DNS cheatsheet

Command	Description
`dig example.com`	DNS lookup with full response
`dig +short example.com A`	Just the A record answer
`dig @8.8.8.8 example.com`	Query a specific nameserver
`dig +trace example.com`	Follow delegation from root
`host example.com`	Simple forward lookup
`nslookup example.com`	Interactive / legacy lookup tool
`dig -x 93.184.216.34`	Reverse DNS (PTR) lookup

Command	Description
`dig example.com MX`	Mail exchanger records
`dig example.com TXT`	TXT records (SPF, verification)
`dig example.com NS`	Nameserver delegation
`dig example.com AAAA`	IPv6 address records
`dig example.com CNAME`	Canonical name (alias)
`dig example.com SOA`	Zone authority metadata

Command / file	Description
`cat /etc/resolv.conf`	Active nameservers and search domains
`cat /etc/hosts`	Static hostname overrides
`grep hosts /etc/nsswitch.conf`	Resolution order (files vs dns)
`resolvectl status`	systemd-resolved DNS config per link
`resolvectl query example.com`	Resolve via systemd-resolved
`systemctl status systemd-resolved`	Check resolver service
`getent hosts example.com`	Resolve using NSS (same path as apps)

Command	Description
`ping -c1 example.com`	ICMP after DNS resolution
`curl -v https://example.com`	HTTP with TLS and resolved IP in verbose output
`nc -zv example.com 443`	TCP connect test after resolve
`dig +time=2 +tries=1 @NS example.com`	Quick timeout test to a nameserver

nameserver 10.0.0.2
search internal.example.com example.com
options ndots:1 timeout:2

127.0.0.1   localhost
10.0.1.50   db.internal.example.com db

Use getent hosts to test the same path your application uses — not just dig
dig @server bypasses local resolver config; useful to isolate upstream vs local issues
Check /etc/hosts first when one machine resolves differently from others
Always use FQDNs in production configs to avoid search-domain surprises

Practice scenarios

Hands-on DNS scenarios on live Linux VMs: dns