dig and host Commands in Linux: DNS Lookup Syntax, Options & Examples

When you only need addresses — for scripts or a fast "does this name resolve?" test — +short strips the banner and question section.

Run the command:

dig example.com +short

Sample output:

104.20.23.154
172.66.147.243

Multiple lines mean multiple A records (load balancing or CDN). Empty output with exit code 0 can mean no A records — try +trace or another type.

host formats the same data in plain sentences — easier to read in terminal scrollback than dig's default multi-section dump.

Run the command:

host example.com 8.8.8.8

Sample output:

Using domain server:
Name: 8.8.8.8
Address: 8.8.8.8#53
Aliases: 

example.com has address 172.66.147.243
example.com has address 104.20.23.154
example.com mail is handled by 0 .
example.com has HTTP service bindings 1 . alpn="h2" ipv4hint=104.20.23.154,172.66.147.243 ipv6hint=2606:4700:10::6814:179a,2606:4700:10::ac42:93f3

The trailing mail is handled by line is the MX answer (example.com publishes a null MX). Modern BIND also prints HTTPS/SVCB bindings when present.

Mail routing and delegation debugging need types beyond A. dig uses the type name after the domain; host uses -t.

Run the commands:

dig example.com MX +short
host -t NS example.com 8.8.8.8

Sample output:

0 .
example.com name server hera.ns.cloudflare.com.
example.com name server elliott.ns.cloudflare.com.

MX answers show priority and target host. NS answers list authoritative name servers for the zone — compare with your registrar if delegation is broken.

Reverse lookups query in-addr.arpa (IPv4) or ip6.arpa (IPv6). dig -x accepts dotted-quad notation; host accepts the IP directly.

Run the commands:

dig -x 8.8.8.8 @1.1.1.1 +short
host 8.8.8.8 1.1.1.1

Sample output:

dns.google.
Using domain server:
Name: 1.1.1.1
Address: 1.1.1.1#53
Aliases: 

8.8.8.8.in-addr.arpa domain name pointer dns.google.

PTR records are optional — many IPs have no reverse name. Mail servers often require matching forward and reverse DNS.

Hide everything except the answer section — a middle ground between verbose dig and bare +short.

Run the command:

dig @8.8.8.8 example.com +noall +answer

Sample output:

example.com.		258	IN	A	104.20.23.154
example.com.		258	IN	A	172.66.147.243

Columns are owner name, TTL, class, type, and rdata. TTL counts down so you can see caching behaviour during cutovers.

TXT holds SPF policies, DKIM public keys, and vendor verification strings. Quotes in output are normal.

Run the command:

dig example.com TXT +short

Sample output:

"v=spf1 -all"
"_k2n1y4vw3qtb4skdx9e7dxt97qrmmq9"

Parse carefully in scripts — TXT strings may contain spaces and multiple chunks per name.

A negative answer means the name is not in the DNS tree (typo, expired domain, or wrong zone). Both tools report it clearly.

Run the commands:

dig @8.8.8.8 nonexistent.invalid +time=1 +tries=1 +short
host -W 1 nonexistent.invalid 8.8.8.8

Sample output:

Host nonexistent.invalid not found: 3(NXDOMAIN)

dig shows status: NXDOMAIN in the header when run without +short. Distinguish NXDOMAIN (name missing) from timeout (network or resolver unreachable).

+trace starts at the root servers and follows NS delegations until it reaches the authoritative zone — invaluable when a subdomain works in one region but not another.

Run the command:

dig @8.8.8.8 example.com +trace 2>&1 | head -20

Sample output (truncated):

; <<>> DiG 9.20.11-0ubuntu0.2-Ubuntu <<>> @8.8.8.8 example.com +trace
; (1 server found)
;; global options: +cmd
.			87203	IN	NS	b.root-servers.net.
.			87203	IN	NS	h.root-servers.net.
...
;; Received 525 bytes from 8.8.8.8#53(8.8.8.8) in 38 ms

Each hop shows which server answered and which NS records were returned. Compare the final authority section with the NS you expect at the registrar.

When lookups hang, cap wait time and retries so scripts fail fast. Specify the resolver explicitly to test whether the problem is local cache or upstream.

Run the command:

host -W 2 example.com 8.8.8.8

Sample output (success):

Using domain server:
Name: 8.8.8.8
Address: 8.8.8.8#53
Aliases: 

example.com has address 172.66.147.243
example.com has address 104.20.23.154

If you see no servers could be reached, check firewall rules for UDP/TCP port 53, VPN split DNS, and whether systemd-resolved is forwarding correctly (resolvectl status).