KDIG(1)

NAME
kdig - Advanced DNS lookup utility

SYNOPSIS

kdig [common-settings] [query [settings]]...

kdig -h

DESCRIPTION

This utility sends one or more DNS queries to a nameserver. Each query can have individual settings, or it can be specified globally via common-settings, which must precede query specification.

  Parameters

query
    name | -q name | -x address | -G tapfile

common-settings, settings
    [query_class] [query_type] [@server]... [options]

name
    Is a domain name that is to be looked up.

server
    Is a domain name or an IPv4 or IPv6 address of the nameserver to send a query to. An additional port can be specified using address:port ([address]:port for IPv6 address), address@port, or address#port notation. If no server is specified, the servers from /etc/resolv.conf are used.

    If no arguments are provided, kdig sends NS query for the root zone.

  Query classes

A query_class can be either a DNS class name (IN, CH) or generic class specification CLASSXXXXX where XXXXX is a corresponding decimal class number. The default query class is IN.

  Query types

A query_type can be either a DNS resource record type (A, AAAA, NS, SOA, DNSKEY, ANY, etc.) or one of the following:

TYPEXXXXX
    Generic query type specification where XXXXX is a corresponding decimal type number.

AXFR
    Full zone transfer request.

IXFR=serial
    Incremental zone transfer request for specified starting SOA serial number.

NOTIFY=serial
    Notify message with a SOA serial hint specified.

NOTIFY
    Notify message with a SOA serial hint unspecified.

    The default query type is A.

  Options

-4  Use the IPv4 protocol only.

-6  Use the IPv6 protocol only.

-b address
    Set the source IP address of the query to address. The address must be a valid address for local interface or :: or 0.0.0.0. An optional port can be specified in the same format as the server value.

-c class
    An explicit query_class specification. See possible values above.

-d  Enable debug messages.

-h, --help
    Print the program help.

-k keyfile
    Use the TSIG key stored in a file keyfile to authenticate the request. The file must contain the key in the same format as accepted by the -y option.

-p port
    Set the nameserver port number or service name to send a query to. The default port is 53.

-q name
    Set the query name. An explicit variant of name specification.

-t type
    An explicit query_type specification. See possible values above.

-V, --version
    Print the program version.

-x address
    Send a reverse (PTR) query for IPv4 or IPv6 address. The correct name, class and type is set automatically.

-y [alg:]name:key
    Use the TSIG key named name to authenticate the request. The alg part specifies the algorithm (the default is hmac-sha256) and key specifies the shared secret encoded in Base64.

-E tapfile
    Export a dnstap trace of the query and response messages received to the file tapfile.

-G tapfile
    Generate message output from a previously saved dnstap file tapfile.

+[no]multiline
    Wrap long records to more lines and improve human readability.

+[no]short
    Show record data only.

+[no]generic
    Use the generic representation format when printing resource record types and data.

+[no]crypto
    Display the DNSSEC keys and signatures values in hexdump, instead of omitting them.

+[no]aaflag
    Set the AA flag.

+[no]tcflag
    Set the TC flag.

+[no]rdflag
    Set the RD flag.

+[no]recurse
    Same as +[no]rdflag

+[no]raflag
    Set the RA flag.

+[no]zflag
    Set the zero flag bit.

+[no]adflag
    Set the AD flag.

+[no]cdflag
    Set the CD flag.

+[no]dnssec
    Set the DO flag.

+[no]all
    Show all packet sections.

+[no]qr
    Show the query packet.

+[no]header
    Show the packet header.

+[no]opt
    Show the EDNS pseudosection.

+[no]question
    Show the question section.

+[no]answer
    Show the answer section.

+[no]authority
    Show the authority section.

+[no]additional
    Show the additional section.

+[no]tsig
    Show the TSIG pseudosection.

+[no]stats
    Show trailing packet statistics.

+[no]class
    Show the DNS class.

+[no]ttl
    Show the TTL value.

+[no]tcp
    Use the TCP protocol (default is UDP for standard query and TCP for AXFR/IXFR).

+[no]fastopen
    Use TCP Fast Open (default with TCP).

+[no]ignore
    Don't use TCP automatically if a truncated reply is received.

+[no]tls
    Use TLS with the Opportunistic privacy profile (RFC 7858#section-4.1).

+[no]tls-ca[=FILE]
    Use TLS with a certificate validation. Certification authority certificates are loaded from the specified PEM file (default is system certificate storage if no argument is provided). Can be specified multiple times. If the +tls-hostname option is not provided, the name of the target server (if specified) is used for strict authentication.

+[no]tls-pin=BASE64
    Use TLS with the Out-of-Band key-pinned privacy profile (RFC 7858#section-4.2). The PIN must be a Base64 encoded SHA-256 hash of the X.509 SubjectPublicKeyInfo. Can be specified multiple times.

+[no]tls-hostname=STR
    Use TLS with a remote server hostname check.

+[no]nsid
    Request the nameserver identifier (NSID).

+[no]bufsize=B
    Set EDNS buffer size in bytes (default is 512 bytes).

+[no]padding[=B]
    Use EDNS(0) padding option to pad queries, optionally to a specific size. The default is to pad queries with a sensible amount when using +tls, and not to pad at all when queries are sent without TLS. With no argument (i.e., just +padding) pad every query with a sensible amount regardless of the use of TLS. With +nopadding, never pad.

+[no]alignment[=B]
    Align the query to B-byte-block message using the EDNS(0) padding option (default is no or 128 if no argument is specified).

+[no]subnet=SUBN
    Set EDNS(0) client subnet SUBN=addr/prefix.

+[no]edns[=N]
    Use EDNS version (default is 0).

+[no]time=T
    Set the wait-for-reply interval in seconds (default is 5 seconds). This timeout applies to each query attempt.

+[no]retry=N
    Set the number (>=0) of UDP retries (default is 2). This doesn't apply to AXFR/IXFR.

+noidn
    Disable the IDN transformation to ASCII and vice versa. IDNA2003 support depends on libidn availability during project building!

NOTES

Options -k and -y can not be used simultaneously.

Dnssec-keygen keyfile format is not supported. Use keymgr(8) instead.

EXAMPLES

1.  Get A records for example.com:

    $ kdig example.com A

2.  Perform AXFR for zone example.com from the server 192.0.2.1:

    $ kdig example.com -t AXFR @192.0.2.1

3.  Get A records for example.com from 192.0.2.1 and reverse lookup for address 2001:DB8::1 from 192.0.2.2. Both using the TCP protocol:

    $ kdig +tcp example.com -t A @192.0.2.1 -x 2001:DB8::1 @192.0.2.2

4.  Get SOA record for example.com, use TLS, use system certificates, check for specified hostname, check for certificate pin, and print additional debug info:

    $ kdig -d @185.49.141.38 +tls-ca +tls-host=getdnsapi.net \
      +tls-pin=foxZRnIh9gZpWnl+zEiKa0EJ2rdCGroMWm02gaxSc9S= soa example.com

FILES

/etc/resolv.conf

SEE ALSO

khost(1), knsupdate(1), keymgr(8).

AUTHOR
CZ.NIC Labs <http://www.knot-dns.cz>

COPYRIGHT
Copyright 2010–2018, CZ.NIC, z.s.p.o.