cloudflare-dns.com/dns-query
over HTTPS. No software needed — runs entirely in your browser!
dig
output has a consistent structure across all record types. Once you learn to read one, you can read them all.
Click each section below to expand the annotated example.
dig devdunia.com (A record)status: NOERROR — the domain exists and DNS responded cleanly.
Other values: NXDOMAIN (domain doesn't exist), SERVFAIL (resolver problem), REFUSED (server declined).
qr = this is a Query Response,
rd = Recursion Desired (client asked for full recursion),
ra = Recursion Available (server supports it).
name TTL class type datadig devdunia.com MX (mail servers)aspmx.l.google.com) first,
falling back to priority 5 and 10 servers only if the primary is unreachable.
dig devdunia.com NS (nameservers)dig @ns1.exampleregistrar.com devdunia.com NS),
you'll see it populated with SOA records.
DNS has over 30 record types — here are the ones you'll encounter daily as a developer.
| Type | What it stores | Example use | dig command |
|---|---|---|---|
| A | IPv4 address (32-bit) | Map domain → IP (e.g. 185.199.108.153) | dig example.com A |
| AAAA | IPv6 address (128-bit) | Map domain → IPv6 (e.g. 2606:50c0::153) | dig example.com AAAA |
| CNAME | Canonical name alias | www → example.com, CDN aliases | dig www.example.com CNAME |
| MX | Mail server + priority | Email routing, Google Workspace setup | dig example.com MX |
| NS | Authoritative nameservers | Who controls DNS for this domain | dig example.com NS |
| TXT | Arbitrary text strings | SPF, DKIM, domain verification, DMARC | dig example.com TXT |
| SOA | Start of Authority metadata | Zone serial, refresh/retry times, admin email | dig example.com SOA |
| PTR | Reverse DNS (IP → hostname) | Spam filtering, server identity checks | dig -x 8.8.8.8 |
| SRV | Service location + port | VoIP, Minecraft, service discovery | dig _sip._tcp.example.com SRV |
| CAA | Allowed SSL/TLS CAs | Restrict which CAs can issue certs for domain | dig example.com CAA |
Click COPY on any card to copy the command to your clipboard.
Replace example.com with your domain.
+short — still shows TTL & type.-x flag handles the in-addr.arpa conversion automatically.ad flag in the response header to confirm validation.
When you type devdunia.com in your browser, up to 7 layers
of caching and delegation fire before you get the IP — all in under 50ms. Here's how:
Browser Cache — The browser checks its own DNS cache first.
If you visited devdunia.com recently and the TTL hasn't expired, you get the IP instantly.
Chrome: chrome://net-internals/#dns to inspect.
OS Cache — Cache miss? The OS checks its own resolver cache
(/etc/hosts on Linux/Mac, the hosts file on Windows, plus the system resolver cache).
This is why sudo dscacheutil -flushcache helps after a DNS change on Mac.
Recursive Resolver — Still no cached answer? The OS sends the query to your configured DNS resolver (e.g. 1.1.1.1, 8.8.8.8, or your ISP's resolver). This server does the heavy lifting — it's called "recursive" because it recurses through the DNS hierarchy on your behalf.
Root Nameservers — If the recursive resolver doesn't have the answer cached, it queries one of the 13 root nameserver clusters (a.root-servers.net → m.root-servers.net). The root servers don't know the IP — but they know who does: the TLD nameservers.
TLD Nameservers — The root server replies: "I don't know, but ask the
.com TLD nameservers." The resolver queries Verisign's
.com nameservers which respond with the domain's authoritative nameservers
(e.g. ns1.yourregistrar.com).
Authoritative Nameserver — The resolver now queries your domain's nameservers — the ones configured at your registrar (Cloudflare, Route 53, GoDaddy, etc.). These servers hold the actual DNS zone file and return the definitive answer.
Answer Returned & Cached — The IP is returned all the way back up the chain. The recursive resolver caches the answer for the record's TTL, so future queries skip steps 4–6. Your browser renders the page. Total time: ~10–50ms for a cached answer, ~100–400ms for a cold recursive lookup.
dig +trace devdunia.com
in your terminal to watch the full delegation chain live — root servers, TLD servers, and
the authoritative answer, all in one command.
Seconds a record may be cached. Low TTL = faster propagation when you change records, but more DNS queries. Set TTL low before migration, raise it after.
When you update a DNS record, old resolvers keep serving the cached version until TTL expires. "Propagation" just means waiting for caches worldwide to expire.
DNS Security Extensions add cryptographic signatures to records, preventing cache poisoning attacks. Look for the ad (Authenticated Data) flag in dig output.
DNS-over-HTTPS and DNS-over-TLS encrypt DNS queries so your ISP can't see what domains you're visiting. This tool uses Cloudflare DoH for all live lookups!