12. Domains and DNS: GoDaddy, Elastic IP, A/CNAME and Subdomains
12.6 Verifying DNS with dig, nslookup and curl
dig example.com +short # A record → 203.0.113.10
dig www.example.com +short # CNAME chain → example.com. → 203.0.113.10
dig example.com # full answer incl. TTL countdown
dig @8.8.8.8 example.com +short # ask Google's public resolver
dig @1.1.1.1 example.com +short # ask Cloudflare's resolver
dig NS example.com +short # which name servers are authoritative?
dig MX example.com +short # mail records
dig +trace example.com # follow root → TLD → authoritative
nslookup example.com # works on Windows, macOS and Linux
host example.com # short output (Linux)
curl -I http://example.com # DNS + web server together
dig comes from bind-utils on Amazon Linux/CentOS (sudo yum install -y bind-utils) and dnsutils on Ubuntu (sudo apt install -y dnsutils).
Reading dig output:
;; ANSWER SECTION:
example.com. 587 IN A 203.0.113.10
name TTL(s) class type value
Flush stale caches on your laptop if the server already shows the new IP but your browser still doesn't:
| OS | Command |
|---|---|
| Windows | ipconfig /flushdns |
| macOS | sudo dscacheutil -flushcache; sudo killall -HUP mDNSResponder |
| Linux (systemd-resolved) | resolvectl flush-caches |
| Chrome browser | open chrome://net-internals/#dns → Clear host cache |
Why this matters for security
The same dig commands are reconnaissance tools. dig +trace shows the delegation chain; dig TXT reveals SPF and verification records; testing curl -H "Host: ..." against an IP is how testers find virtual hosts that are not in public DNS.
Ravindra Bagale's Tip
Domain "chalat nahi" tevha problem don bhagat vaata: dig yourdomain.com +short DNS barobar aahe ka sangto, aani curl -I http://<EIP> -H "Host: yourdomain.com" web server barobar aahe ka sangto. Donhi barobar asel tar fakt laptop cha cache – thamba kiwa flush kara.
Practice task
Query your domain through 8.8.8.8 and 1.1.1.1, follow it with dig +trace, and flush your laptop's DNS cache.