Ravindra BagaleCourses & study guides

12. Domains and DNS: GoDaddy, Elastic IP, A/CNAME and Subdomains

12.6 Verifying DNS with dig, nslookup and curl

dig example.com +short                  # A record → 203.0.113.10
dig www.example.com +short              # CNAME chain → example.com. → 203.0.113.10
dig example.com                         # full answer incl. TTL countdown
dig @8.8.8.8 example.com +short         # ask Google's public resolver
dig @1.1.1.1 example.com +short         # ask Cloudflare's resolver
dig NS example.com +short               # which name servers are authoritative?
dig MX example.com +short               # mail records
dig +trace example.com                  # follow root → TLD → authoritative
nslookup example.com                    # works on Windows, macOS and Linux
host example.com                        # short output (Linux)
curl -I http://example.com              # DNS + web server together

dig comes from bind-utils on Amazon Linux/CentOS (sudo yum install -y bind-utils) and dnsutils on Ubuntu (sudo apt install -y dnsutils).

Reading dig output:

;; ANSWER SECTION:
example.com.        587     IN      A       203.0.113.10
     name          TTL(s) class   type     value

Flush stale caches on your laptop if the server already shows the new IP but your browser still doesn't:

OS Command
Windows ipconfig /flushdns
macOS sudo dscacheutil -​flushcache; sudo killall -​HUP mDNSResponder
Linux (systemd-resolved) resolvectl flush-​caches
Chrome browser open chrome://​net-​internals/#dns → Clear host cache

Why this matters for security

The same dig commands are reconnaissance tools. dig +trace shows the delegation chain; dig TXT reveals SPF and verification records; testing curl -H "Host: ..." against an IP is how testers find virtual hosts that are not in public DNS.

Ravindra Bagale's Tip

When a domain "isn't working", split the problem in two: dig yourdomain.com +short tells you whether DNS is correct, and curl -I http://<EIP> -H "Host: yourdomain.com" tells you whether the web server is correct. If both are fine, it's just your laptop's cache – wait or flush it.

Practice task

Query your domain through 8.8.8.8 and 1.1.1.1, follow it with dig +trace, and flush your laptop's DNS cache.