nslookup and dig for DNS in Linux CLI - Step-by-Step Execution

Concept Flow - nslookup and dig for DNS

Start Command

↓

Send DNS Query

↓

Receive DNS Response

↓

Parse Response

↓

Display Results

↓

End

The command sends a DNS query, waits for the response, parses it, and then shows the results.

Execution Sample

Linux CLI

nslookup example.com

dig example.com

These commands ask DNS servers for information about example.com and show the answers.

Execution Table

Step	Command	Action	Output Example	Notes
1	nslookup example.com	Send DNS query for example.com	Server: 8.8.8.8 Address: 8.8.8.8 Non-authoritative answer: Name: example.com Address: 93.184.216.34	nslookup sends query and shows IP address
2	dig example.com	Send DNS query for example.com	; <<>> DiG 9.16.1-Ubuntu <<>> example.com ;; global options: +cmd ;; Got answer: ;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 12345 ;; ANSWER SECTION: example.com. 86400 IN A 93.184.216.34 ;; Query time: 30 msec ;; SERVER: 8.8.8.8#53(8.8.8.8) ;; WHEN: Thu Jun 01 12:00:00 UTC 2023 ;; MSG SIZE rcvd: 56	dig shows detailed DNS response including header and answer
3	nslookup invalid.domain	Send DNS query for invalid.domain	Server: 8.8.8.8 Address: 8.8.8.8 ** server can't find invalid.domain: NXDOMAIN	Shows error when domain not found
4	dig invalid.domain	Send DNS query for invalid.domain	; <<>> DiG 9.16.1-Ubuntu <<>> invalid.domain ;; global options: +cmd ;; Got answer: ;; ->>HEADER<<- opcode: QUERY, status: NXDOMAIN, id: 54321 ;; Query time: 20 msec ;; SERVER: 8.8.8.8#53(8.8.8.8) ;; WHEN: Thu Jun 01 12:01:00 UTC 2023 ;; MSG SIZE rcvd: 45	dig shows NXDOMAIN status for not found domain
5	End	No more queries	Command prompt returns	Execution ends

💡 Commands finish after receiving and displaying DNS responses or errors.

Variable Tracker

Variable	Start	After nslookup example.com	After dig example.com	After nslookup invalid.domain	After dig invalid.domain	Final
DNS Query	None	example.com	example.com	invalid.domain	invalid.domain	None
DNS Response Status	None	NOERROR	NOERROR	NXDOMAIN	NXDOMAIN	None
IP Address	None	93.184.216.34	93.184.216.34	None	None	None

Key Moments - 3 Insights

Why does nslookup show 'Non-authoritative answer'?

Because the DNS server is not the original source for the domain info but has cached it. See execution_table row 1.

What does NXDOMAIN mean in the output?

It means the domain does not exist. Both nslookup and dig show this in rows 3 and 4.

Why does dig output more details than nslookup?

dig shows the full DNS response including headers and timing, while nslookup shows a simpler summary. See rows 1 and 2.

Visual Quiz - 3 Questions

Look at the execution table, what is the IP address returned by nslookup for example.com?

A 93.184.216.34

B 8.8.8.8

C NXDOMAIN

D No IP address

💡 Hint

Check execution_table row 1 under Output Example for nslookup example.com

At which step does the DNS query return a 'NXDOMAIN' status?

A Step 1

B Step 2

C Step 3

D Step 5

💡 Hint

Look at execution_table rows 3 and 4 for NXDOMAIN status

If you change the domain to a valid one, how would the 'DNS Response Status' change in variable_tracker?

A It would stay NXDOMAIN

B It would change to NOERROR

C It would become UNKNOWN

D It would be empty

💡 Hint

See variable_tracker row for DNS Response Status after valid domain queries

Concept Snapshot

nslookup and dig send DNS queries to get domain info.
nslookup shows simple answers; dig shows detailed info.
Both report errors like NXDOMAIN if domain not found.
Use these commands to check domain IPs and DNS records.
nslookup is simpler; dig is more detailed and flexible.

Full Transcript

This lesson shows how nslookup and dig commands work to query DNS servers. When you run nslookup example.com, it sends a DNS query and shows the IP address if found, or an error if not. dig example.com does the same but shows more details like headers and query time. If the domain does not exist, both commands show NXDOMAIN status. The execution table traces each command step by step, showing the query sent, the response received, and the output displayed. The variable tracker follows key values like the domain queried, response status, and IP address found. Key moments clarify common confusions such as the meaning of 'Non-authoritative answer' and NXDOMAIN. The visual quiz tests understanding by asking about IP addresses returned, when NXDOMAIN appears, and how response status changes with different domains. The quick snapshot summarizes the commands and their behavior simply. This helps beginners see exactly how DNS queries work in practice.

Practice

1. What is the primary purpose of the nslookup command in Linux?

easy

A. To monitor network traffic

B. To edit DNS server settings

C. To find the IP address of a domain name quickly

D. To create new domain names

Solution

1. Step 1: Understand nslookup's function

   The nslookup command is used to query DNS to find IP addresses or domain names.

2. Step 2: Identify the main use case

   Its main use is to quickly find the IP address of a given domain name.

3. Final Answer:

   To find the IP address of a domain name quickly -> Option C

4. Quick Check:

   nslookup = quick IP lookup [OK]

Hint: nslookup quickly shows IP for a domain [OK]

Common Mistakes:

• Thinking nslookup edits DNS settings
• Confusing nslookup with network monitoring tools
• Assuming nslookup creates domains

2. Which of the following is the correct syntax to use dig to query the A record of example.com?

easy

A. dig -A example.com

B. dig example.com -t A

C. dig example.com A

D. dig -query=A example.com

Solution

1. Step 1: Recall dig syntax for record type

   The correct syntax uses the -t option to specify the record type, e.g., dig example.com -t A.

2. Step 2: Match syntax to options

   dig example.com -t A matches this syntax.

3. Final Answer:

   dig example.com -t A -> Option B

4. Quick Check:

   dig -t TYPE domain = query record [OK]

Hint: Use -t to specify record type: dig example.com -t A [OK]

Common Mistakes:

• Placing record type without -t option
• Using invalid -A flag
• Using nonexistent -query flag

3. What will be the output of the command nslookup google.com if the DNS server is reachable and working?

medium

A. The IP address(es) of google.com along with DNS server info

B. A list of all DNS servers on the internet

C. A blank output with no information

D. An error message saying 'server can't find google.com'

Solution

1. Step 1: Understand nslookup output on success

   If the DNS server is reachable, nslookup returns the IP address(es) of the domain and info about the DNS server used.

2. Step 2: Eliminate incorrect options

   An error message saying 'server can't find google.com' is an error message, which won't appear if DNS works. A blank output with no information is blank output, unlikely. A list of all DNS servers on the internet is unrelated.

3. Final Answer:

   The IP address(es) of google.com along with DNS server info -> Option A

4. Quick Check:

   nslookup success = IP + server info [OK]

Hint: Successful nslookup shows IP and server info [OK]

Common Mistakes:

• Expecting nslookup to list all DNS servers
• Thinking nslookup outputs blank on success
• Confusing error messages with normal output

4. You run dig example.com MX but get no answer section in the output. What is the most likely reason?

medium

A. The dig command syntax is incorrect

B. The DNS server is blocking all queries

C. Your internet connection is down

D. The domain example.com has no MX records configured

Solution

1. Step 1: Analyze dig output with no answer section

   If dig shows no answer section for MX query, it usually means no MX records exist for that domain.

2. Step 2: Check other options

   The syntax is correct, eliminating A. Internet down would cause timeout or no response. DNS blocking would cause errors like REFUSED, not empty answer.

3. Final Answer:

   The domain example.com has no MX records configured -> Option D

4. Quick Check:

   No MX answer = no MX records [OK]

Hint: No answer section means no such DNS record exists [OK]

Common Mistakes:

• Assuming syntax error when command is correct
• Blaming internet connection without checking
• Thinking DNS server blocks cause empty answers

5. You want to write a script that uses dig to check if a domain has an A record and print "Exists" or "Not Found" accordingly. Which command snippet correctly checks this?

hard

A. if dig example.com A +short | grep -q '.'; then echo "Exists"; else echo "Not Found"; fi

B. if dig example.com A | grep -q 'NXDOMAIN'; then echo "Exists"; else echo "Not Found"; fi

C. if nslookup example.com | grep -q 'Address'; then echo "Exists"; else echo "Not Found"; fi

D. if dig example.com MX +short | grep -q '.'; then echo "Exists"; else echo "Not Found"; fi

Solution

1. Step 1: Understand how to check A record existence with dig

   Using dig example.com A +short returns IP addresses if A records exist; empty if none.

2. Step 2: Use grep to check output

   Using grep -q '.' checks if output has any character (non-empty). If yes, print "Exists", else "Not Found".

3. Step 3: Evaluate options

   if dig example.com A +short | grep -q '.'; then echo "Exists"; else echo "Not Found"; fi correctly uses this logic. if dig example.com A | grep -q 'NXDOMAIN'; then echo "Exists"; else echo "Not Found"; fi checks for NXDOMAIN incorrectly. if nslookup example.com | grep -q 'Address'; then echo "Exists"; else echo "Not Found"; fi uses nslookup, not dig. if dig example.com MX +short | grep -q '.'; then echo "Exists"; else echo "Not Found"; fi checks MX records, not A.

4. Final Answer:

   if dig example.com A +short | grep -q '.'; then echo "Exists"; else echo "Not Found"; fi -> Option A

5. Quick Check:

   dig +short output empty means no record [OK]

Hint: Use dig +short and grep for quick record check [OK]

Common Mistakes:

• Checking wrong record type (MX instead of A)
• Misinterpreting NXDOMAIN in grep
• Using nslookup output with dig logic