# Working of DNS Resolution

## What is DNS and why name resolution exists

### DNS →

Domain name server works like a phonebook, which translate from contact name to contact number.

**Analogy** :

| Person → | ***Domain Name*** |
| --- | --- |
| Contact No. → | ***IP Address*** |

### **DNS resolution / DNS Lookup →**

Resolution stands for resolving problem, and the problem with IP Addresses is the lengthy no. which is hard to understand by human for every single website. So DNS works as a phonebook and the process of resolving domain name into machine readable IP address is what we call DNS resolution.

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1769021143504/1f06dfb1-a58d-455c-87fe-9439993897f5.png align="center")

## What is the `dig` command and when it is used

So basically `dig` **(domain information groper)** is a **diagnostic tool** to inspect DNS resolution, making it very essential tool for network administrators, developers and security professionals. There is another tool as well named `nslookup` **(name server lookup),** `dig` command having superior troubleshooting capabilities, detailed output, and accuracy.

**General SYNTAX :** `dig [server] [name] [type]`

`dig` returns one or multiple different sections about the Hostname’s DNS records depending on the command’s syntax. Below is the example of `dig example.com`

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1768995458408/4a0026b7-6883-4ff0-bccb-3b2b36d5cb94.png align="center")

Usually most sections which are commonly need to understand:

1. Question section : What you asked (e.g. google.com IN A)
    
2. Answer section : The final data you wanted (IP Address)
    
3. Authority section: The servers that are in charge of the domain you queried.
    

### **Common commands :**

1. **A record detail :**
    

<table><tbody><tr><td colspan="1" rowspan="1"><p><code>dig &lt;hostname&gt;</code></p></td><td colspan="1" rowspan="1"><p><code>dig</code><a target="_self" rel="noopener noreferrer nofollow" href="http://example.com" style="pointer-events: none"><code>google.com</code></a></p></td><td colspan="1" rowspan="1"><p>Returns the A records found at a hostname.</p></td></tr></tbody></table>

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1768993518975/eeb2dc5a-6bcd-4155-bcc3-9489f9d3b78c.png align="center")

---

2. **All records :**
    

<table><tbody><tr><td colspan="1" rowspan="1"><p><code>dig &lt;hostname&gt; any</code></p></td><td colspan="1" rowspan="1"><p><code>dig</code><a target="_self" rel="noopener noreferrer nofollow" href="http://example.com" style="pointer-events: none"><code>google.com</code></a><code> any</code></p></td><td colspan="1" rowspan="1"><p>Returns all records for a hostname, including NS and SOA records.</p></td></tr></tbody></table>

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1768988825544/f2779eaf-e0c3-4e27-b89b-087efdf93d5a.png align="center")

---

3. **With respect to record type :**
    

<table><tbody><tr><td colspan="1" rowspan="1"><p><code>dig @&lt;name server address&gt; &lt;hostname&gt; &lt;record type&gt;</code></p></td><td colspan="1" rowspan="1"><p><code>dig @ns1.google.com </code><a target="_self" rel="noopener noreferrer nofollow" href="http://example.com" style="pointer-events: none"><code>google.com</code></a><code> MX</code></p></td><td colspan="1" rowspan="1"><p>Queries a hostname’s name server directly instead of your ISP’s resolver. Include the record type parameter to retrieve records of a specific type at a hostname.</p></td></tr></tbody></table>

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1768995657266/6f1c7f5c-9ef3-4afa-8004-035c71dd0c89.png align="center")

---

4. **Return IP Address → A record :**
    

<table><tbody><tr><td colspan="1" rowspan="1"><p><code>dig &lt;hostname&gt; +short</code></p></td><td colspan="1" rowspan="1"><p><code>dig </code><a target="_self" rel="noopener noreferrer nofollow" href="http://example.com" style="pointer-events: none"><code>example.com</code></a><code> +short</code></p></td><td colspan="1" rowspan="1"><p>Only returns the IP addresses for all A records at a hostname.</p></td></tr></tbody></table>

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1768993626195/103704ae-0d29-4b1d-8444-352dfa754b58.png align="center")

---

5. **Tracing all servers :**
    

<table><tbody><tr><td colspan="1" rowspan="1"><p><code>dig &lt;hostname&gt; +trace</code></p></td><td colspan="1" rowspan="1"><p><code>dig </code><a target="_self" rel="noopener noreferrer nofollow" href="http://example.com" style="pointer-events: none"><code>example.com</code></a><code> +trace</code></p></td><td colspan="1" rowspan="1"><p>Adding <code>+trace</code> instructs dig to resolve the query from the root name server and return information from each server queried in the delegation chain.</p></td></tr></tbody></table>

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1768993789735/e12175ae-855e-4065-875c-ddaadbbf976e.png align="center")

---

## Understanding `dig google.com` and the full DNS resolution flow

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1769060513167/dc3cd633-1236-4e1c-8f78-00c266b424d6.png align="center")

1. **The Root Servers :** `dig . NS`  
    Finding all the root nameservers so they don’t know where google.com is available but they do know the location of ***.com* TLD (Top lever domain) server.**
    
    ![](https://cdn.hashnode.com/res/hashnode/image/upload/v1769014102057/58dfdd35-19b6-486e-9355-de293344b61e.png align="center")
    
2. **The TLD Servers :** `dig com NS`  
    This command gives the ***.com*** TLD servers
    
    ![](https://cdn.hashnode.com/res/hashnode/image/upload/v1769016618728/62b54101-93c2-4e09-8036-943c65ed2ef1.png align="center")
    
    From there, we can specifically ask one of the root nameserver that  
    **who handles *.com*** → `dig @a.root-servers.net google.com NS` (e.g. **a.gtld-servers.net**)
    
    ![](https://cdn.hashnode.com/res/hashnode/image/upload/v1769018092074/b091ee8c-e91a-4ac9-9f54-f1898af0728c.png align="center")
    
3. **The Authoritative Servers :** `dig google.com NS`  
    It will direct all the Google’s own Authoritative servers associated with google.com.
    
    ![](https://cdn.hashnode.com/res/hashnode/image/upload/v1769018611362/ec15c60f-fbd9-4336-ad62-7baca2027cc8.png align="center")
    
    From there, TLD server can redirect which of the authoritative servers are there associated with google.com → `dig @a.gtld-servers.net google.com NS` (e.g. **ns1.google.com :** these servers are final source of truth where google.com can be translated into IP address.)
    
    ![](https://cdn.hashnode.com/res/hashnode/image/upload/v1769018879348/2674b3de-5e4b-483b-abc2-6365dec4c179.png align="center")
    
4. The Final IP Address : `dig google.com`  
    Here you can finally translate through that what’s the IP address ( **A record** ) associated with google.com.
    
    ![](https://cdn.hashnode.com/res/hashnode/image/upload/v1769019344203/01fbccc6-767c-4113-b647-86539d69c0cb.png align="center")
    
    As well, we can ask specifically from the authoritative the same through command → `dig @ns1-servers.net google.com` ( e.g. **IP address → 142.250.193.70**)
    
    ![](https://cdn.hashnode.com/res/hashnode/image/upload/v1769019535882/e7ca6409-0c67-45ef-bded-6d630230b9b5.png align="center")
    

---

## DNS Resolution Flow with `+trace`

By using command : `dig google.com +trace` you can track all servers from root nameserver to IP Address.

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1769020166714/9d59818b-b4ac-437d-897d-1bd02899194a.png align="center")