---
name: "sdig"
section: "1"
platform: "linux"
package: "powerdns"
version: "5.1.5-1"
release: "Arch Linux 2026-11-01"
platforms: ["linux"]
url: "https://new.carta.tech/sdig"
---

# sdig(1)

Perform a DNS query and show the results

## NAME

sdig - Perform a DNS query and show the results

## SYNOPSIS

**sdig** *IP-ADDRESS-OR-DOH-URL* *PORT* *QNAME* *QTYPE* \[*OPTION*\]

## DESCRIPTION

**sdig** sends a DNS query to *IP-ADDRESS-OR-DOH-URL* on port *PORT* and displays the answer in a formatted way. If the address starts with an **h**, it is assumed to be a DoH endpoint, and *PORT* is ignored. If qname and qtype are both *-* and tcp is used, multiple lines are read from stdin, where each line contains a qname and a type. If the address is **stdin**, a DNS packet is read from stdin instead of from the network, and *PORT* is ignored. All input is literal and case-sensitive. Queries need option *recurse* to expect a resource record reply if the query target is not known to be the authoritative server for that record.

## OPTIONS

These options can be added to the commandline in any order.

- **class *CLASSNUM***

  Send the query in the numbered class (like 3 for CHAOS) instead of the default 1 (for IN).

- **dnssec**

  Set the DO bit to request DNSSEC information.

- **ednssubnet *SUBNET***

  Send *SUBNET* in the edns-client-subnet option. If this option is not set, no edns-client-subnet option is set in the query.

- **hidesoadetails**

  Don't show the SOA serial in the response.

- **hidettl**

  Replace TTLs with *\[ttl\]* in the response.

- **proxy *TCP?* *SRC* *DST***

  Wrap query in PROXYv2 protocol with these parameters. The first parameter accepts 0 for UDP and 1 for TCP. The second and third take IP addresses and port.

- **recurse**

  Set the RD bit in the question.

- **showflags**

  Show the NSEC3 flags in the response (they are hidden by default).

- **dumpluaraw**

  Display record contents in a form suitable for dnsdist's *SpoofRawAction*.

- **tcp**

  Use TCP instead of UDP to send the query.

- **dot**

  use DoT instead of UDP to send a query. Implies tcp.

- **insecure**

  when using DoT, do not validate the server certificate.

- **fastOpen**

  when using TCP or, DoT, enable TCP Fast Open

- **subjectName *name***

  when using DoT, verify the server certificate is issued for *name*. The *openssl* provider will accept an empty name and still make sure the certificate is issued by a trusted CA, *gnutls* will only do the validation if a name is given. Default is the empty name. Also, note that older provide libraries might not validate at all.

- **caStore *file***

  when using DoT, read the trusted CA certificates from *file*. Default is to use the system provided CA store.

- **tlsProvider *name***

  when using DoT, use TLS provider *name*. Currently supported (if compiled in): *openssl* and *gnutls*. Default is *openssl* if available.

- **opcode *OPNUM***

  Use opcode *OPNUM* instead of 0 (Query). For example, **sdig 192.0.2.1 53 example.com SOA opcode 4** sends a **NOTIFY**.

- **cookie *COOKIE***

  if *COOKIE* is **-** send a random client cookie. Otherwise, send the given cookie, which should be a hex string received from a server earlier.

- **traceid *TraceID***

  include a TraceID and an empty SpanID value into the EDNS data. If TraceID is **-**, a random TraceID is generated; otherwise, it is a hex string.

## EXAMPLES

- **Simple queries to local resolvers**

  **sdig 127.0.0.1 53 example.com AAAA recurse**

  **sdig ::1 53 example.com A recurse**

- **Query to a DNS-over-HTTPS server requesting dnssec and recursion**

  **sdig https://dns.example.net/dns-query 443 example.com A dnssec recurse**

## AUTHOR

PowerDNS.COM BV

## COPYRIGHT

PowerDNS.COM BV