Dig Online
This free online dig tool sends a real DNS query from our server and shows the full reply the way the dig command does: the status, the flags and every section, plus the raw output you can copy.
Free, no signup.
What dig shows that a normal lookup doesn't
A simple DNS lookup gives you the answer. Dig gives you the whole reply: whether the server is authoritative for the name, whether the answer was checked with DNSSEC, and the AUTHORITY and ADDITIONAL sections that explain where an answer came from.
That's what you need when something doesn't add up, for example when one resolver already sees your new record and another still has the old one.
Asking your own nameserver
Pick "Your nameserver" and enter its name or IP address to ask it directly, with no resolver cache in between. Turn on +norecurse to see only what that server knows itself.
If it answers with the aa (authoritative answer) flag, the record really lives there. If it refuses or stays silent, the domain's delegation and the server's set-up don't match.
Reading the options
+dnssec asks for the signatures (RRSIG records) too. +tcp sends the question over TCP instead of UDP, which is how large answers travel. -4 and -6 choose whether we talk to the server over IPv4 or IPv6.
Type an IP address instead of a name and we look up its reverse DNS (PTR) record, like dig -x.
Frequently asked questions
Is this the real dig command?
It's our own implementation of the same DNS query, run from our server in Germany. The raw output follows dig's layout, so you can compare it with what dig prints on your own machine.
Why can't I run an ANY query?
Most servers no longer answer them properly: RFC 8482 lets them send a short reply instead. Ask for the record type you need, such as A, MX or TXT.
Can I run a zone transfer (AXFR)?
No. A zone transfer copies a whole zone and should only work for your own secondary nameservers, so we don't offer it.
What does the ad flag mean?
The resolver checked the DNSSEC signatures and they're valid. It only appears when the domain is signed and the resolver validates, as Cloudflare, Google and Quad9 do.
How often can I run a lookup?
Each visitor can run 10 lookups a minute and 60 an hour. Asking your own nameserver is also limited to 30 lookups an hour per server, so nobody can use the tool to flood one.
Do you store the lookups?
We keep an answered lookup for 60 seconds so repeat views are instant, and our server logs which name was looked up for 14 days so we can deal with abuse. We don't store your IP address, only a scrambled form of it.
Dig deeper
DNS Trace
Follow a lookup from the root servers down to the domain's own nameservers, step by step, like dig +trace.
Trace a domainDNS Checker
Look up any record type straight from public DNS, with the live answer and its TTL.
Look up DNSDNS Propagation Checker
Just changed a record? Ask 6 public resolvers at once and see side by side who already has the new answer.
Check propagation