DNS

getent ahosts api.example.com                    # what applications on this host get, including /etc/hosts
dig +short api.example.com                       # what the configured resolver returns
dig @1.1.1.1 +short api.example.com              # what a public resolver returns
dig NS example.com +short                        # who is authoritative
dig +norecurse @ns1.example.com api.example.com  # straight from the zone, no cache involved
dig +trace api.example.com | tail -20            # delegation from the root, done by dig itself
resolvectl status | head -20                     # which servers and search domains this host uses

;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 23405
;; flags: qr rd ra; QUERY: 1, ANSWER: 2, AUTHORITY: 0, ADDITIONAL: 1

;; ANSWER SECTION:
api.example.com.   60   IN   CNAME   lb.example.net.
lb.example.net.    30   IN   A       203.0.113.10

;; SERVER: 192.0.2.53#53(192.0.2.53) (UDP)
;; Query time: 4 msec

dig -t MX example.com +noall +answer          # one section only; -t and a bare type name are equivalent
dig example.com +short +identify              # answer plus the server and port that supplied it
dig SOA example.com +multiline                # SOA fields on separate lines with field names
dig +nssearch example.com                     # SOA from every authoritative server, one line each, with query time
dig +norecurse +dnssec DNSKEY example.com @ns1.example.com   # zone keys with RRSIGs, from the source
dig +tcp AXFR example.com @ns1.example.com    # zone transfer; refused unless your address is allowed
dig +tls @1.1.1.1 example.com                 # DNS over TLS, port defaults to 853
dig +https @1.1.1.1 example.com               # DNS over HTTPS, port defaults to 443
dig +subnet=192.0.2.0/24 example.com @8.8.8.8 # EDNS Client Subnet: what a client in that network would be told
dig +bufsize=512 +noedns example.com          # force pre-EDNS behaviour to reproduce truncation
dig +timeout=2 +tries=1 example.com           # fail fast instead of waiting 5 s and retrying 3 times
dig -4 example.com; dig -6 example.com        # restrict the transport, not the record type
dig -p 5353 @127.0.0.1 example.com            # a resolver on a non-standard port
dig -f queries.txt +short                     # batch mode: one query per line in the file
dig +qr example.com                           # print the query as sent; shows EDNS options and flags

delv example.com                      # "; fully validated", "; unsigned answer" or an explanation of the failure
delv +vtrace example.com              # every validation step: which key, which DS, which RRSIG
delv +rtrace example.com              # every query delv sent while resolving
delv @ns1.example.com +cdflag example.com   # fetch with checking disabled, still validate locally
delv -a /etc/trusted-key.key +root=. example.com   # alternate trust anchor file

example.com.        3600 IN SOA   ns1.example.com. hostmaster.example.com. 2026092401 7200 900 1209600 300
example.com.        3600 IN NS    ns1.example.com.
example.com.        3600 IN MX    10 mail.example.com.
example.com.        3600 IN TXT   "v=spf1 mx -all"
example.com.        3600 IN CAA   0 issue "letsencrypt.org"
example.com.        3600 IN HTTPS 1 . alpn="h2,h3"
www.example.com.     300 IN CNAME lb.example.net.
_sip._tcp.example.com. 3600 IN SRV 10 60 5060 sip.example.com.
10.2.0.192.in-addr.arpa. 3600 IN PTR api.example.com.

$ORIGIN example.com.
$TTL 3600
@       IN SOA  ns1 hostmaster (
                2026092401 ; serial
                7200       ; refresh
                900        ; retry
                1209600    ; expire
                300 )      ; negative-cache TTL
        IN NS   ns1
        IN NS   ns2
        IN MX   10 mail
ns1     IN A    192.0.2.53
ns2     IN A    198.51.100.53
mail    IN A    192.0.2.25
api  60 IN A    192.0.2.10
www     IN CNAME api

named-checkzone example.com /var/named/example.com.zone     # "OK" and the loaded serial, or the line that failed
named-checkconf -z /etc/named.conf                          # configuration syntax and every zone file
named-checkconf -p /etc/named.conf | less                   # the configuration with includes expanded and defaults applied
rndc reload example.com                                     # reload one zone after editing its file; rndc reload alone reloads all
rndc zonestatus example.com                                 # serial, type, next refresh and whether it is loaded
rndc retransfer example.com                                 # on a secondary: force a transfer regardless of serial

dig api.example.com +noall +answer                  # TTL remaining in your resolver's cache
dig +norecurse @ns1.example.com api.example.com     # the record and full TTL at the source
watch -n5 'dig +short @8.8.8.8 api.example.com'     # watch one public resolver pick up a change

nameserver 10.96.0.10
search my-namespace.svc.cluster.local svc.cluster.local cluster.local
options ndots:5

cat /etc/resolv.conf
resolvectl query api.example.com          # shows the link and whether the answer came from cache
resolvectl statistics                     # cache hits, misses and DNSSEC counters
resolvectl flush-caches                   # needs root or polkit authorisation

resolvectl status eth0                          # servers, search domains, DNSSEC and DNS-over-TLS state for one link
resolvectl query --type=MX example.com          # explicit type; disables search-domain logic
resolvectl query --cache=no api.example.com     # bypass the cache for this lookup
resolvectl query --validate=no api.example.com  # skip DNSSEC validation for this lookup
resolvectl service _sip._tcp example.com        # SRV lookup with the targets resolved
resolvectl dns eth0 192.0.2.53 2001:db8::53     # set servers for a link until the network manager changes them
resolvectl domain eth0 '~corp.example.com'      # routing domain: send only this suffix to eth0's servers
resolvectl default-route eth0 false             # stop this link from receiving unrelated queries
resolvectl revert eth0                          # drop the per-link overrides made with the commands above
resolvectl show-cache                           # dump cached records (needs root)
resolvectl log-level debug                      # verbose logs in journalctl -u systemd-resolved until reset to info

# /etc/systemd/resolved.conf.d/upstream.conf
[Resolve]
DNS=192.0.2.53#dns.example.com 2001:db8::53   # server with the name to verify for DNS-over-TLS
FallbackDNS=
DNSOverTLS=opportunistic                        # yes enforces it and fails closed
DNSSEC=allow-downgrade                          # yes fails closed on unsigned-looking answers
Domains=~.
Cache=yes

kubectl run -it --rm dnstest --image=nicolaka/netshoot --restart=Never -- dig api.my-namespace.svc.cluster.local
kubectl -n kube-system logs -l k8s-app=kube-dns --tail 50
kubectl -n kube-system get configmap coredns -o yaml
kubectl -n kube-system get endpointslice -l kubernetes.io/service-name=kube-dns

dig +dnssec api.example.com | grep -E 'RRSIG|flags:'   # ad in flags = validated by the resolver
dig +cdflag api.example.com                           # checking disabled: does it resolve without validation?
delv api.example.com                                  # validates locally and explains failures
dig DS example.com +short                             # delegation signer record at the parent

dig DNSKEY example.com +short | awk '$1 == 257'                    # the KSK(s), what the parent's DS must hash
dig DS example.com @a.gtld-servers.net +norecurse +short             # DS as published at the parent
dig +dnssec +multiline SOA example.com | grep -A1 RRSIG              # signature validity window: inception and expiration
dnssec-dsfromkey -2 Kexample.com.+013+12345.key                     # SHA-256 DS record to give the registrar, from the KSK file
dnssec-verify -o example.com /var/named/example.com.zone.signed      # verify a signed zone file offline before publishing
delv +vtrace example.com 2>&1 | grep -iE 'validat|bogus|insecure'    # where a broken chain breaks

view "internal" {
    match-clients { 192.0.2.0/24; 2001:db8::/32; localhost; };
    recursion yes;
    zone "example.com" { type primary; file "internal/example.com.zone"; };
};
view "external" {
    match-clients { any; };
    recursion no;
    zone "example.com" { type primary; file "external/example.com.zone"; };
};

server:
    local-zone: "corp.example.com." transparent
    local-data: "git.corp.example.com. IN A 192.0.2.40"
    local-data-ptr: "192.0.2.40 git.corp.example.com"
    private-domain: "corp.example.com."     # allow RFC 1918 answers from this domain despite rebinding protection
forward-zone:
    name: "example.internal."
    forward-addr: 192.0.2.53

# /etc/unbound/unbound.conf
server:
    interface: 0.0.0.0
    interface: ::0
    access-control: 192.0.2.0/24 allow
    access-control: 2001:db8::/32 allow      # everything not listed is refused
    auto-trust-anchor-file: "/var/lib/unbound/root.key"
    prefetch: yes                            # refresh popular records before they expire
    cache-min-ttl: 0                         # honour published TTLs; raising this serves stale data
    harden-dnssec-stripped: yes
    verbosity: 1
    log-queries: no                          # yes for a short diagnosis only; one line per query
remote-control:
    control-enable: yes
    control-interface: 127.0.0.1

unbound-checkconf                       # parse the config; run before every reload
sudo systemctl reload unbound           # or unbound-control reload, which also flushes the cache
unbound-control status                  # version, threads, uptime; exit code 3 if not running
unbound-control stats_noreset | grep -E 'total.num.(queries|cachehits|cachemiss)|num.answer.rcode'
unbound-control lookup api.example.com  # which nameservers unbound would ask, with their RTT
unbound-control flush_zone example.com  # drop everything at and below the name
unbound-control flush_negative          # drop cached NXDOMAIN, NODATA and SERVFAIL answers
unbound-control dump_cache > cache.txt  # full cache in text; load_cache reads the same format
unbound-control local_data 'test.example.com. IN A 192.0.2.99'   # runtime override, lost on restart
unbound-host -C /etc/unbound/unbound.conf -v api.example.com     # resolve with that config and print the security status

# /etc/named.conf
options {
    directory "/var/named";
    listen-on { 192.0.2.53; 127.0.0.1; };
    allow-query { 192.0.2.0/24; localhost; };
    allow-recursion { 192.0.2.0/24; localhost; };   # separate from allow-query; an open recursor is an amplifier
    recursion yes;
    dnssec-validation auto;                          # built-in root trust anchor, RFC 5011 tracked
};
zone "example.com" {
    type primary;
    file "example.com.zone";
    allow-transfer { 198.51.100.53; };               # secondaries only; set it explicitly rather than relying on the default
    notify yes;
};

named-checkconf -z && rndc reconfig      # reconfig loads new zones without reloading existing ones
rndc status                              # zones loaded, recursive clients, query logging state
rndc dumpdb -cache && less /var/named/data/cache_dump.db   # cache contents with remaining TTLs
rndc flushname api.example.com           # one name; rndc flushtree drops the subtree, rndc flush drops everything
rndc querylog                            # toggle per-query logging to the configured channel
rndc dnssec -status example.com          # key states under dnssec-policy
rndc sync -clean example.com             # write dynamic-update journal to the zone file

# Compare answers across public resolvers
for r in 1.1.1.1 8.8.8.8 9.9.9.9; do printf '%s: %s\n' "$r" "$(dig +short @"$r" api.example.com | tr '\n' ' ')"; done

# Common record types for a name
for t in A AAAA CNAME HTTPS MX TXT NS SOA CAA; do printf '%-6s %s\n' "$t" "$(dig +short "$t" example.com | tr '\n' ' ')"; done

# Serial on every authoritative server, to check zone transfer and replication
for ns in $(dig +short NS example.com); do printf '%s %s\n' "$ns" "$(dig +short SOA @"$ns" example.com | awk '{print $3}')"; done

# Reverse lookups for part of a subnet
for i in $(seq 1 20); do dig +short -x "192.0.2.$i" | sed "s/^/192.0.2.$i /"; done

# Resolve through one interface's resolver (systemd-resolved)
resolvectl query --interface=eth0 api.example.com

# Watch queries as they happen (systemd-resolved, needs root)
resolvectl monitor

# SPF and DMARC records
dig +short TXT example.com | grep -i spf; dig +short TXT _dmarc.example.com

# Which CAs may issue for this name
dig +short CAA example.com

# Time a lookup from inside a pod
kubectl run -it --rm t --image=nicolaka/netshoot --restart=Never -- sh -c 'time dig +short api.example.com'

# Watch a record change during a cutover
while :; do printf '%s %s\n' "$(date +%T)" "$(dig +short @1.1.1.1 api.example.com)"; sleep 5; done

# Serial and response time from every authoritative server in one command
dig +nssearch example.com

# Full delegation chain, only the last hop's answer and the servers consulted
dig +trace +nodnssec api.example.com | grep -E '^(api\.example\.com|;; Received)'

# Does the parent's NS set match the child's
diff <(dig +short NS example.com @a.gtld-servers.net +norecurse | sort) <(dig +short NS example.com @ns1.example.com +norecurse | sort)

# Does every glue record resolve to the address the parent publishes
for ns in $(dig +short NS example.com); do printf '%-24s %s\n' "$ns" "$(dig +short A "$ns" | tr '\n' ' ')"; done

# TTLs in human units for an answer with many records
dig +noall +answer +ttlunits example.com

# All records at the apex, whether ANY is honoured or not (RFC 8482 servers return a synthetic HINFO)
for t in SOA NS A AAAA MX TXT CAA HTTPS DNSKEY; do dig +noall +answer "$t" example.com; done

# RRSIG expiration dates for a name, oldest first
dig +dnssec +noall +answer example.com SOA | awk '$4 == "RRSIG" {print $9}' | sort

# Validate a zone from any host, without trusting the local resolver
delv +short example.com && echo validated

# Resolve over DNS-over-TLS and confirm the transport in the footer
dig +tls @1.1.1.1 example.com | grep -E 'SERVER|TLS'

# What a client in another network would be told (EDNS Client Subnet, geo-routed zones)
dig +short +subnet=198.51.100.0/24 @8.8.8.8 api.example.com

# Reproduce a truncation problem: small buffer, no EDNS, then confirm TCP works
dig +bufsize=512 +ignore DNSKEY example.com | grep flags; dig +tcp DNSKEY example.com | grep status

# Query a resolver on a non-standard port, IPv4 only, fail after 2 seconds
dig -4 -p 5353 +timeout=2 +tries=1 @127.0.0.1 api.example.com

# Batch resolve a file of names, one line each: name, then addresses
dig -f names.txt +short +identify

# Zone transfer, when your address is allowed: full zone as records
dig +tcp AXFR example.com @ns1.example.com | grep -v '^;'

# DS record to hand to the registrar, from the live KSK
dig +short DNSKEY example.com | awk '$1 == 257' | sed 's/^/example.com. IN DNSKEY /' | dnssec-dsfromkey -2 -f /dev/stdin example.com

# drill: chase signatures to the root and print the trust path
drill -S -k /var/lib/unbound/root.key example.com

# systemd-resolved: cache hit rate since the last reset
resolvectl statistics | grep -E 'Current Cache Size|Cache Hits|Cache Misses'

# systemd-resolved: which link answers a given domain
resolvectl status | awk '/^Link/ {link=$0} /DNS Domain/ {print link ": " $0}'

# systemd-resolved: JSON answer for scripting
resolvectl query --json=short api.example.com | jq -r '.answer[].rr.a.address // empty'

# What resolves this host, ordered as applications use it
grep -E '^hosts:' /etc/nsswitch.conf; ls -l /etc/resolv.conf; grep -E '^(nameserver|search|options)' /etc/resolv.conf

# unbound: top cache misses by name, from a short query-log sample
unbound-control stats_noreset | grep -E 'num\.(queries|cachehits|cachemiss)'

# unbound: which servers it would ask for a name, with RTTs
unbound-control lookup api.example.com

# BIND: dump the cache and list what it holds for one zone
rndc dumpdb -cache && grep -A2 'example.com' /var/named/data/cache_dump.db | head

# Reverse zone name for a prefix, for delegation and PTR work
arpaname 192.0.2.10 2001:db8::10

# Names in a CoreDNS log that hit search-domain expansion (queries ending in the cluster suffix for external names)
kubectl -n kube-system logs -l k8s-app=kube-dns --tail 2000 | grep -oE '[a-z0-9.-]+\.com\.[a-z-]+\.svc\.cluster\.local\.' | sort | uniq -c | sort -rn | head

# Measure lookup latency through the local resolver, 20 samples
for i in $(seq 20); do dig api.example.com | awk '/Query time/ {print $4}'; done | sort -n | awk '{a[NR]=$1} END {print "min", a[1], "median", a[int(NR/2)+1], "max", a[NR]}'

# Which pods override cluster DNS with their own dnsPolicy or dnsConfig
kubectl get pods -A -o json | jq -r '.items[] | select(.spec.dnsPolicy != "ClusterFirst" or .spec.dnsConfig != null) | "\(.metadata.namespace)/\(.metadata.name) \(.spec.dnsPolicy)"'

#!/usr/bin/env bash
# Usage: zone-consistency.sh example.com
set -euo pipefail
zone=${1:?zone required}
mapfile -t parent_ns < <(dig +short NS "$zone" | sort)
(( ${#parent_ns[@]} > 0 )) || { printf 'no NS records for %s\n' "$zone" >&2; exit 1; }
declare -A serial
rc=0
for ns in "${parent_ns[@]}"; do
  out=$(dig +norecurse +time=3 +tries=1 SOA "$zone" @"$ns" 2>&1) || { printf '%-28s unreachable\n' "$ns"; rc=1; continue; }
  if ! grep -q 'flags:.* aa' <<<"$out"; then printf '%-28s not authoritative (lame)\n' "$ns"; rc=1; continue; fi
  s=$(awk -v z="$zone." '$1 == z && $4 == "SOA" {print $7}' <<<"$out")
  serial[$ns]=$s
  printf '%-28s serial %s\n' "$ns" "$s"
done
distinct=$(printf '%s\n' "${serial[@]}" | sort -u | wc -l)
if (( distinct > 1 )); then printf 'serials disagree across %d servers\n' "${#serial[@]}" >&2; rc=1; fi
child_ns=$(dig +short +norecurse NS "$zone" @"${parent_ns[0]}" | sort)
if [[ "$child_ns" != "$(printf '%s\n' "${parent_ns[@]}")" ]]; then printf 'NS set at parent differs from NS set in zone\n' >&2; rc=1; fi
exit "$rc"

#!/usr/bin/env bash
# Usage: dnssec-expiry.sh 7 example.com example.net
set -euo pipefail
days=${1:?days required}; shift
now=$(date +%s); rc=0
for zone in "$@"; do
  exp=$(dig +dnssec +noall +answer SOA "$zone" | awk '$4 == "RRSIG" {print $9}' | sort | head -1)
  if [[ -z "$exp" ]]; then printf '%-24s unsigned or RRSIG not returned\n' "$zone"; continue; fi
  exp_epoch=$(date -u -d "${exp:0:8} ${exp:8:2}:${exp:10:2}:${exp:12:2}" +%s)   # RRSIG time is YYYYMMDDHHmmss UTC
  left=$(( (exp_epoch - now) / 86400 ))
  status=ok; (( left < days )) && { status=EXPIRING; rc=1; }
  ds_parent=$(dig +short DS "$zone" | awk '{print $1}' | sort -u | tr '\n' ' ')
  ds_zone=$(dig +short DNSKEY "$zone" | awk '$1 == 257' | sed "s/^/$zone. IN DNSKEY /" | dnssec-dsfromkey -2 -f /dev/stdin "$zone" 2>/dev/null | awk '{print $4}' | sort -u | tr '\n' ' ')
  match=match
  for tag in $ds_parent; do [[ " $ds_zone " == *" $tag "* ]] || { match=MISMATCH; rc=1; }; done
  printf '%-24s %s signatures expire in %3d days; DS %s (parent tags: %s)\n' "$zone" "$status" "$left" "$match" "${ds_parent:-none}"
done
exit "$rc"

#!/usr/bin/env python3
"""Usage: resolve-layers.py api.example.com"""
import socket, subprocess, sys

name = sys.argv[1]

def dig(*args):
    out = subprocess.run(["dig", "+short", "+time=2", "+tries=1", *args, name], capture_output=True, text=True, timeout=10)
    return " ".join(out.stdout.split()) or f"(none, rc={out.returncode})"

try:
    nss = sorted({r[4][0] for r in socket.getaddrinfo(name, None)})
except socket.gaierror as e:
    nss = [f"gaierror: {e}"]
print(f"{'getaddrinfo (NSS)':<28} {' '.join(nss)}")
print(f"{'stub resolver (dig)':<28} {dig()}")
with open("/etc/resolv.conf") as f:
    servers = [l.split()[1] for l in f if l.startswith("nameserver")]
if "127.0.0.53" in servers:
    r = subprocess.run(["resolvectl", "status"], capture_output=True, text=True, timeout=10)
    servers = [w for line in r.stdout.splitlines() if "DNS Servers:" in line for w in line.split(":", 1)[1].split()]
for s in servers:
    print(f"{'upstream ' + s:<28} {dig('@' + s)}")
for s in ("1.1.1.1", "8.8.8.8"):
    print(f"{'public ' + s:<28} {dig('@' + s)}")
print(f"{'authoritative':<28} {dig('+norecurse', '@' + (dig('NS').split() or ['.'])[0])}")