dig +short apple.comPrint only the answer: apple.com's IPv4 addresses.
When to use it
Use dig when you need to see exactly what DNS returns: the records, their TTLs, which server answered and how long it took. It's the tool for checking DNS changes, debugging email records and comparing resolvers.
Steps
Get a quick answer
+short prints only the values, which is perfect for scripts and quick checks.dig +short apple.comLook up other record types
Put the type after the name: A, AAAA, MX, TXT, NS, CNAME, SOA, CAA.dig github.com TXT +shortAsk a specific resolver
Use @server to compare answers, for example after a DNS change.dig apple.com @8.8.8.8Reverse lookup
-x finds the host name for an IP address.dig -x 8.8.8.8 +shortFollow the delegation from the root
+trace queries the root, then .com, then the domain's own servers, showing each step. Useful when a domain's name servers are misconfigured.dig +trace apple.com
Output explained
; <<>> DiG 9.10.6 <<>> apple.com
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 56678
;; flags: qr rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 4, ADDITIONAL: 9
;; QUESTION SECTION:
;apple.com. IN A
;; ANSWER SECTION:
apple.com. 542 IN A 17.253.144.10
;; AUTHORITY SECTION:
apple.com. 16592 IN NS a.ns.apple.com.
;; Query time: 12 msec
;; SERVER: 192.168.1.1#53(192.168.1.1)
- status is the result: NOERROR (found), NXDOMAIN (doesn't exist), SERVFAIL (the resolver failed).
- flags: qr = this is a response, rd = recursion desired, ra = recursion available. aa appears when the answer is authoritative.
- ANSWER SECTION holds the records. The number after the name (542) is the remaining TTL in seconds.
- AUTHORITY SECTION lists the name servers responsible for the domain.
- Query time and SERVER tell you how fast and from which resolver the answer came.
Options and variations
| Flag | Meaning | Example |
|---|---|---|
| +short | Only the answer values | dig +short apple.com AAAA |
| @server | Query a specific DNS server | dig @9.9.9.9 apple.com |
| -x IP | Reverse lookup (PTR) | dig -x 1.1.1.1 |
| +trace | Follow delegation from the root servers | dig +trace example.com |
| +noall +answer | Show only the answer section, with TTLs | dig +noall +answer apple.com |
| +tcp | Query over TCP instead of UDP | dig +tcp apple.com |
Common errors
| Error | Cause | Fix |
|---|---|---|
| ;; connection timed out; no servers could be reached | The DNS server didn't answer | Try @1.1.1.1; check network and DNS settings. |
| status: SERVFAIL | The resolver couldn't complete the lookup (often DNSSEC) | Try +cd to skip DNSSEC validation and compare; fix the domain's DNSSEC. |
| Empty ANSWER section with NOERROR | The name exists but has no record of that type | Try another type (A vs AAAA vs CNAME). |
Do it in the app
LightAtom's connections view shows the domain and address of each connection your apps make, without running dig by hand.
Frequently asked questions
Is dig installed on a Mac?
Yes. macOS includes dig (version 9.10.6 on macOS 15), along with nslookup and host.
What is the difference between nslookup and dig?
dig prints the full DNS response, with TTLs, flags and every section, and is easier to script with +short. nslookup gives a simpler summary. Both query DNS the same way.
How do I see a record's TTL?
Run dig +noall +answer name. The number after the name is the TTL in seconds, counting down while the record sits in the resolver's cache.
How do I check if a DNS change has propagated?
Query several resolvers: dig +short name @1.1.1.1, @8.8.8.8 and @9.9.9.9. When they all return the new value, it's live for most users. The DNS propagation checker does this worldwide.