DNS Resolution with `dig` and `nslookup`

1. What is DNS? The Internet's Phonebook

At its core, DNS is a globally distributed database that maps human-friendly domain names to the IP addresses that network equipment needs to locate services. It's a hierarchical and decentralized system.

Before we use the tools, it's essential to understand a few key concepts: DNS server types and record types. This will help you make sense of the information you get back from your queries.

To summarize the most critical record types from that reading:

• A: Maps a hostname to an IPv4 address.
• AAAA: Maps a hostname to an IPv6 address.
• MX: Mail Exchanger; specifies the mail servers for a domain.
• CNAME: Canonical Name; an alias that points one name to another.
• NS: Name Server; lists the authoritative DNS servers for a domain.
• TXT: Text record; used for various purposes, including domain ownership verification and email security policies.

2. nslookup: The Quick-Check Tool

nslookup (Name Server Lookup) is a classic command-line tool available on nearly all operating systems. It's great for quick, simple DNS queries.

Basic Usage

To find the IP address for a domain, simply provide the domain name as an argument:

nslookup google.com

The output shows you which DNS server answered your request and then provides the "Non-authoritative answer," which includes the IP address(es) for the domain. A "non-authoritative" answer means your resolver got the information from its cache, not by asking the domain's authoritative server directly.

Interactive Mode & Specific Records

nslookup can also be used in an interactive mode, which is useful for making multiple queries. Just type nslookup and hit enter. From there, you can set the query type to look for specific records.

Let's see this in action. The following video demonstrates basic nslookup usage and how to query for MX (mail server) and NS (name server) records.

While nslookup is handy, most system administrators and security professionals prefer a more powerful tool: dig.

3. dig: The Power User's Tool

dig (Domain Information Groper) is the preferred tool for DNS queries because its output is more detailed, better structured, and more easily scriptable. As an Arch user, you'll appreciate the level of detail and control it provides.

First, ensure you have it installed. It's part of the dnsutils package on Arch Linux (and Debian/Ubuntu).

sudo pacman -S dnsutils

Basic Usage and Understanding the Output

Let's run the same basic query as before:

dig google.com

The output is verbose but very informative. Let's break it down:

• QUESTION SECTION: Shows exactly what you asked for (in this case, an A record for google.com).
• ANSWER SECTION: This is the result. It gives you the domain, the record's TTL (Time-To-Live) in seconds, the record class (IN for Internet), the record type (A), and the IP address.
• AUTHORITY SECTION: Shows the authoritative Name Servers (NS) for the domain.
• ADDITIONAL SECTION: Provides extra information, often the IP addresses of the name servers listed in the authority section.
• Statistics: At the bottom, you get metadata about the query, including how long it took and which server answered it.

Querying for Specific Record Types

With dig, you specify the record type at the end of the command. This is more direct than the interactive mode of nslookup.

• dig google.com MX (Mail servers)
• dig archlinux.org NS (Name servers)
• dig google.com AAAA (IPv6 addresses)

This video provides a great walkthrough of using dig for these common record types.

Advanced dig Usage for Efficiency and Troubleshooting

Two options make dig incredibly powerful for practical work.

1. +short: Trimming the Fat
   The full dig output is great for analysis but terrible for scripting. The +short option gives you only the answer, which is perfect for command pipelines.

   
   
   
   # Get just the IP addresses for archlinux.org
   dig archlinux.org +short
   
   
   
   
   # Get just the mail server hostnames
   dig gmail.com MX +short
   

2. @server: Choosing Your Resolver
   Sometimes, you need to check what a specific DNS server thinks. This is essential for troubleshooting issues where your local ISP's DNS might be slow or returning incorrect results. You can tell dig which server to ask by using the @ symbol. Common public resolvers are Google's 8.8.8.8 and Cloudflare's 1.1.1.1.

   
   
   
   # Ask Google's DNS server for the IP of cloudflare.com
   dig @8.8.8.8 cloudflare.com
   

The next video gives excellent demonstrations of these practical options.

4. Hands-On Investigation

Time to put this theory into practice in your terminal.

Activity 1: nslookup vs. dig

1. Run nslookup archlinux.org.
2. Run dig archlinux.org.
3. Compare the outputs. Note the extra detail dig provides, like the TTL and the Authority section.

Activity 2: DNS Record Hunting
Use dig to answer the following questions.

1. What are the IPv4 addresses for github.com? (A record)
2. What are the name servers for debian.org? (NS record)
3. What are the mail servers for protonmail.com? (MX record) Note the numbers before the hostnames—these are priorities. The lower the number, the higher the priority.
4. Does www.gnu.org have an IPv6 address? (AAAA record)

Activity 3: Reconnaissance Practice
In ethical hacking, finding subdomains is a common task. Sometimes, a CNAME record can point to an interesting service.

1. Run dig CNAME www.archlinux.org. What do you see?
2. Now try dig CNAME mail.google.com. Notice it points to googlemail.l.google.com.. This is a canonical name, the "true" name behind the alias.

Activity 4: Troubleshooting and Scripting Prep

1. Query your default resolver for wikipedia.org: dig wikipedia.org +short
2. Now, query Cloudflare's resolver for the same domain: dig @1.1.1.1 wikipedia.org +short
   Are the IP addresses the same? Usually they will be, but during a DNS change, you might see different results from different servers.
3. Try this command pipeline: ping -c 3 $(dig +short google.com A | head -n 1)
   This command uses dig +short to get the list of IPs for google.com, head -n 1 to grab only the first one, and then passes it directly to ping. This shows how +short enables automation.

Conclusion

You've now added two fundamental DNS query tools to your toolkit. You can not only translate names to IP addresses but also interrogate the DNS system for a wealth of information about a domain's infrastructure.

Key Takeaways:

• DNS is the internet's directory service, mapping names to IP addresses.
• DNS records like A, AAAA, MX, NS, CNAME, and TXT store different types of information about a domain.
• nslookup is a simple, universal tool for quick lookups.
• dig is the more powerful tool, providing detailed, structured output that is preferred for serious analysis.
• The dig +short option provides clean output for scripting, while dig @server is essential for troubleshooting by querying specific DNS servers.

Next Lesson Preview:
So far, we've found a host's IP address and verified it's online. From a security perspective, the next question is: what is running on that host? In our next lesson, we will learn how to identify which processes are listening on network ports using ss and netstat. This is how you discover open doors—the running services—on a target machine.