What Does This dig Output Mean?

How the dig output explainer works

This tool looks for the parts of a dig response that change the diagnosis. It recognizes response codes such as NXDOMAIN, SERVFAIL, REFUSED, and NOERROR, then considers section counts, transport warnings, and flags such as aa, ra, and tc. It does not perform a new DNS query, so the result describes the exact response you collected from your network and chosen server.

Paste the complete response

Include the header, flags, question, answer, authority, additional, and server lines when they are available. A single status line can be misleading. For example, NOERROR with zero answers is different from NXDOMAIN, and an empty answer section can be a negative response or a referral depending on the authority section.

dig @resolver.example www.example.net A
dig @resolver.example www.example.net A +tcp
dig www.example.net A +trace

Record the ordinary query before adding +trace. Trace mode follows the delegation path itself and can therefore behave differently from the recursive resolver you were originally testing.

What the common flags tell you

• aa means the response is authoritative for the queried name.
• rd means the client requested recursion.
• ra means the server says recursion is available to this client.
• ad means the resolver reports that the answer validated under DNSSEC.
• tc means the response was truncated and should be retried over TCP.

What this tool does not do

It does not decide that every warning is an outage. Authoritative servers commonly decline recursion, and a warning about recursion can appear beside a perfectly valid authoritative answer. It also cannot see resolver logs, firewall policy, or authoritative zone data that is absent from the pasted output. Use the suggested commands to verify the likely stage before changing DNS records.