dig: Usage, Options & Common CI Errors
dig queries DNS and shows exactly what the resolver returns.
dig is the precise DNS lookup tool for debugging resolution in CI. The CI gotchas: +short for scriptable output, @server to bypass the local resolver, and it is often missing from slim images.
What it does
dig sends DNS queries and prints the full response - answer, authority, and additional sections - for any record type. It is the authoritative way to see what a name actually resolves to and from which server.
Common usage
dig example.com
dig +short example.com # just the answer
dig +short A api.example.com
dig MX example.com
dig @8.8.8.8 example.com # query a specific server
dig +trace example.com # full delegation pathOptions
| Item | What it does |
|---|---|
| +short | Print only the answer (scriptable) |
| A | AAAA | MX | TXT | CNAME | Record type to query |
| @<server> | Query a specific DNS server |
| +trace | Trace delegation from the root |
| +noall +answer | Show only the answer section |
Common errors in CI
status: NXDOMAIN means the name does not exist (typo or wrong domain); status: SERVFAIL means the resolver failed (DNSSEC issue or upstream broken) - try @8.8.8.8 to isolate the local resolver. dig +short returning nothing means no record of that type (still exit 0), so test the output, not just the exit code. "dig: command not found" - dig ships in dnsutils/bind-tools; slim and Alpine images omit it (install bind-tools), where getent hosts or nslookup are fallbacks.