dig

dig (Domain Information Groper) is the standard flexible DNS query tool on Linux/Unix, shipped as part of ISC’s BIND. Unlike nslookup (universal but limited), dig gives precise control over query flags, transport, and output formatting, making it the preferred DNS tool for scripting and reconnaissance. It is not installed by default on Windows.

Syntax

Only the name is required; server and record type are optional:

dig [@$NAME_SERVER] $DOMAIN [$QUERY_TYPE] [options]
 
# Examples
dig @8.8.8.8 microsoft.com A      # query a specific resolver
dig @1.1.1.1 tryhackme.com        # defaults to type A
dig google.com MX                 # mail exchangers
dig google.com ANY                # all records the server will volunteer
dig -x 8.8.8.8                    # reverse lookup (PTR)

Omitting @server uses the system’s configured resolver; specifying one tests that server directly — useful for confirming a nameserver answers authoritatively for a zone, or for bypassing a poisoned/filtered local resolver.

Zone transfer (AXFR)

If an authoritative nameserver is misconfigured to allow zone transfers to arbitrary clients, dig can pull the entire zone file — every host, subdomain, MX, TXT, and SRV record:

dig @$NAME_SERVER $DOMAIN AXFR

Most public servers refuse AXFR from strangers, but when it works it is a complete reconnaissance win: the full internal naming map in one query. Always attempt it against each of a target’s NS records (see also nslookup’s interactive ls -d, which attempts the same thing).

Recon notes

• TXT records frequently leak SPF policies, domain-verification tokens, and cloud service hints — enumerate them explicitly (dig $DOMAIN TXT).
• +short collapses output to just answer data (dig +short $DOMAIN A), ideal for scripting pipelines.
• +trace walks the delegation chain from the root down, revealing each authoritative hop — useful for spotting dangling/odd delegations.
• SOA and NS records identify the infrastructure provider and sometimes internal naming conventions worth feeding into subdomain wordlists (pair with cewl-custom-wordlist-generator-style enumeration).

Sources

• dig(1) — Linux man page
• ISC BIND 9

Related

• nslookup — the everywhere-available fallback (and the only option on stock Windows)
• nip-io — wildcard-DNS trick for instant hostnames pointing at arbitrary IPs
• windows-reconnaissance-commands — when dig isn’t available on a foothold