dig
CLI DNS lookup utility for authoritative and recursive inspection of mail-related records.
- Reading time:
- 5 min
- Difficulty:
- Intermediate
- Estimated duration:
- 5 min
- Prerequisites:
- None
- Last updated:
- 2026-07-15
- Author:
- empire
Overview
CLI DNS lookup utility for authoritative and recursive inspection of mail-related records.
Vendor: ISC / system utility
Primary purpose
Query DNS directly so you can verify SPF, DKIM, DMARC, MX, and PTR publications.
Best for
- Operators confirming what authoritative DNS actually serves
- Debugging propagation and record syntax issues
Common use cases
- Confirm SPF TXT at the organizational domain
- Check DKIM selector TXT before enabling signing
- Compare authoritative vs recursive answers after a change
Advantages
- Precise, scriptable, and available on most operator workstations
- No third-party trust boundary for the query itself
Limitations
- Does not interpret DMARC policy for you
- Easy to query the wrong resolver and misread cache
When not to use it
- You need a guided UI explanation of authentication results
- You are uncomfortable with a terminal
Pricing
Free with your OS or BIND tools package.
Official website
Inputs and outputs
Typical inputs
- Domain name
- Record type
- Optional @nameserver
Typical outputs
- Raw DNS answers
- Status codes
Privacy notes
- Review each vendor’s data handling before uploading production lists or message content.
Related Learn Articles
Related Solve Articles
- CNAME at zone apexA CNAME is placed at the zone apex where other record types are also required.
- HELO / EHLO problemsThe SMTP HELO/EHLO hostname is missing, invalid, or inconsistent with reverse DNS.
- Inconsistent authoritative answersAuthoritative name servers for the same zone return conflicting data.
- Incorrect MX targetMX points to the wrong host name or unreachable mail server.
- Missing glue recordsDelegation references in-bailiwick name servers without required glue.
- MX record missingNo MX record is published for a domain that should receive mail.
- NXDOMAIN for expected nameA name that should exist returns NXDOMAIN from authoritative servers.
- Reverse DNS mismatchPTR (reverse DNS) for a sending IP is missing or does not match the forward hostname used in mail.
- Stale DNS cache after changeResolvers still serve prior answers after an authoritative change because TTL has not expired.
- Wrong TTL for cutoverTTL values are too high for a planned cutover, prolonging mixed old/new answers.
- Broken SPF includeAn included SPF domain is missing, invalid, or fails closed.
- Forwarded email fails SPFForwarding paths break SPF because the forwarder is not authorized.
- Incorrect IP authorizationSending infrastructure IPs are not authorized by SPF.
- Invalid SPF mechanismSPF record contains unsupported or malformed mechanisms.
- Multiple SPF recordsMore than one SPF TXT record exists, causing evaluation failure.
- SPF passes but DMARC failsSPF authenticates a domain that does not align for DMARC.
- SPF PermErrorSPF evaluation fails permanently due to policy or lookup errors.
- SPF record missingNo SPF TXT record is published for the sending domain.
- SPF TempErrorTemporary DNS or evaluation failure during SPF checks.
- Too many DNS lookupsSPF evaluation exceeds the ten-lookup limit.
Alternatives & related tools
- MXToolboxPopular DNS and mail diagnostics suite for SPF, DMARC, blacklist, and MX checks.
- nslookupInteractive DNS lookup utility commonly used for quick MX and TXT checks.
- Google Admin Toolbox DigBrowser-based dig-style DNS lookup from Google’s Admin Toolbox.
- Google Admin Toolbox CheckMXGoogle Admin Toolbox Check MX for inbound mail DNS sanity checks.
- Mail-TesterSend-a-message spam and authentication scoring for pre-send QA.
- Kitterman SPF validatorClassic web SPF policy evaluator used by operators for syntax checks.
Related Workflows
- Verify DNS recordsVerify zone authority, MX/address records, and authentication-related TXT publications.
- Configure SPFPublish and validate an SPF policy for authorized senders.
- Authenticate a new domainPublish SPF, DKIM, and DMARC for a new sending domain and verify authentication before warmup.
- Migrate authentication recordsMove SPF, DKIM, and DMARC to a new platform without dual-record failures.