Keyboard shortcuts

Press ← or → to navigate between chapters

Press S or / to search in the book

Press ? to show this help

Press Esc to hide this help

Drill

drill is a DNS lookup tool from NLnet Labs’ ldns library, built as a dig replacement with DNSSEC support baked in. It behaves like dig and can also chase a DNSSEC signature chain from a record up to the root. When DNSSEC is actually broken, though, delv is the better tool: it does the validation itself and tells you which link failed.

Availability

PlatformHow to get it
Windows (Cygwin)not packaged for Cygwin; use dig / delv instead
Fedorasudo dnf install ldns-utils
Ubuntu / Debiansudo apt install ldnsutils

Examples

  • Basic lookup, dig-style:
drill www.google.com
drill @8.8.8.8 google.com TXT
  • Reverse lookup:
drill -x 8.8.8.8
  • Trace a name from the root servers down (like dig +trace):
drill -T www.google.com
  • Chase the DNSSEC signature chain from the record up to the root, printing every DNSKEY/DS link along the way (-D requests DNSSEC records, -S chases the chain):
drill -DS www.cdc.gov