DNS Debugging Tools

dig, nslookup, host, /etc/resolv.conf, /etc/nsswitch.conf, and systemd-resolved.

Overview

Overview DNS debugging is a critical skill — many service failures are ultimately DNS failures. The tools and configuration files involved form a layered system.

dig (Domain Information Groper): The preferred DNS debugging tool for its structured, unambiguous output. dig @server name type queries a specific nameserver. Without @server, uses the system resolver from /etc/resolv.conf. Common types: A (IPv4), AAAA (IPv6), CNAME (canonical name), MX (mail), TXT (text records, SPF/DKIM/verification), NS (nameservers), SOA (Start of Authority), PTR (reverse DNS). Key options: +short (just the answer), +trace (full delegation from root servers), +norecurse (non-recursive query), +time=2 (short timeout).

Reading dig output: QUESTION SECTION shows what was asked. ANSWER SECTION shows the records. AUTHORITY SECTION shows the authoritative nameservers for the domain. ADDITIONAL SECTION shows IP addresses for nameservers. ;; MSG SIZE shows query/response sizes. The TTL in the ANSWER shows how long the answer is cached.

/etc/resolv.conf: The system DNS configuration. nameserver IP specifies DNS servers (up to 3). search domain1 domain2 appends these domains to unqualified names (myservice resolves as myservice.domain1, then myservice.domain2). options ndots:5 means names with fewer than 5 dots get the search domains appended first (Kubernetes sets this to cause issues with external DNS).

/etc/nsswitch.conf: Controls the order of name resolution mechanisms. The hosts line: files dns — means check /etc/hosts first, then DNS. With just dns, /etc/hosts is ignored. compat includes NIS.

systemd-resolved: A caching stub resolver at 127.0.0.53. Modern Ubuntu/Debian use it by default. /etc/resolv.conf is a symlink to /run/systemd/resolve/stub-resolv.conf. resolvectl status shows configuration per interface. resolvectl query hostname shows resolution path. Flush cache: resolvectl flush-caches.

Key concepts

dig @server type
dig @8.8.8.8 example.com A — query specific nameserver. +short for just the answer. +trace to follow delegation from root. dig MX domain for mail records.
+trace for delegation chain
dig +trace example.com follows the entire resolution path: root servers → TLD nameservers → authoritative nameservers. Shows exactly where delegation happens.
/etc/resolv.conf search
search domain1 domain2 appends domains to short names. options ndots:N controls threshold. In Kubernetes, ndots:5 causes 5 DNS lookups before trying the bare name.
systemd-resolved stub
Caching stub resolver at 127.0.0.53. resolvectl status shows per-interface DNS. resolvectl flush-caches clears stale entries. /etc/resolv.conf → symlink to stub-resolv.conf.

When to use it

  • Diagnosing DNS resolution failures in applications
  • Verifying DNS propagation after DNS record changes
  • Debugging Kubernetes pod DNS resolution issues
  • Understanding split-horizon DNS and resolver configuration

Interview questions

  • How would you trace a complete DNS resolution from root servers to final answer using dig?
  • A Kubernetes pod can't resolve external DNS. Walk through your debugging process.

Sign up free to read the full topic

More Linux topics

Start free on Cariara · Coding problems · System design studio