How to Install and Use dig on Debian 13 and Debian 12

by | Feb 13, 2024 | Linux

dig command output with the ANSWER SECTION for an A record, alongside DNS record types A, AAAA, MX, TXT, NS and PTR

Last updated:

dig (Domain Information Groper) sends a DNS query and shows you the full answer: which server replied, how long the record will be cached, and every section of the response. It is the standard tool for checking DNS changes, debugging mail records and confirming a domain points to the right server.

It is not installed on minimal Debian systems, containers or most VPS images, where running it returns dig: command not found.

Quick answer

sudo apt update
sudo apt install bind9-dnsutils
dig -v

Works on Debian 13 and 12. On Debian 13, apt install dnsutils fails with “Unable to locate package”, because that package was removed.

Which package contains dig?

Debian release Package to install dig version Notes
Debian 13 “Trixie” bind9-dnsutils BIND 9.20 dnsutils no longer exists
Debian 12 “Bookworm” bind9-dnsutils BIND 9.18 dnsutils still works as an empty transitional package

Package availability checked against the Debian archive on 3 October 2026. Still on Debian 12 and planning the move? The Debian 12 to 13 upgrade guide walks through it safely. The same package also gives you nslookup, delv and nsupdate.

Install dig

Step 1: Refresh the package lists

sudo apt update
sudo apt update refreshing package lists on Debian

Step 2: Install the DNS utilities

On Debian 12, either name works, because dnsutils simply pulls in bind9-dnsutils:

sudo apt install dnsutils
Installing the dnsutils transitional package with apt on Debian 12
Debian 12 only. This command fails on Debian 13.

Step 3: Confirm dig is installed

dig -v
dig -v printing the installed DiG version on Debian

A version line such as DiG 9.18.x or DiG 9.20.x means it is ready. If you see dig: command not found, the install did not complete.

On Debian 13: install bind9-dnsutils

This is the one command to remember, because it works on both releases:

sudo apt install bind9-dnsutils
Installing bind9-dnsutils with apt on Debian, the package that provides dig

How to read and use dig

The syntax is:

dig [@server] name [type] [+options]
  • @server (optional): the DNS server to ask. Without it, dig uses the first server in /etc/resolv.conf.
  • name: the domain to look up.
  • type (optional): the record type. The default is A.
  • +options: change the query or the output, for example +short.

Record types you will use most

Type What it holds Example
A IPv4 address dig example.com A
AAAA IPv6 address dig example.com AAAA
MX Mail servers for the domain dig example.com MX
NS Authoritative name servers dig example.com NS
TXT SPF, DKIM, DMARC and verification strings dig example.com TXT
CNAME Alias pointing to another name dig www.example.com CNAME
SOA Zone serial number and timers dig example.com SOA
PTR Reverse DNS (IP to name) dig -x 192.0.2.10

Example 1: A standard query

dig google.com
Full dig google.com output showing the header, question, answer sections and query time

How to read the output, top to bottom:

Part What to look at
HEADER status: NOERROR means the lookup worked. NXDOMAIN means the name does not exist; SERVFAIL means the resolver could not get a valid answer. The flags line includes ad when the answer was DNSSEC-validated.
OPT PSEUDOSECTION EDNS details, such as the UDP buffer size. Rarely needed.
QUESTION SECTION What you asked for.
ANSWER SECTION The records. The number after the name is the TTL, the seconds left before resolvers refresh the record.
Footer Query time, the server that answered, and the time of the query.

Example 2: Just the answer

dig google.com +short
dig google.com +short printing only the IP address

+short is the option to use in scripts. For a readable middle ground that keeps the TTL, use dig google.com +noall +answer.

Example 3: Ask a specific DNS server

dig @8.8.8.8 google.com
dig @8.8.8.8 google.com querying Google Public DNS instead of the system resolver

Comparing your resolver with a public one, or with the domain’s own name server (dig @ns1.example.com example.com), is how you tell whether a DNS change is live at the source but still cached elsewhere.

Example 4: Other record types

The ANY type asks for everything:

dig google.com ANY
dig google.com ANY output on Debian

Treat ANY results as incomplete: many providers, including Cloudflare, deliberately return a minimal answer to ANY queries (permitted by RFC 8482). Ask for the type you need instead, such as TXT:

dig google.com TXT
dig google.com TXT showing SPF and site verification TXT records

TXT lookups are how you check SPF, DKIM (dig selector._domainkey.example.com TXT) and DMARC (dig _dmarc.example.com TXT) when email lands in spam.

Example 5: Reverse DNS

dig -x 192.65.69.68
dig -x reverse DNS lookup showing the PTR record for an IP address

A mail server whose IP has no PTR record, or a PTR that does not match its host name, is a common reason for outgoing mail being rejected. Reverse DNS is set by whoever owns the IP, usually your VPS provider’s control panel, not in your own DNS zone.

Example 6: Trace the delegation path

dig google.com +trace
dig +trace following DNS delegation from the root servers to the authoritative name servers

+trace starts at the root servers and follows each referral down to the domain’s authoritative servers, bypassing your resolver’s cache. It is the most reliable way to see what the world will see after you change name servers. To trace the network path to a host instead, use traceroute.

Example 7: Many lookups from a file

Put one query per line in a text file:

wikipedia.org
google.com
yahoo.com

Then pass it with -f:

dig -f testDNS.txt +short
dig -f running batch DNS lookups for several domains read from a text file

Each line can include its own type and options, for example example.com MX.

Example 8: Set default options with ~/.digrc

dig reads ~/.digrc before every run and applies the options in it. To make concise answer-only output your default:

echo "+noall +answer" > ~/.digrc

From then on, a plain dig bing.com uses those options:

dig bing.com
dig bing.com output shaped by options saved in the ~/.digrc file

Options typed on the command line still override the file. Delete ~/.digrc to go back to the full output. If you ever see dig output you did not ask for, a forgotten .digrc is usually why.

Example 9: Force IPv4 or IPv6 transport

dig -4 google.com
dig -4 google.com sending the DNS query over IPv4 only

-4 and -6 choose how the query is sent, not which records come back. To get a domain’s IPv6 address, ask for the AAAA record: dig google.com AAAA.

Example 10: Change the timeout

dig google.com +time=10 +tries=2
dig google.com with the +time option increasing the query timeout

The default wait is 5 seconds per try. Raising it helps on slow or distant servers. If a query still times out, the server is unreachable or port 53 is blocked.

Checking for DNS tampering with dig

dig cannot stop DNS spoofing by itself, but it is how you check for it. Three practical checks:

  1. Compare resolvers. Run the same query against your normal resolver and a public one: dig example.com +short, then dig @1.1.1.1 example.com +short and dig @9.9.9.9 example.com +short. Different answers for a site that does not use geo-routing deserve a closer look.
  2. Check DNSSEC. For domains that sign their zones, dig example.com +dnssec returns RRSIG records, and the ad flag in the header shows that a validating resolver verified them. delv example.com, from the same package, performs the validation itself and prints “fully validated” when the chain checks out.
  3. Ask the source. dig @ns1.example.com example.com queries the domain’s own name server directly, so no resolver cache is involved.

If you decide to switch your system to a resolver you trust, on desktop Debian you can do it in the network connection editor:

nm-connection-editor

Select the connection, open the IPv4 or IPv6 settings, set the method to “Automatic (DHCP) addresses only” and enter DNS servers such as 1.1.1.1, 9.9.9.9:

NetworkManager connection editor IPv4 settings on Debian with custom DNS servers entered

On servers using /etc/network/interfaces, set DNS as described in our static IP guide.

Troubleshooting

Message Meaning Fix
dig: command not found Not installed sudo apt install bind9-dnsutils
E: Unable to locate package dnsutils Debian 13, where the package was removed Install bind9-dnsutils
;; communications error ... timed out or no servers could be reached Resolver down or port 53 blocked Test with dig @1.1.1.1 debian.org; if that works, fix /etc/resolv.conf. If nothing answers at all, check basic connectivity with ping
status: NXDOMAIN The name does not exist Check spelling, or create the record
status: SERVFAIL Resolver could not get a valid answer, often a DNSSEC problem Compare with +cd (checking disabled); if that works, the zone’s DNSSEC is broken
Old value still returned after a change Cached until the TTL expires Query the authoritative server with @, or use +trace

Frequently asked questions

Is dig installed on Debian by default?
Not on minimal, container or most cloud installs. Install bind9-dnsutils.

dig or nslookup?
Both come from the same package. nslookup is quicker to read; dig shows TTLs, flags and every section, which is what you need for real troubleshooting. Our nslookup guide covers the other one.

How do I check DNS propagation with dig?
Query the authoritative server (dig @ns1.yourdns.com yourdomain.com) to confirm the new value exists, then query public resolvers such as @8.8.8.8 and @1.1.1.1. They update as the old record’s TTL runs out.