Skip to content
SendPoint / Education
CLI and terminal

DNS commands: dig and nslookup

Inspect real DNS records and distinguish DNS visibility from authentication success.

SendPoint referenceUpdated 2 min read

Before running commands

These are Bash snippets for your own terminal with BIND dig or nslookup installed. Enter the actual domain at each prompt. They query DNS and make no changes. The website does not run the commands or collect the values.

Query mail records

dig

Bash
read -r -p "Actual DNS domain: " dns_domain
dig MX "$dns_domain" +noall +answer
dig TXT "$dns_domain" +noall +answer
dig TXT "_dmarc.$dns_domain" +noall +answer

nslookup

Bash
read -r -p "Actual DNS domain: " dns_domain
nslookup -type=MX "$dns_domain"
nslookup -type=TXT "$dns_domain"
nslookup -type=TXT "_dmarc.$dns_domain"

Check reverse and forward DNS

Bash
read -r -p "Actual sending IP: " sending_ip
dig -x "$sending_ip" +noall +answer
read -r -p "Hostname returned by PTR: " ptr_hostname
dig A "$ptr_hostname" +noall +answer
dig AAAA "$ptr_hostname" +noall +answer

Compare the resulting A or AAAA data with the original connecting IP. Reverse DNS is usually controlled by the IP provider. An unrelated website address is not a substitute for the sending address.

Compare authoritative data

Bash
read -r -p "Actual record name: " record_name
read -r -p "Authoritative nameserver hostname: " authoritative_ns
dig @"$authoritative_ns" TXT "$record_name" +noall +answer

Query a nameserver authoritative for the relevant zone. A recursive cache can retain earlier data until its TTL expires. An empty answer needs further inspection of response status and authority data; it does not by itself prove that a zone is missing.

Interpret the limits

  • A DNS lookup does not evaluate the complete SPF policy.
  • A visible DKIM key does not prove a message was signed correctly.
  • A DMARC TXT record does not prove a production message aligns.
  • Use the real DKIM selector and receiver headers for message-level verification.

Next steps

Sources