| name | dns-tools |
| description | Resolve DNS records, check propagation, and debug name resolution. Use when you need to look up A/AAAA/MX/TXT records, verify DNS changes across resolvers, or query via encrypted DNS (DoT/DoH). |
| user-invocable | false |
| allowed-tools | Bash(dig *), Bash(nslookup *), Bash(host *), Bash(whois *), Read, Grep, Glob, TodoWrite |
| created | "2026-01-01T00:00:00.000Z" |
| modified | "2026-04-25T00:00:00.000Z" |
| reviewed | "2026-04-25T00:00:00.000Z" |
DNS Tools
When to Use This Skill
| Scenario | Use this skill | Alternative |
|---|
| Look up DNS records (A, MX, TXT, etc.) | Yes | |
| Check DNS propagation across resolvers | Yes | |
| Query via encrypted DNS (DoT/DoH) | Yes | |
| Verify email auth records (SPF/DKIM/DMARC) | Yes | |
| Reverse DNS lookup for an IP | Yes | |
| Troubleshoot connectivity or packet loss | | network-diagnostics (trippy, gping) |
| Find hosts or open ports on a network | | network-discovery (RustScan, nmap) |
| Discover devices on local L2 segment | | layer2-discovery (ARP/LLDP) |
| Load test an HTTP endpoint | | http-load-testing (oha) |
| Monitor real-time bandwidth per process | | network-monitoring (bandwhich) |
Core Expertise
dog is a modern, Rust-based DNS client that serves as a user-friendly alternative to dig. Key advantages:
- Readable output: Colorized, human-friendly formatting by default
- Modern protocols: Native support for DNS-over-TLS (DoT) and DNS-over-HTTPS (DoH)
- JSON output: Machine-parseable output for scripting and automation
- Fast: Compiled Rust binary with minimal dependencies
- Cross-platform: Works on Linux, macOS, and Windows
Installation
brew install dog
cargo install dog
pacman -S dog
Essential Commands
Basic Queries
dog example.com
dog example.com MX
dog example.com AAAA
dog example.com TXT
dog example.com A AAAA MX
dog example.com example.org
Specifying DNS Server
dog @8.8.8.8 example.com
dog @1.1.1.1 example.com MX
dog @/etc/resolv.conf example.com
Output Formats
dog --json example.com
dog --short example.com
dog -q example.com
DNS-over-TLS and DNS-over-HTTPS
Modern encrypted DNS protocols prevent eavesdropping and tampering.
DNS-over-TLS (DoT)
dog --tls @dns.google example.com
dog --tls @1.1.1.1 example.com
dog --tls @dns.quad9.net example.com
DNS-over-HTTPS (DoH)
dog --https @https://dns.google/dns-query example.com
dog --https @https://cloudflare-dns.com/dns-query example.com
dog --https @https://dns.quad9.net/dns-query example.com
Protocol Comparison
| Protocol | Flag | Port | Use Case |
|---|
| UDP | (default) | 53 | Standard queries |
| TCP | --tcp | 53 | Large responses, reliability |
| DoT | --tls | 853 | Encrypted, TLS-based |
| DoH | --https | 443 | Encrypted, HTTPS-based |
Advanced Features
Query Options
dog --tcp example.com
dog --timeout 5 example.com
dog --no-recurse example.com
dog --class CH version.bind TXT
Reverse DNS
dog -x 8.8.8.8
dog --reverse 1.1.1.1
DNSSEC Queries
dog --dnssec example.com
dog example.com DNSKEY
dog example.com DS
Common Patterns
Troubleshooting DNS
dog @8.8.8.8 example.com A
dog @1.1.1.1 example.com A
dog @9.9.9.9 example.com A
dog example.com MX --json | jq '.answers[].data'
dog example.com TXT | grep -E 'spf|dkim|dmarc'
dog _dmarc.example.com TXT
dog selector._domainkey.example.com TXT
Automation and Scripting
dog --json example.com A | jq -r '.answers[].data'
dog --short example.com && echo "Resolves" || echo "No resolution"
for domain in example.com example.org; do
dog --json "$domain" A
done
Alternative Tools
dig (Traditional)
Still valuable for DNSSEC validation and advanced debugging:
dig +dnssec example.com
dig +trace example.com
dig +noall +answer example.com MX
drill (LDNS Project)
DNSSEC-focused tool from NLnet Labs:
drill -S example.com
drill -T example.com
Agentic Optimizations
| Context | Command |
|---|
| Parse results | dog --json example.com |
| Quick check | dog --short example.com |
| Minimal output | dog -q example.com A |
| Extract IPs | dog --json example.com A | jq -r '.answers[].data' |
| Batch queries | Loop with --json for structured output |
| CI/CD checks | dog --json --timeout 5 for fast, parseable results |
Quick Reference
Record Types
| Type | Description | Example |
|---|
| A | IPv4 address | dog example.com A |
| AAAA | IPv6 address | dog example.com AAAA |
| MX | Mail exchanger | dog example.com MX |
| NS | Name server | dog example.com NS |
| TXT | Text record | dog example.com TXT |
| CNAME | Canonical name | dog www.example.com CNAME |
| SOA | Start of authority | dog example.com SOA |
| PTR | Pointer (reverse) | dog -x 8.8.8.8 |
| SRV | Service record | dog _sip._tcp.example.com SRV |
| CAA | Certificate authority | dog example.com CAA |
Common Flags
| Flag | Short | Description |
|---|
--json | -J | JSON output |
--short | -s | Answers only |
--tcp | -T | Use TCP |
--tls | | DNS-over-TLS |
--https | -H | DNS-over-HTTPS |
--reverse | -x | Reverse lookup |
--timeout | | Query timeout |
--dnssec | -D | Request DNSSEC |
--class | -C | Query class |
--no-recurse | | Disable recursion |
Error Handling
| Error | Cause | Solution |
|---|
| NXDOMAIN | Domain does not exist | Verify domain spelling |
| SERVFAIL | Server failure | Try different resolver |
| REFUSED | Query refused | Server policy, try public resolver |
| Timeout | No response | Check network, increase --timeout |
| Connection refused | DoT/DoH server unreachable | Verify server address and port |