Dig for DNS Information

In addition to Nslookup, UNIX administrators have long used another tool, called Dig, to perform DNS name lookups. (Dig is similar to Nslookup but doesn't have that tool's interactive mode.) This year, the Internet Software Consortium (ISC) ported Dig into the Windows 2000 and Windows NT versions of BIND 8.2.3 and later. When you execute dig.exe, the tool calls the BIND file libbind.dll. To use Dig, you need to place dig.exe and a copy of libbind.dll in the same directory or in a searchable directory on a Win2K or NT workstation.

In the Dig command line, you can specify a DNS server to query. Otherwise, on any Win2K system or on an NT system that doesn't contain a configured DNS server IP address in its TCP/IP properties, Dig looks up a DNS server through the resolv.conf file, which resides in C:winntsystem32driversetc. This file is a traditional UNIX configuration file that defines which DNS servers the DNS client uses. Listing A shows a sample resolv.conf file.

You can include as many as three nameserver entries in resolv.conf. Usually, the file can also include a domain statement and a search statement, which specify the domain suffixes and the domain search order to use if you try to resolve a host name instead of a fully qualified domain name (FQDN). However, I found that Dig in BIND 8.2.4 for Win2K or NT doesn't support the search statement. Dig's most basic syntax is

dig [@] [] []

For example, the command

dig @24.30.163.11 www.microsoft.com any

tells Dig to use the DNS server 24.30.163.11 to resolve the query for the domain name www.microsoft.com. The specified query type is any, which tells Dig to look for DNS information about www.microsoft.com regardless of DNS Resource Record (RR) type. (For information about Dig's options, use Dig's -h option.) The result, which Figure A shows, is quite comprehensive.

Callout A in Figure A shows the Dig version and the entered command-line options. Callout B displays the query's recursive options, which in this example is recursive. Callout C shows the query's status. In this example, the status is NOERROR, which means the query was successful. (A status of SERVFAIL means the server couldn't resolve the request.) Callout D displays the number of query requests in the Query section and the number of records in each section of the query response (i.e., the Answer, Authority, and Additional sections).

The Answer section returns the resolved DNS information from the queried RRs. Callout E shows that www.microsoft.com is a CNAME record pointing to www.microsoft.akadns.net, which means that akadns.net hosts Microsoft's Web site. Callout E also tells you the DNS server had a cached record of www.microsoft.com that would expire in 13 minutes and 46 seconds. The Authority section lists all authoritative DNS servers in the domain microsoft.com. The Additional section attempts to provide the IP addresses of the servers in the Authority section. Callout F reveals how much time the query took, which computer initiated the query to which DNS server, when the computer submitted the query, and what the query message sizes were.