SDIG(1)                  PowerDNS Authoritative Server                 SDIG(1)

NAME
       sdig - Perform a DNS query and show the results

SYNOPSIS
       sdig IP-ADDRESS-OR-DOH-URL PORT QNAME QTYPE [OPTION]

DESCRIPTION
       sdig sends a DNS query to IP-ADDRESS-OR-DOH-URL on port PORT and
       displays the answer in a formatted way.  If the address starts with an
       h, it is assumed to be a DoH endpoint, and PORT is ignored.  If qname
       and qtype are both - and tcp is used, multiple lines are read from
       stdin, where each line contains a qname and a type.  If the address is
       stdin, a DNS packet is read from stdin instead of from the network, and
       PORT is ignored.  All input is literal and case sensitive.  Queries
       need option recurse to expect a resource record reply if the query
       target is not known to be the authoritative server for that record.

OPTIONS
       These options can be added to the commandline in any order.

       class CLASSNUM
              Send the query in the numbered class (like 3 for CHAOS) instead
              of the default 1 (for IN).

       dnssec Set the DO bit to request DNSSEC information.

       ednssubnet SUBNET
              Send SUBNET in the edns-client-subnet option. If this option is
              not set, no edns-client-subnet option is set in the query.

       hidesoadetails
              Don't show the SOA serial in the response.

       hidettl
              Replace TTLs with [ttl] in the response.

       proxy TCP? SRC DST
              Wrap query in PROXYv2 protocol with these parameters. The first
              parameter accepts 0 for UDP and 1 for TCP. The second and third
              take IP addresses and port.

       recurse
              Set the RD bit in the question.

       showflags
              Show the NSEC3 flags in the response (they are hidden by
              default).

       dumpluaraw
              Display record contents in a form suitable for dnsdist's
              SpoofRawAction.

       tcp    Use TCP instead of UDP to send the query.

       dot    use DoT instead of UDP to send a query. Implies tcp.

       insecure
              when using DoT, do not validate the server certificate.

       fastOpen
              when using TCP or, DoT, enable TCP Fast Open

       subjectName name
              when using DoT, verify the server certificate is issued for
              name. The openssl provider will accept an empty name and still
              make sure the certificate is issued by a trusted CA, gnutls will
              only do the validation if a name is given.  Default is the empty
              name. Also, note that older provide libraries might not validate
              at all.

       caStore file
              when using DoT, read the trusted CA certificates from file.
              Default is to use the system provided CA store.

       tlsProvider name
              when using DoT, use TLS provider name. Currently supported (if
              compiled in): openssl and gnutls. Default is openssl if
              available.

       xpf XPFCODE XPFVERSION XPFPROTO XPFSRC XPFDST
              Send an XPF additional with these parameters.

       opcode OPNUM
              Use opcode OPNUM instead of 0 (Query). For example, sdig
              192.0.2.1 53 example.com SOA opcode 4 sends a NOTIFY.

EXAMPLES

       Simple queries to local resolvers
              sdig 127.0.0.1 53 example.com AAAA recurse sdig ::1 53
              example.com A recurse

       Query to a DNS-over-HTTPS server requesting dnssec and recursion
              sdig https://dns.example.net/dns-query 443 example.com A dnssec
              recurse

AUTHOR
       PowerDNS.COM BV

COPYRIGHT
       PowerDNS.COM BV

                                March 15, 2024                         SDIG(1)