008/Networking

Check where a domain name actually points

2026.08.25·003 min·macOS · Debian · Alpine · Shell

$ dig +short example.com

anatomy

dig

Domain Information Groper. Queries DNS servers directly and prints the raw answer, bypassing local caches like /etc/hosts and nscd.

+short

Suppress the header, footer, and authority sections. Print only the answer, one record per line.

example.com

The domain to look up. Defaults to an A record query. Add AAAA, MX, TXT, or any other record type after the domain to change what you ask for.

Sample output

93.184.215.14

One line, one IP. That is where example.com resolves right now, according to your default nameserver. If you expected a different address, or no address at all, you have found the problem.

When you would reach for it

You changed a DNS record and want to know whether the change has propagated. A deploy failed because the app cannot reach an internal service by hostname. A colleague says “the site is down” and you need to separate a DNS problem from a server problem in under five seconds.

Gotchas

dig queries your system’s default resolver (usually whatever is in /etc/resolv.conf). That resolver may have a cached answer. To bypass it, query an authoritative server directly: dig +short example.com @8.8.8.8.
A CNAME answer returns the alias, not the IP. Run dig +short again on the returned hostname, or use dig +trace to follow the full chain from root servers.
On Alpine and minimal Docker images, dig is not installed by default. Install it with apk add bind-tools, or use nslookup which ships with busybox.

Variants

$ dig +short example.com MX

Query mail exchange records instead of A records

$ dig +short example.com @1.1.1.1

Ask Cloudflare’s resolver instead of your default, useful for checking propagation

$ dig example.com +trace

Follow the delegation chain from root servers to authoritative nameserver, showing every hop. Useful when you suspect a caching layer is returning a stale record

lineage

dig was written by Steve Hotz and is part of BIND (Berkeley Internet Name Domain), the DNS server implementation that has been the reference standard since the mid-1980s. BIND itself traces back to a group of graduate students at UC Berkeley, funded by DARPA, who built the first widely deployed DNS software for 4.3BSD in 1984. dig shipped as a diagnostic companion to the server, a way for administrators to query DNS the same way the resolver did internally. It replaced the older nslookup, which the Internet Systems Consortium eventually deprecated in BIND 9 before reversing course and keeping both. Today dig ships by default on macOS and most Linux distributions, though Alpine and minimal container images leave it out to save space.

> dns is the first thing to break and the last thing anyone checks_