R-DIG
dig
Query DNS records directly — A, AAAA, MX, NS, TXT, and the rest — from BIND’s CLI.
OVERVIEW
dig ships with BIND (isc.org/bind) and is the usual CLI for asking a DNS server a specific question: one name, one type, one resolver. Unlike a browser or a stub resolver, it prints the raw answer section, the flags, and which server replied, so you can see a CNAME chain, a leftover SPF/DMARC TXT, or an NS set that points at forgotten infrastructure.
`+noall +answer` keeps the output to the records themselves, which is what you want to paste into notes or feed the next tool. Point `@` at a public resolver or at the domain’s own NS when you need to see what the authoritative servers actually serve, not what a recursive cache has stored.
USE CASES
Practical use cases
- 01
Resolving A/AAAA for a domain before any port scan.
- 02
Pulling MX, NS, and TXT (SPF, DMARC, verification tokens) during OSINT.
- 03
Asking the authoritative NS directly to bypass a poisoned or stale cache.
- 04
Checking a single name against several resolvers when answers disagree.
QUICK START
When scope is a domain name and you need the actual DNS answers — IPs, mail exchangers, nameservers, TXT — before scanning anything.
- Confirm the domain is in the authorized OSINT/recon scope.
- Query A and AAAA first, then MX, NS, and TXT.
- Repeat against the domain’s own nameserver with @ns if the recursive answer looks incomplete.
- Save the record set as the seed host list for later scanning.
dig +noall +answer target.example ABEFORE YOU RUN IT
What to check before running it
ANY is deprecated and often ignored; ask for the types you need instead of hoping for a dump.
AXFR against a nameserver you do not own is usually refused and is only in scope when the client’s DNS is explicitly authorized to zone-transfer.
DNS queries still leave a trail at the resolver; using the client’s internal resolver can mix your recon with production lookup logs.