint: Successful nslookup shows IP and server info [OK]

Common Mistakes:

• Expecting nslookup to list all DNS servers
• Thinking nslookup outputs blank on success
• Confusing error messages with normal output

4. You run dig example.com MX but get no answer section in the output. What is the most likely reason?

medium

A. The dig command syntax is incorrect

B. The DNS server is blocking all queries

C. Your internet connection is down

D. The domain example.com has no MX records configured

Solution

1. Step 1: Analyze dig output with no answer section

   If dig shows no answer section for MX query, it usually means no MX records exist for that domain.

2. Step 2: Check other options

   The syntax is correct, eliminating A. Internet down would cause timeout or no response. DNS blocking would cause errors like REFUSED, not empty answer.

3. Final Answer:

   The domain example.com has no MX records configured -> Option D

4. Quick Check:

   No MX answer = no MX records [OK]

Hint: No answer section means no such DNS record exists [OK]

Common Mistakes:

• Assuming syntax error when command is correct
• Blaming internet connection without checking
• Thinking DNS server blocks cause empty answers

5. You want to write a script that uses dig to check if a domain has an A record and print "Exists" or "Not Found" accordingly. Which command snippet correctly checks this?

hard

A. if dig example.com A +short | grep -q '.'; then echo "Exists"; else echo "Not Found"; fi

B. if dig example.com A | grep -q 'NXDOMAIN'; then echo "Exists"; else echo "Not Found"; fi

C. if nslookup example.com | grep -q 'Address'; then echo "Exists"; else echo "Not Found"; fi

D. if dig example.com MX +short | grep -q '.'; then echo "Exists"; else echo "Not Found"; fi

Solution

1. Step 1: Understand how to check A record existence with dig

   Using dig example.com A +short returns IP addresses if A records exist; empty if none.

2. Step 2: Use grep to check output

   Using grep -q '.' checks if output has any character (non-empty). If yes, print "Exists", else "Not Found".

3. Step 3: Evaluate options

   if dig example.com A +short | grep -q '.'; then echo "Exists"; else echo "Not Found"; fi correctly uses this logic. if dig example.com A | grep -q 'NXDOMAIN'; then echo "Exists"; else echo "Not Found"; fi checks for NXDOMAIN incorrectly. if nslookup example.com | grep -q 'Address'; then echo "Exists"; else echo "Not Found"; fi uses nslookup, not dig. if dig example.com MX +short | grep -q '.'; then echo "Exists"; else echo "Not Found"; fi checks MX records, not A.

4. Final Answer:

   if dig example.com A +short | grep -q '.'; then echo "Exists"; else echo "Not Found"; fi -> Option A

5. Quick Check:

   dig +short output empty means no record [OK]

Hint: Use dig +short and grep for quick record check [OK]

Common Mistakes:

• Checking wrong record type (MX instead of A)
• Misinterpreting NXDOMAIN in grep
• Using nslookup output with dig logic