DE

↑ ↓ select, Enter open, Esc close

Trace DNS delegation from the root zone

harmlessDNSdebian, ubuntu
Adjust the values, the command updates live
user@server
dig +trace example.com

Queries the root servers, the TLD nameservers and finally the domain’s authoritative nameservers one after another. This shows whether the delegation at the registrar is correct and where resolution fails. Typical after domain transfers, when the new nameservers are not yet registered with the registry.

Also searched as

  • domain does not resolve
  • check nameservers at registrar
  • dns resolution step by step

Related one-liners

All in DNS

Check a domain's DKIM key in DNS

$dig +short default._domainkey.example.com TXT
harmlessDNS

Check DNS propagation across public resolvers

$for ns in 1.1.1.1 8.8.8.8 9.9.9.9 208.67.222.222; do echo "$ns: $(dig +short @$ns example.com A | tr '\n' ' ')"; done
harmlessDNS

Check if a server IP is on the Spamhaus blacklist

$dig +short $(echo 203.0.113.10 | awk -F. '{print $4"."$3"."$2"."$1}').zen.spamhaus.org
harmlessDNS

Check the CAA record of a domain

$dig +short example.com CAA
harmlessDNS

Check whether DNSSEC works for a domain

$dig @1.1.1.1 +dnssec example.com SOA | grep -E "flags:|RRSIG|status:"
harmlessDNS

Compare the SOA serial on all nameservers

$for ns in $(dig +short example.com NS); do echo "$ns $(dig +short @$ns example.com SOA | awk '{print $3}')"; done
harmlessDNS

Read first, then run.

The commands on myline.de act directly on servers, files and databases. A wrong path or placeholder can delete data irreversibly or make a server unreachable.

  • All commands are provided without warranty and are not tested on every system.
  • Understand what a command does before running it, and check every placeholder.
  • Make a backup first and, if possible, try it on a test system.
  • You run commands at your own risk. Liability for damages is excluded to the extent permitted by law.