1<!DOCTYPE book PUBLIC "-//OASIS//DTD DocBook XML V4.2//EN" 2 "http://www.oasis-open.org/docbook/xml/4.2/docbookx.dtd" 3 [<!ENTITY mdash "—">]> 4<!-- 5 - Copyright (C) 2004-2010 Internet Systems Consortium, Inc. ("ISC") 6 - Copyright (C) 2000-2003 Internet Software Consortium. 7 - 8 - Permission to use, copy, modify, and/or distribute this software for any 9 - purpose with or without fee is hereby granted, provided that the above 10 - copyright notice and this permission notice appear in all copies. 11 - 12 - THE SOFTWARE IS PROVIDED "AS IS" AND ISC DISCLAIMS ALL WARRANTIES WITH 13 - REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY 14 - AND FITNESS. IN NO EVENT SHALL ISC BE LIABLE FOR ANY SPECIAL, DIRECT, 15 - INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM 16 - LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE 17 - OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR 18 - PERFORMANCE OF THIS SOFTWARE. 19--> 20 21<!-- $Id: dig.docbook,v 1.47 2010/03/04 23:50:34 tbox Exp $ --> 22<refentry id="man.dig"> 23 24 <refentryinfo> 25 <date>Jun 30, 2000</date> 26 </refentryinfo> 27 28 <refmeta> 29 <refentrytitle>dig</refentrytitle> 30 <manvolnum>1</manvolnum> 31 <refmiscinfo>BIND9</refmiscinfo> 32 </refmeta> 33 34 <refnamediv> 35 <refname>dig</refname> 36 <refpurpose>DNS lookup utility</refpurpose> 37 </refnamediv> 38 39 <docinfo> 40 <copyright> 41 <year>2004</year> 42 <year>2005</year> 43 <year>2006</year> 44 <year>2007</year> 45 <year>2008</year> 46 <year>2009</year> 47 <year>2010</year> 48 <holder>Internet Systems Consortium, Inc. ("ISC")</holder> 49 </copyright> 50 <copyright> 51 <year>2000</year> 52 <year>2001</year> 53 <year>2002</year> 54 <year>2003</year> 55 <holder>Internet Software Consortium.</holder> 56 </copyright> 57 </docinfo> 58 59 <refsynopsisdiv> 60 <cmdsynopsis> 61 <command>dig</command> 62 <arg choice="opt">@server</arg> 63 <arg><option>-b <replaceable class="parameter">address</replaceable></option></arg> 64 <arg><option>-c <replaceable class="parameter">class</replaceable></option></arg> 65 <arg><option>-f <replaceable class="parameter">filename</replaceable></option></arg> 66 <arg><option>-k <replaceable class="parameter">filename</replaceable></option></arg> 67 <arg><option>-m</option></arg> 68 <arg><option>-p <replaceable class="parameter">port#</replaceable></option></arg> 69 <arg><option>-q <replaceable class="parameter">name</replaceable></option></arg> 70 <arg><option>-t <replaceable class="parameter">type</replaceable></option></arg> 71 <arg><option>-x <replaceable class="parameter">addr</replaceable></option></arg> 72 <arg><option>-y <replaceable class="parameter"><optional>hmac:</optional>name:key</replaceable></option></arg> 73 <arg><option>-4</option></arg> 74 <arg><option>-6</option></arg> 75 <arg choice="opt">name</arg> 76 <arg choice="opt">type</arg> 77 <arg choice="opt">class</arg> 78 <arg choice="opt" rep="repeat">queryopt</arg> 79 </cmdsynopsis> 80 81 <cmdsynopsis> 82 <command>dig</command> 83 <arg><option>-h</option></arg> 84 </cmdsynopsis> 85 86 <cmdsynopsis> 87 <command>dig</command> 88 <arg choice="opt" rep="repeat">global-queryopt</arg> 89 <arg choice="opt" rep="repeat">query</arg> 90 </cmdsynopsis> 91 </refsynopsisdiv> 92 93 <refsect1> 94 <title>DESCRIPTION</title> 95 <para><command>dig</command> 96 (domain information groper) is a flexible tool 97 for interrogating DNS name servers. It performs DNS lookups and 98 displays the answers that are returned from the name server(s) that 99 were queried. Most DNS administrators use <command>dig</command> to 100 troubleshoot DNS problems because of its flexibility, ease of use and 101 clarity of output. Other lookup tools tend to have less functionality 102 than <command>dig</command>. 103 </para> 104 105 <para> 106 Although <command>dig</command> is normally used with 107 command-line 108 arguments, it also has a batch mode of operation for reading lookup 109 requests from a file. A brief summary of its command-line arguments 110 and options is printed when the <option>-h</option> option is given. 111 Unlike earlier versions, the BIND 9 implementation of 112 <command>dig</command> allows multiple lookups to be issued 113 from the 114 command line. 115 </para> 116 117 <para> 118 Unless it is told to query a specific name server, 119 <command>dig</command> will try each of the servers listed 120 in 121 <filename>/etc/resolv.conf</filename>. 122 </para> 123 124 <para> 125 When no command line arguments or options are given, 126 <command>dig</command> will perform an NS query for "." (the root). 127 </para> 128 129 <para> 130 It is possible to set per-user defaults for <command>dig</command> via 131 <filename>${HOME}/.digrc</filename>. This file is read and 132 any options in it 133 are applied before the command line arguments. 134 </para> 135 136 <para> 137 The IN and CH class names overlap with the IN and CH top level 138 domains names. Either use the <option>-t</option> and 139 <option>-c</option> options to specify the type and class, 140 use the <option>-q</option> the specify the domain name, or 141 use "IN." and "CH." when looking up these top level domains. 142 </para> 143 144 </refsect1> 145 146 <refsect1> 147 <title>SIMPLE USAGE</title> 148 149 <para> 150 A typical invocation of <command>dig</command> looks like: 151 <programlisting> dig @server name type </programlisting> 152 where: 153 154 <variablelist> 155 156 <varlistentry> 157 <term><constant>server</constant></term> 158 <listitem> 159 <para> 160 is the name or IP address of the name server to query. This can 161 be an IPv4 162 address in dotted-decimal notation or an IPv6 163 address in colon-delimited notation. When the supplied 164 <parameter>server</parameter> argument is a 165 hostname, 166 <command>dig</command> resolves that name before 167 querying that name 168 server. If no <parameter>server</parameter> 169 argument is provided, 170 <command>dig</command> consults <filename>/etc/resolv.conf</filename> 171 and queries the name servers listed there. The reply from the 172 name 173 server that responds is displayed. 174 </para> 175 </listitem> 176 </varlistentry> 177 178 <varlistentry> 179 <term><constant>name</constant></term> 180 <listitem> 181 <para> 182 is the name of the resource record that is to be looked up. 183 </para> 184 </listitem> 185 </varlistentry> 186 187 <varlistentry> 188 <term><constant>type</constant></term> 189 <listitem> 190 <para> 191 indicates what type of query is required — 192 ANY, A, MX, SIG, etc. 193 <parameter>type</parameter> can be any valid query 194 type. If no 195 <parameter>type</parameter> argument is supplied, 196 <command>dig</command> will perform a lookup for an 197 A record. 198 </para> 199 </listitem> 200 </varlistentry> 201 202 </variablelist> 203 </para> 204 205 </refsect1> 206 207 <refsect1> 208 <title>OPTIONS</title> 209 210 <para> 211 The <option>-b</option> option sets the source IP address of the query 212 to <parameter>address</parameter>. This must be a valid 213 address on 214 one of the host's network interfaces or "0.0.0.0" or "::". An optional 215 port 216 may be specified by appending "#<port>" 217 </para> 218 219 <para> 220 The default query class (IN for internet) is overridden by the 221 <option>-c</option> option. <parameter>class</parameter> is 222 any valid 223 class, such as HS for Hesiod records or CH for Chaosnet records. 224 </para> 225 226 <para> 227 The <option>-f</option> option makes <command>dig </command> 228 operate 229 in batch mode by reading a list of lookup requests to process from the 230 file <parameter>filename</parameter>. The file contains a 231 number of 232 queries, one per line. Each entry in the file should be organized in 233 the same way they would be presented as queries to 234 <command>dig</command> using the command-line interface. 235 </para> 236 237 <para> 238 The <option>-m</option> option enables memory usage debugging. 239 <!-- It enables ISC_MEM_DEBUGTRACE and ISC_MEM_DEBUGRECORD 240 documented in include/isc/mem.h --> 241 </para> 242 243 <para> 244 If a non-standard port number is to be queried, the 245 <option>-p</option> option is used. <parameter>port#</parameter> is 246 the port number that <command>dig</command> will send its 247 queries 248 instead of the standard DNS port number 53. This option would be used 249 to test a name server that has been configured to listen for queries 250 on a non-standard port number. 251 </para> 252 253 <para> 254 The <option>-4</option> option forces <command>dig</command> 255 to only 256 use IPv4 query transport. The <option>-6</option> option forces 257 <command>dig</command> to only use IPv6 query transport. 258 </para> 259 260 <para> 261 The <option>-t</option> option sets the query type to 262 <parameter>type</parameter>. It can be any valid query type 263 which is 264 supported in BIND 9. The default query type is "A", unless the 265 <option>-x</option> option is supplied to indicate a reverse lookup. 266 A zone transfer can be requested by specifying a type of AXFR. When 267 an incremental zone transfer (IXFR) is required, 268 <parameter>type</parameter> is set to <literal>ixfr=N</literal>. 269 The incremental zone transfer will contain the changes made to the zone 270 since the serial number in the zone's SOA record was 271 <parameter>N</parameter>. 272 </para> 273 274 <para> 275 The <option>-q</option> option sets the query name to 276 <parameter>name</parameter>. This useful do distinguish the 277 <parameter>name</parameter> from other arguments. 278 </para> 279 280 <para> 281 Reverse lookups — mapping addresses to names — are simplified by the 282 <option>-x</option> option. <parameter>addr</parameter> is 283 an IPv4 284 address in dotted-decimal notation, or a colon-delimited IPv6 address. 285 When this option is used, there is no need to provide the 286 <parameter>name</parameter>, <parameter>class</parameter> and 287 <parameter>type</parameter> arguments. <command>dig</command> 288 automatically performs a lookup for a name like 289 <literal>11.12.13.10.in-addr.arpa</literal> and sets the 290 query type and 291 class to PTR and IN respectively. By default, IPv6 addresses are 292 looked up using nibble format under the IP6.ARPA domain. 293 To use the older RFC1886 method using the IP6.INT domain 294 specify the <option>-i</option> option. Bit string labels (RFC2874) 295 are now experimental and are not attempted. 296 </para> 297 298 <para> 299 To sign the DNS queries sent by <command>dig</command> and 300 their 301 responses using transaction signatures (TSIG), specify a TSIG key file 302 using the <option>-k</option> option. You can also specify the TSIG 303 key itself on the command line using the <option>-y</option> option; 304 <parameter>hmac</parameter> is the type of the TSIG, default HMAC-MD5, 305 <parameter>name</parameter> is the name of the TSIG key and 306 <parameter>key</parameter> is the actual key. The key is a 307 base-64 308 encoded string, typically generated by 309 <citerefentry> 310 <refentrytitle>dnssec-keygen</refentrytitle><manvolnum>8</manvolnum> 311 </citerefentry>. 312 313 Caution should be taken when using the <option>-y</option> option on 314 multi-user systems as the key can be visible in the output from 315 <citerefentry> 316 <refentrytitle>ps</refentrytitle><manvolnum>1</manvolnum> 317 </citerefentry> 318 or in the shell's history file. When 319 using TSIG authentication with <command>dig</command>, the name 320 server that is queried needs to know the key and algorithm that is 321 being used. In BIND, this is done by providing appropriate 322 <command>key</command> and <command>server</command> statements in 323 <filename>named.conf</filename>. 324 </para> 325 326 </refsect1> 327 328 <refsect1> 329 <title>QUERY OPTIONS</title> 330 331 <para><command>dig</command> 332 provides a number of query options which affect 333 the way in which lookups are made and the results displayed. Some of 334 these set or reset flag bits in the query header, some determine which 335 sections of the answer get printed, and others determine the timeout 336 and retry strategies. 337 </para> 338 339 <para> 340 Each query option is identified by a keyword preceded by a plus sign 341 (<literal>+</literal>). Some keywords set or reset an 342 option. These may be preceded 343 by the string <literal>no</literal> to negate the meaning of 344 that keyword. Other 345 keywords assign values to options like the timeout interval. They 346 have the form <option>+keyword=value</option>. 347 The query options are: 348 349 <variablelist> 350 351 <varlistentry> 352 <term><option>+[no]tcp</option></term> 353 <listitem> 354 <para> 355 Use [do not use] TCP when querying name servers. The default 356 behavior is to use UDP unless an AXFR or IXFR query is 357 requested, in 358 which case a TCP connection is used. 359 </para> 360 </listitem> 361 </varlistentry> 362 363 <varlistentry> 364 <term><option>+[no]vc</option></term> 365 <listitem> 366 <para> 367 Use [do not use] TCP when querying name servers. This alternate 368 syntax to <parameter>+[no]tcp</parameter> is 369 provided for backwards 370 compatibility. The "vc" stands for "virtual circuit". 371 </para> 372 </listitem> 373 </varlistentry> 374 375 <varlistentry> 376 <term><option>+[no]ignore</option></term> 377 <listitem> 378 <para> 379 Ignore truncation in UDP responses instead of retrying with TCP. 380 By 381 default, TCP retries are performed. 382 </para> 383 </listitem> 384 </varlistentry> 385 386 <varlistentry> 387 <term><option>+domain=somename</option></term> 388 <listitem> 389 <para> 390 Set the search list to contain the single domain 391 <parameter>somename</parameter>, as if specified in 392 a 393 <command>domain</command> directive in 394 <filename>/etc/resolv.conf</filename>, and enable 395 search list 396 processing as if the <parameter>+search</parameter> 397 option were given. 398 </para> 399 </listitem> 400 </varlistentry> 401 402 <varlistentry> 403 <term><option>+[no]search</option></term> 404 <listitem> 405 <para> 406 Use [do not use] the search list defined by the searchlist or 407 domain 408 directive in <filename>resolv.conf</filename> (if 409 any). 410 The search list is not used by default. 411 </para> 412 </listitem> 413 </varlistentry> 414 415 <varlistentry> 416 <term><option>+[no]showsearch</option></term> 417 <listitem> 418 <para> 419 Perform [do not perform] a search showing intermediate 420 results. 421 </para> 422 </listitem> 423 </varlistentry> 424 425 <varlistentry> 426 <term><option>+[no]defname</option></term> 427 <listitem> 428 <para> 429 Deprecated, treated as a synonym for <parameter>+[no]search</parameter> 430 </para> 431 </listitem> 432 </varlistentry> 433 434 <varlistentry> 435 <term><option>+[no]aaonly</option></term> 436 <listitem> 437 <para> 438 Sets the "aa" flag in the query. 439 </para> 440 </listitem> 441 </varlistentry> 442 443 <varlistentry> 444 <term><option>+[no]aaflag</option></term> 445 <listitem> 446 <para> 447 A synonym for <parameter>+[no]aaonly</parameter>. 448 </para> 449 </listitem> 450 </varlistentry> 451 452 <varlistentry> 453 <term><option>+[no]adflag</option></term> 454 <listitem> 455 <para> 456 Set [do not set] the AD (authentic data) bit in the 457 query. This requests the server to return whether 458 all of the answer and authority sections have all 459 been validated as secure according to the security 460 policy of the server. AD=1 indicates that all records 461 have been validated as secure and the answer is not 462 from a OPT-OUT range. AD=0 indicate that some part 463 of the answer was insecure or not validated. 464 </para> 465 </listitem> 466 </varlistentry> 467 468 <varlistentry> 469 <term><option>+[no]cdflag</option></term> 470 <listitem> 471 <para> 472 Set [do not set] the CD (checking disabled) bit in the query. 473 This 474 requests the server to not perform DNSSEC validation of 475 responses. 476 </para> 477 </listitem> 478 </varlistentry> 479 480 <varlistentry> 481 <term><option>+[no]cl</option></term> 482 <listitem> 483 <para> 484 Display [do not display] the CLASS when printing the record. 485 </para> 486 </listitem> 487 </varlistentry> 488 489 <varlistentry> 490 <term><option>+[no]ttlid</option></term> 491 <listitem> 492 <para> 493 Display [do not display] the TTL when printing the record. 494 </para> 495 </listitem> 496 </varlistentry> 497 498 <varlistentry> 499 <term><option>+[no]recurse</option></term> 500 <listitem> 501 <para> 502 Toggle the setting of the RD (recursion desired) bit in the 503 query. 504 This bit is set by default, which means <command>dig</command> 505 normally sends recursive queries. Recursion is automatically 506 disabled 507 when the <parameter>+nssearch</parameter> or 508 <parameter>+trace</parameter> query options are 509 used. 510 </para> 511 </listitem> 512 </varlistentry> 513 514 <varlistentry> 515 <term><option>+[no]nssearch</option></term> 516 <listitem> 517 <para> 518 When this option is set, <command>dig</command> 519 attempts to find the 520 authoritative name servers for the zone containing the name 521 being 522 looked up and display the SOA record that each name server has 523 for the 524 zone. 525 </para> 526 </listitem> 527 </varlistentry> 528 529 <varlistentry> 530 <term><option>+[no]trace</option></term> 531 <listitem> 532 <para> 533 Toggle tracing of the delegation path from the root name servers 534 for 535 the name being looked up. Tracing is disabled by default. When 536 tracing is enabled, <command>dig</command> makes 537 iterative queries to 538 resolve the name being looked up. It will follow referrals from 539 the 540 root servers, showing the answer from each server that was used 541 to 542 resolve the lookup. 543 </para> 544 </listitem> 545 </varlistentry> 546 547 <varlistentry> 548 <term><option>+[no]cmd</option></term> 549 <listitem> 550 <para> 551 Toggles the printing of the initial comment in the output 552 identifying 553 the version of <command>dig</command> and the query 554 options that have 555 been applied. This comment is printed by default. 556 </para> 557 </listitem> 558 </varlistentry> 559 560 <varlistentry> 561 <term><option>+[no]short</option></term> 562 <listitem> 563 <para> 564 Provide a terse answer. The default is to print the answer in a 565 verbose form. 566 </para> 567 </listitem> 568 </varlistentry> 569 570 <varlistentry> 571 <term><option>+[no]identify</option></term> 572 <listitem> 573 <para> 574 Show [or do not show] the IP address and port number that 575 supplied the 576 answer when the <parameter>+short</parameter> option 577 is enabled. If 578 short form answers are requested, the default is not to show the 579 source address and port number of the server that provided the 580 answer. 581 </para> 582 </listitem> 583 </varlistentry> 584 585 <varlistentry> 586 <term><option>+[no]comments</option></term> 587 <listitem> 588 <para> 589 Toggle the display of comment lines in the output. The default 590 is to 591 print comments. 592 </para> 593 </listitem> 594 </varlistentry> 595 596 <varlistentry> 597 <term><option>+[no]stats</option></term> 598 <listitem> 599 <para> 600 This query option toggles the printing of statistics: when the 601 query 602 was made, the size of the reply and so on. The default 603 behavior is 604 to print the query statistics. 605 </para> 606 </listitem> 607 </varlistentry> 608 609 <varlistentry> 610 <term><option>+[no]qr</option></term> 611 <listitem> 612 <para> 613 Print [do not print] the query as it is sent. 614 By default, the query is not printed. 615 </para> 616 </listitem> 617 </varlistentry> 618 619 <varlistentry> 620 <term><option>+[no]question</option></term> 621 <listitem> 622 <para> 623 Print [do not print] the question section of a query when an 624 answer is 625 returned. The default is to print the question section as a 626 comment. 627 </para> 628 </listitem> 629 </varlistentry> 630 631 <varlistentry> 632 <term><option>+[no]answer</option></term> 633 <listitem> 634 <para> 635 Display [do not display] the answer section of a reply. The 636 default 637 is to display it. 638 </para> 639 </listitem> 640 </varlistentry> 641 642 <varlistentry> 643 <term><option>+[no]authority</option></term> 644 <listitem> 645 <para> 646 Display [do not display] the authority section of a reply. The 647 default is to display it. 648 </para> 649 </listitem> 650 </varlistentry> 651 652 <varlistentry> 653 <term><option>+[no]additional</option></term> 654 <listitem> 655 <para> 656 Display [do not display] the additional section of a reply. 657 The default is to display it. 658 </para> 659 </listitem> 660 </varlistentry> 661 662 <varlistentry> 663 <term><option>+[no]all</option></term> 664 <listitem> 665 <para> 666 Set or clear all display flags. 667 </para> 668 </listitem> 669 </varlistentry> 670 671 <varlistentry> 672 <term><option>+time=T</option></term> 673 <listitem> 674 <para> 675 676 Sets the timeout for a query to 677 <parameter>T</parameter> seconds. The default 678 timeout is 5 seconds. 679 An attempt to set <parameter>T</parameter> to less 680 than 1 will result 681 in a query timeout of 1 second being applied. 682 </para> 683 </listitem> 684 </varlistentry> 685 686 <varlistentry> 687 <term><option>+tries=T</option></term> 688 <listitem> 689 <para> 690 Sets the number of times to try UDP queries to server to 691 <parameter>T</parameter> instead of the default, 3. 692 If 693 <parameter>T</parameter> is less than or equal to 694 zero, the number of 695 tries is silently rounded up to 1. 696 </para> 697 </listitem> 698 </varlistentry> 699 700 <varlistentry> 701 <term><option>+retry=T</option></term> 702 <listitem> 703 <para> 704 Sets the number of times to retry UDP queries to server to 705 <parameter>T</parameter> instead of the default, 2. 706 Unlike 707 <parameter>+tries</parameter>, this does not include 708 the initial 709 query. 710 </para> 711 </listitem> 712 </varlistentry> 713 714 <varlistentry> 715 <term><option>+ndots=D</option></term> 716 <listitem> 717 <para> 718 Set the number of dots that have to appear in 719 <parameter>name</parameter> to <parameter>D</parameter> for it to be 720 considered absolute. The default value is that defined using 721 the 722 ndots statement in <filename>/etc/resolv.conf</filename>, or 1 if no 723 ndots statement is present. Names with fewer dots are 724 interpreted as 725 relative names and will be searched for in the domains listed in 726 the 727 <option>search</option> or <option>domain</option> directive in 728 <filename>/etc/resolv.conf</filename>. 729 </para> 730 </listitem> 731 </varlistentry> 732 733 <varlistentry> 734 <term><option>+bufsize=B</option></term> 735 <listitem> 736 <para> 737 Set the UDP message buffer size advertised using EDNS0 to 738 <parameter>B</parameter> bytes. The maximum and minimum sizes 739 of this buffer are 65535 and 0 respectively. Values outside 740 this range are rounded up or down appropriately. 741 Values other than zero will cause a EDNS query to be sent. 742 </para> 743 </listitem> 744 </varlistentry> 745 746 <varlistentry> 747 <term><option>+edns=#</option></term> 748 <listitem> 749 <para> 750 Specify the EDNS version to query with. Valid values 751 are 0 to 255. Setting the EDNS version will cause a 752 EDNS query to be sent. <option>+noedns</option> clears the 753 remembered EDNS version. 754 </para> 755 </listitem> 756 </varlistentry> 757 758 <varlistentry> 759 <term><option>+[no]multiline</option></term> 760 <listitem> 761 <para> 762 Print records like the SOA records in a verbose multi-line 763 format with human-readable comments. The default is to print 764 each record on a single line, to facilitate machine parsing 765 of the <command>dig</command> output. 766 </para> 767 </listitem> 768 </varlistentry> 769 770 <varlistentry> 771 <term><option>+[no]onesoa</option></term> 772 <listitem> 773 <para> 774 Print only one (starting) SOA record when performing 775 an AXFR. The default is to print both the starting and 776 ending SOA records. 777 </para> 778 </listitem> 779 </varlistentry> 780 781 <varlistentry> 782 <term><option>+[no]fail</option></term> 783 <listitem> 784 <para> 785 Do not try the next server if you receive a SERVFAIL. The 786 default is 787 to not try the next server which is the reverse of normal stub 788 resolver 789 behavior. 790 </para> 791 </listitem> 792 </varlistentry> 793 794 <varlistentry> 795 <term><option>+[no]besteffort</option></term> 796 <listitem> 797 <para> 798 Attempt to display the contents of messages which are malformed. 799 The default is to not display malformed answers. 800 </para> 801 </listitem> 802 </varlistentry> 803 804 <varlistentry> 805 <term><option>+[no]dnssec</option></term> 806 <listitem> 807 <para> 808 Requests DNSSEC records be sent by setting the DNSSEC OK bit 809 (DO) 810 in the OPT record in the additional section of the query. 811 </para> 812 </listitem> 813 </varlistentry> 814 815 <varlistentry> 816 <term><option>+[no]sigchase</option></term> 817 <listitem> 818 <para> 819 Chase DNSSEC signature chains. Requires dig be compiled with 820 -DDIG_SIGCHASE. 821 </para> 822 </listitem> 823 </varlistentry> 824 825 <varlistentry> 826 <term><option>+trusted-key=####</option></term> 827 <listitem> 828 <para> 829 Specifies a file containing trusted keys to be used with 830 <option>+sigchase</option>. Each DNSKEY record must be 831 on its own line. 832 </para> 833 <para> 834 If not specified, <command>dig</command> will look for 835 <filename>/etc/trusted-key.key</filename> then 836 <filename>trusted-key.key</filename> in the current directory. 837 </para> 838 <para> 839 Requires dig be compiled with -DDIG_SIGCHASE. 840 </para> 841 </listitem> 842 </varlistentry> 843 844 <varlistentry> 845 <term><option>+[no]topdown</option></term> 846 <listitem> 847 <para> 848 When chasing DNSSEC signature chains perform a top-down 849 validation. 850 Requires dig be compiled with -DDIG_SIGCHASE. 851 </para> 852 </listitem> 853 </varlistentry> 854 855 <varlistentry> 856 <term><option>+[no]nsid</option></term> 857 <listitem> 858 <para> 859 Include an EDNS name server ID request when sending a query. 860 </para> 861 </listitem> 862 </varlistentry> 863 864 865 </variablelist> 866 867 </para> 868 </refsect1> 869 870 <refsect1> 871 <title>MULTIPLE QUERIES</title> 872 873 <para> 874 The BIND 9 implementation of <command>dig </command> 875 supports 876 specifying multiple queries on the command line (in addition to 877 supporting the <option>-f</option> batch file option). Each of those 878 queries can be supplied with its own set of flags, options and query 879 options. 880 </para> 881 882 <para> 883 In this case, each <parameter>query</parameter> argument 884 represent an 885 individual query in the command-line syntax described above. Each 886 consists of any of the standard options and flags, the name to be 887 looked up, an optional query type and class and any query options that 888 should be applied to that query. 889 </para> 890 891 <para> 892 A global set of query options, which should be applied to all queries, 893 can also be supplied. These global query options must precede the 894 first tuple of name, class, type, options, flags, and query options 895 supplied on the command line. Any global query options (except 896 the <option>+[no]cmd</option> option) can be 897 overridden by a query-specific set of query options. For example: 898 <programlisting> 899dig +qr www.isc.org any -x 127.0.0.1 isc.org ns +noqr 900</programlisting> 901 shows how <command>dig</command> could be used from the 902 command line 903 to make three lookups: an ANY query for <literal>www.isc.org</literal>, a 904 reverse lookup of 127.0.0.1 and a query for the NS records of 905 <literal>isc.org</literal>. 906 907 A global query option of <parameter>+qr</parameter> is 908 applied, so 909 that <command>dig</command> shows the initial query it made 910 for each 911 lookup. The final query has a local query option of 912 <parameter>+noqr</parameter> which means that <command>dig</command> 913 will not print the initial query when it looks up the NS records for 914 <literal>isc.org</literal>. 915 </para> 916 917 </refsect1> 918 919 <refsect1> 920 <title>IDN SUPPORT</title> 921 <para> 922 If <command>dig</command> has been built with IDN (internationalized 923 domain name) support, it can accept and display non-ASCII domain names. 924 <command>dig</command> appropriately converts character encoding of 925 domain name before sending a request to DNS server or displaying a 926 reply from the server. 927 If you'd like to turn off the IDN support for some reason, defines 928 the <envar>IDN_DISABLE</envar> environment variable. 929 The IDN support is disabled if the variable is set when 930 <command>dig</command> runs. 931 </para> 932 </refsect1> 933 934 <refsect1> 935 <title>FILES</title> 936 <para><filename>/etc/resolv.conf</filename> 937 </para> 938 <para><filename>${HOME}/.digrc</filename> 939 </para> 940 </refsect1> 941 942 <refsect1> 943 <title>SEE ALSO</title> 944 <para><citerefentry> 945 <refentrytitle>host</refentrytitle><manvolnum>1</manvolnum> 946 </citerefentry>, 947 <citerefentry> 948 <refentrytitle>named</refentrytitle><manvolnum>8</manvolnum> 949 </citerefentry>, 950 <citerefentry> 951 <refentrytitle>dnssec-keygen</refentrytitle><manvolnum>8</manvolnum> 952 </citerefentry>, 953 <citetitle>RFC1035</citetitle>. 954 </para> 955 </refsect1> 956 957 <refsect1> 958 <title>BUGS</title> 959 <para> 960 There are probably too many query options. 961 </para> 962 </refsect1> 963</refentry><!-- 964 - Local variables: 965 - mode: sgml 966 - End: 967--> 968