How to use dig, nslookup, or host for DNS testing?
Still have a question, spotted an error, or have a better explanation or a source we should cite?
You need to check your TXT records for SPF, DKIM, or DMARC, and your ISP isn't helping? Command line tools are your friends. You've got three main options, each with a different complexity level.
dig is the powerhouse. It's the most detailed and gives you the full picture. You can run dig TXT yourdomain.com to pull all TXT records, or dig MX yourdomain.com to check mail exchangers. Want to see what a specific public resolver thinks? Try dig @8.8.8.8 TXT yourdomain.com. The +short flag strips out the noise: dig TXT yourdomain.com +short. If you're really debugging, dig TXT yourdomain.com +trace shows the entire resolution path from root nameservers down.
nslookup is simpler. It's less verbose, which can be nice if you just want a quick answer. Try nslookup -type=TXT yourdomain.com or nslookup -type=MX yourdomain.com. You can also point it at a specific server: nslookup -type=TXT yourdomain.com 8.8.8.8. Most systems have it built in.
host is the briefest. It's fast and clean if you hate clutter. host -t TXT yourdomain.com and host -t MX yourdomain.com do the job. No extra output, just the facts.
Pro tip: if your DNS looks wrong from dig but fine from nslookup, you might have a caching issue. Run the same query against Google's public DNS (8.8.8.8) to see if it's your local resolver lying to you. After you fix records, give them 15 minutes before testing again (that's TTL at work). If you're feeling overwhelmed by the command line, Review My Emails has a free SPF checker that does this work for you in a browser.
Contributors
Who worked on this answer
Every name links to their profile. Every company links to their site. Real people, real accountability.
