Post cover image
Photo by Niels Baars on Unsplash

July 31, 2026

Mastering the Dig Tool: A Beginner-Friendly Guide to DNS Lookup and Reconnaissance

Learn how security professionals use the Dig tool to understand DNS, perform reconnaissance, and gather valuable information before a…

By Yamini Yadav_369

7 min read

Learn how security professionals use the Dig tool to understand DNS, perform reconnaissance, and gather valuable information before a penetration test begins.

Every penetration tester has that one moment when they realize that a simple command can reveal much more than expected. Mine happened during a web application security assessment.

The target looked secure from the outside. The website was protected by a firewall, most common ports were closed, and there were no obvious vulnerabilities. It seemed like there was very little information available.

Instead of jumping into scanning tools, I started with something much simpler. I opened my terminal and typed a single command.

dig example.com

The output looked ordinary at first. It showed the domain's IP address, name servers, and some DNS information. But after checking a few more DNS records, I noticed that the company was using a different mail server hosted on another provider. That led me to discover additional subdomains, development servers, and cloud services that were not linked from the main website.

None

None of this was a vulnerability by itself. However, it helped me understand the organization's infrastructure before testing even began. That experience taught me an important lesson.

Good penetration testing always starts with good reconnaissance.

One of the easiest and most powerful tools for DNS reconnaissance is the Dig tool.

Whether you are a beginner learning networking, a student preparing for cybersecurity interviews, a bug bounty hunter, or an experienced penetration tester, Dig is a tool you should know.

In this guide, I will explain everything in simple English. By the end of this article, you will understand what Dig is, how DNS works, and how to use Dig effectively during security assessments.

What Is the Dig Tool

Dig stands for Domain Information Groper.

It is a command-line utility used to query the Domain Name System, also known as DNS.

Whenever you visit a website like google.com, your computer first needs to know the server's IP address. DNS provides that information.

The Dig tool allows you to ask DNS servers questions directly.

For example, you can ask questions like:

  • What is the IP address of this website?
  • Which mail server handles emails for this domain?
  • Which name servers manage this domain?
  • Does this domain support DNSSEC?
  • Which DNS provider is being used?

Instead of guessing, Dig gives accurate answers directly from DNS servers.

This makes it one of the most trusted tools for network administrators, system engineers, penetration testers, and bug bounty hunters.

Why Every Penetration Tester Should Learn Dig

Many beginners focus only on vulnerability scanners.

While scanners are useful, they work much better when you already understand your target.

Think of penetration testing like solving a puzzle.

Before trying to find weaknesses, you first need to understand the environment.

The Dig tool helps answer questions such as:

  • Where is the website hosted?
  • Which cloud provider is being used?
  • Are there separate mail servers?
  • Which DNS provider manages the domain?
  • Is DNSSEC enabled?
  • Are multiple IP addresses configured?

All of this information helps build a clearer picture of the target infrastructure.

The better your reconnaissance, the better your testing.

Why DNS Matters During Reconnaissance

Imagine trying to visit a friend's house without knowing the address.

That would be difficult.

Computers face the same problem.

They understand IP addresses, not domain names.

DNS works like the internet's phone book.

When someone enters

example.com

the computer asks DNS,

"What is the IP address for this website?"

DNS responds with something like

93.184.216.34

Now the browser knows where to connect.

During reconnaissance, security professionals ask many more questions than just the IP address.

They also want to know

  • Which email servers exist
  • Which DNS servers are responsible
  • Whether cloud infrastructure is being used
  • If backup services exist
  • Whether DNS records reveal internal information

All of this starts with DNS.

Understanding DNS in Simple Language

Let's use a real-life example.

Imagine you want to visit a restaurant.

You know the restaurant's name.

You don't know its address.

So you search for it on Google Maps.

Google Maps finds the address and tells you where to go.

DNS works exactly the same way.

Instead of finding restaurants, it finds servers.

The browser asks DNS,

"Where is amazon.com located?"

DNS replies,

"Here is the IP address."

The browser then connects to that IP address.

Without DNS, every website would need to be visited using long numbers instead of easy names.

Instead of typing

google.com
you would need to remember something like
142.250.183.14
That would be impossible for most people.

DNS solves this problem.

How DNS Works

Let's understand the DNS lookup process step by step.

Suppose you type

www.example.com
into your browser.

Step 1

Your browser checks whether it already knows the IP address.

If yes, it uses the cached result.

If not, it asks a DNS resolver.

Step 2

The DNS resolver contacts the Root DNS Server.

The root server doesn't know the answer directly.

Instead, it tells the resolver where to find information for the ".com" domain.

Step 3

The resolver contacts the Top Level Domain server.

This server knows which name servers manage example.com.

Step 4

The resolver contacts the authoritative DNS server.

This server stores the actual DNS records.

It responds with the website's IP address.

Step 5

The resolver sends the answer back to your browser.

Your browser now knows exactly where the website is located.

The webpage opens in just a fraction of a second.

Although this entire process sounds long, it usually happens in milliseconds.

Installing the Dig Tool

The good news is that Dig is free.

It comes pre-installed on many Linux distributions.

If it is missing, installation only takes a few seconds.

Kali Linux

sudo apt update
sudo apt install dnsutils
Verify installation.
dig -v

Ubuntu

sudo apt update
sudo apt install dnsutils

Verify installation.

dig -v

Debian

sudo apt update
sudo apt install dnsutils

Verify installation.

dig -v

macOS

If you are using macOS, Dig is usually already installed.

Check by running

dig -v

If it is missing, install the BIND package using Homebrew.

brew install bind

Windows

Dig is not included with Windows by default.

The easiest way is to install BIND Tools or use the Windows Subsystem for Linux (WSL).

After installation, open Command Prompt or PowerShell and run

dig -v

If the version number appears, the installation is successful.

Why Verify the Installation

Many beginners skip this step.

Always confirm that Dig is installed correctly before starting a security assessment.

Run

dig -v
You should see output similar to this.
DiG 9.18.39

If you see the version number, everything is ready.

If you receive a "command not found" message, the installation is incomplete or the executable is not in your system's PATH.

Understanding the Basic Dig Command

Now that you have installed Dig, it's time to use it.

The simplest Dig command is:

dig example.com

Replace example.com with the domain you want to query.

For example:

dig google.com

Within a second, Dig returns detailed DNS information.

At first glance, the output may look confusing because it contains several sections. Don't worry. Once you understand each part, reading Dig output becomes easy.

A typical output looks something like this:

; <<>> DiG 9.18.39 <<>> google.com
;; QUESTION SECTION:
;google.com. IN      A
;; ANSWER SECTION:
google.com. 300  IN  A   142.250.183.14
;; Query time: 18 msec
;; SERVER: 8.8.8.8#53
;; WHEN: Tue Jul 22 15:10:24 IST 2026
;; MSG SIZE  rcvd: 55

Let's understand each section.

QUESTION SECTION

This shows what you asked.

In this example, Dig is asking:

"What is the A record (IPv4 address) for google.com?"

ANSWER SECTION

This is the most important part.

google.com.   300   IN   A   142.250.183.14

Each field has a meaning.

FieldMeaninggoogle.comDomain Name300TTL (Time To Live)INInternet classARecord Type142.250.183.14IPv4 Address

The answer tells us the IP address of the website.

Query Time

Query time: 18 msec

This tells you how long the DNS server took to answer.

Smaller values usually mean faster DNS responses.

Server

SERVER: 8.8.8.8#53

This tells you which DNS server answered your request.

In this example, Google's public DNS server answered.

Message Size

This simply tells you how much data was received.

For beginners, this field is usually not important.

Understanding Dig Syntax

The general syntax is very simple.

dig [server] [domain] [record type] [options]

Examples

dig google.com
dig google.com MX
dig @8.8.8.8 google.com
dig google.com TXT

Once you understand this structure, almost every Dig command becomes easy.

20 Useful Dig Commands Every Beginner Should Know

1. Basic DNS Lookup

Command

dig example.com

Purpose

Retrieves the default A record.

When to use

When you want to know the website's IP address.

Expected Output

IPv4 address of the domain.

2. Find the IPv4 Address

Command

dig example.com A

Purpose

Returns only the A record.

When to use

Finding the IPv4 address of a website.

Expected Output

93.184.216.34

3. Find the IPv6 Address

Command

dig example.com AAAA

Purpose

Checks whether IPv6 is enabled.

When to use

During infrastructure discovery.

Expected Output

IPv6 address if available.

4. Find Mail Servers

Command

dig example.com MX

Purpose

Lists mail servers.

When to use

Email security assessments.

Expected Output

10 mail.example.com

5. Find TXT Records

Command

dig example.com TXT

Purpose

Displays TXT records.

When to use

Checking SPF, verification tokens, or ownership records.

Expected Output

v=spf1 include:_spf.google.com

6. Find Name Servers

Command

dig example.com NS

Purpose

Shows authoritative name servers.

When to use

DNS reconnaissance.

Expected Output

ns1.example.com
ns2.example.com

7. Find SOA Record

Command

dig example.com SOA

Purpose

Displays the Start of Authority record.

When to use

Understanding DNS configuration.

Expected Output

Primary DNS server and administrator email.

8. Find CNAME Record

Command

dig www.example.com CNAME

Purpose

Checks whether a hostname points to another hostname.

When to use

Finding CDN providers or aliases.

9. Reverse DNS Lookup

Command

dig -x 8.8.8.8

Purpose

Finds the hostname from an IP address.

When to use

Infrastructure analysis.

Expected Output

dns.google

10. Find CAA Record

Command

dig example.com CAA
Purpose

Shows which Certificate Authorities can issue SSL certificates.

When to use

SSL security review.

11. Find SRV Record

Command

dig example.com SRV
Purpose

Finds service records.

When to use

Checking SIP, LDAP, or Active Directory services.

12. Find DNSKEY Record

Command

dig example.com DNSKEY

Purpose

Checks DNSSEC public keys.

When to use

DNSSEC verification.

13. Short Output

Sometimes you only want the answer.

Command

dig +short example.com
Purpose

Displays only the result.

Expected Output

93.184.216.34

This is one of the most frequently used options.

14. Trace DNS Resolution

Command

dig +trace example.com

Purpose

Shows the complete DNS lookup process.

When to use

Learning how DNS works.

Troubleshooting DNS issues.

15. Use Google's DNS Server

Command

dig @8.8.8.8 example.com

Purpose

Queries Google's DNS server directly.

When to use

Comparing DNS responses.

16. Use Cloudflare DNS

Command

dig @1.1.1.1 example.com

Purpose

Uses Cloudflare's DNS.

Useful for comparing propagation results.

17. Show Query Statistics

Command

dig +stats example.com

Purpose

Displays performance statistics.

Useful during troubleshooting.

18. Force TCP Instead of UDP

Command

dig +tcp example.com

Purpose

Sends DNS queries over TCP.

When to use

Testing firewall behavior or troubleshooting DNS responses.

19. Check DNSSEC

Command

dig +dnssec example.com

Purpose

Requests DNSSEC information.

When to use

Checking whether DNSSEC is configured correctly.

20. Query a Specific Record Using a Custom DNS Server

Command

dig @8.8.8.8 example.com MX

Purpose

Checks mail records using Google's DNS.

When to use

Verifying DNS propagation or comparing different DNS providers.

A Quick Tip That Saves Time

If you're working on a penetration test, you'll probably use +short more than any other option.

Instead of seeing a full page of information:

dig example.com
Use:
dig +short example.com

You'll immediately get:

93.184.216.34

This makes scripting and automation much easier.

Real World Example

Imagine you're testing a company's website.

You begin with:

dig company.com MX

The output shows:

company-com.mail.protection.outlook.com

Now you know the organization uses Microsoft 365 for email.

Next, you run:

dig company.com NS

The output reveals that the domain is managed by Cloudflare.

Then you check:

dig company.com TXT

You discover SPF records and email verification records for Google Workspace.