DELV(1)

📦
version 9.20.29 · 37 versions
, in opensuse-leap 16.0

DELV(1) from BIND 9 is here, bestie — the delv manual, aka the DNS lookup and validation utility. Grab your iced coffee, because we're going through every flag and every little caveat. 💖✨

✨ NAME ✨

delv — DNS lookup and validation utility. That's it, that's the name. 🦋

🌸 SYNOPSIS 🌸

delv [@server] [ [-4] | [-6] ] [-a anchor-file] [-b address] [-c class]
[-d level] [-i] [-m] [-p port#] [-q name] [-t type] [-x addr] [name]
[type] [class] [queryopt...]

delv [-h]

delv [-v]

delv [queryopt...] [query...]

💫 DESCRIPTION 💫

delv is a tool for sending DNS queries and validating the results, using the same internal resolver and validator logic as named. Ngl, that's the main character energy: it's doing the resolver/validator thing itself. 👑

delv sends to a specified name server all queries needed to fetch and validate the requested data; this includes the original requested query, subsequent queries to follow CNAME or DNAME chains, queries for DNSKEY, and DS records to establish a chain of trust for DNSSEC validation. It does not perform iterative resolution, but simulates the behavior of a name server configured for DNSSEC validating and forwarding. Fr fr, no iterative resolution.

By default, responses are validated using the built-in DNSSEC trust anchor for the root zone ("."). Records returned by delv are either fully validated or were not signed. If validation fails, an explanation of the failure is included in the output; the validation process can be traced in detail. Because delv does not rely on an external server to carry out validation, it can be used to check the validity of DNS responses in environments where local name servers may not be trustworthy. Lowkey iconic. 🌈

Unless it is told to query a specific name server, delv tries each of the servers listed in /etc/resolv.conf. If no usable server addresses are found, delv sends queries to the localhost addresses (127.0.0.1 for IPv4, ::1 for IPv6).

When no command-line arguments or options are given, delv performs an NS query for "." (the root zone). Periodt. 💅

🎀 SIMPLE USAGE 🎀

A typical invocation of delv looks like:

delv @server name type

where:

  • server is the name or IP address of the name server to query. This can be an IPv4 address in dotted-decimal notation or an IPv6 address in colon-delimited notation. When the supplied server argument is a hostname, delv resolves that name before querying that name server (note, however, that this initial lookup is not validated by DNSSEC). If no server argument is provided, delv consults /etc/resolv.conf; if an address is found there, it queries the name server at that address. If either of the -4 or -6 options is in use, then only addresses for the corresponding transport are tried. If no usable addresses are found, delv sends queries to the localhost addresses (127.0.0.1 for IPv4, ::1 for IPv6).
  • name is the domain name to be looked up.
  • type indicates what type of query is required - ANY, A, MX, etc. type can be any valid query type. If no type argument is supplied, delv performs a lookup for an A record.

💅 OPTIONS 💅

  • -a anchor-file — this option specifies a file from which to read an alternate DNSSEC root zone trust anchor. By default, keys that do not match the root zone name (.) are ignored. If an alternate key name is desired, it can be specified using the +root option. Note: when reading trust anchors, delv treats trust-anchors, initial-key, and static-key identically. That is, for a managed key, it is the initial key that is trusted; RFC 5011 key management is not supported. delv does not consult the managed-keys database maintained by named. This means that if the default key built in to delv is revoked, delv must be updated to a newer version in order to continue validating. 🗝️
  • -b address — this option sets the source IP address of the query to address. This must be a valid address on one of the host's network interfaces, or 0.0.0.0, or ::. An optional source port may be specified by appending #<port>.
  • -c class — this option sets the query class for the requested data. Currently, only class "IN" is supported in delv and any other value is ignored.
  • -d level — this option sets the systemwide debug level to level. The allowed range is from 0 to 99. The default is 0 (no debugging). Debugging traces from delv become more verbose as the debug level increases. See the +mtrace, +rtrace, and +vtrace options below for additional debugging details. 👀
  • -h — this option displays the delv help usage output and exits.
  • -i — this option sets insecure mode, which disables internal DNSSEC validation. Note: this does not set the CD bit on upstream queries. If the server being queried is performing DNSSEC validation, then it does not return invalid data; this can cause delv to time out. When it is necessary to examine invalid data to debug a DNSSEC problem, use dig +cd. ⚠️
  • -m — this option enables memory usage debugging.
  • -p port# — this option specifies a destination port to use for queries, instead of the standard DNS port number 53. This option is used with a name server that has been configured to listen for queries on a non-standard port number.
  • -q name — this option sets the query name to name. While the query name can be specified without using the -q option, it is sometimes necessary to disambiguate names from types or classes (for example, when looking up the name "ns", which could be misinterpreted as the type NS, or "ch", which could be misinterpreted as class CH). 🎯
  • -t type — this option sets the query type to type, which can be any valid query type supported in BIND 9 except for zone transfer types AXFR and IXFR. As with -q, this is useful to distinguish query-name types or classes when they are ambiguous. It is sometimes necessary to disambiguate names from types. The default query type is "A", unless the -x option is supplied to indicate a reverse lookup, in which case it is "PTR".
  • -v — this option prints the delv version and exits.
  • -x addr — this option performs a reverse lookup, mapping an address to a name. addr is an IPv4 address in dotted-decimal notation, or a colon-delimited IPv6 address. When -x is used, there is no need to provide the name or type arguments; delv automatically performs a lookup for a name like 11.12.13.10.in-addr.arpa and sets the query type to PTR. IPv6 addresses are looked up using nibble format under the IP6.ARPA domain. 🔁
  • -4 — this option forces delv to only use IPv4.
  • -6 — this option forces delv to only use IPv6.

✨ QUERY OPTIONS ✨

okay so delv has a whole little wardrobe of query options 💅 and they change how your results get displayed — and sometimes even how the lookups actually happen. main character energy, honestly.

every single query option is a keyword with a plus sign (+) in front of it. some of these keywords just set or reset a thing, and you can slap no before them to flip the meaning. the others are the +keyword=value type, where you're handing over something like a timeout interval. here's the whole lineup 🎀:

  • +cdflag, +nocdflag — controls whether the CD (checking disabled) bit gets set on queries delv sends out. super useful when you're troubleshooting DNSSEC problems from behind a validating resolver 🕵️ — because a validating resolver blocks invalid responses, which makes them a nightmare to retrieve for analysis. set the CD flag and the resolver hands back the invalid responses anyway, so delv can validate them internally and spill all the deets on what went wrong 💀.
  • +class, +noclass — show the CLASS when a record is printed, or don't. default is to display it.
  • +hint=FILE, +nohint — points at a filename to load root hints from 🌱. those get used to find the root name servers when name server mode (delv +ns) is in use. no option specified? built-in root hints, periodt.
  • +ns, +nons — toggles name server mode, bestie. when it's on, the delv process spins up a whole full recursive resolver and uses that to look up whatever query name and type you asked for. turning this on also activates +mtrace, +strace, and +rtrace, so every iterative query gets logged — including the full response messages from each authoritative server 👑. and those logged messages go to stdout instead of stderr like usual, so you can capture the full trace way more easily.

it's meant to feel like dig +trace, but since it runs the same code as named, it replicates the behavior of a recursive name server with a cold cache chewing through a recursive query much more accurately. it's giving accuracy 💯.

  • +qmin[=MODE], +noqmin — with +ns, this enables QNAME minimization mode. valid MODE values are relaxed and strict. by default QNAME minimization is disabled. if you say +qmin but leave out MODE, then relaxed mode gets used 🦋.
  • +ttl, +nottl — show the TTL when printing a record, or don't. default is to display the TTL.
  • +rtrace, +nortrace — toggles resolver fetch logging. this reports the name and type of every query delv sends while doing the resolution and validation thing, including the original query and all the follow-up queries chasing CNAMEs and building a chain of trust for DNSSEC validation 🔗.

it's equivalent to setting the debug level to 1 in the "resolver" logging category. setting the systemwide debug level to 1 with -d gives the same output, but it messes with other logging categories too 🙈.

  • +mtrace, +nomtrace — toggles logging of messages received. this gives you a detailed dump of the responses delv receives while resolving and validating 📥.

equivalent to setting the debug level to 10 for the "packets" module of the "resolver" logging category. systemwide debug level 10 via -d = same output, but, again, it hits other categories too.

  • +strace, +nostrace — toggles logging of messages sent. detailed dump of the queries delv sends while resolving and validating 📤. turning this on also activates +mtrace, so yeah, package deal ✨.

equivalent to setting the debug level to 11 for the "packets" module of the "resolver" logging category. systemwide debug level 11 with -d gives the same output but affects other categories as well.

  • +vtrace, +novtrace — toggles validation logging. shows you the validator's internal process while it decides whether an answer is validly signed, unsigned, or invalid 🔍.

equivalent to setting the debug level to 3 for the "validator" module of the "dnssec" logging category. systemwide debug level 3 via -d = same output, other categories affected though.

  • +short, +noshort — flips between verbose and terse answers. default is verbose, because we love detail 💖.
  • +comments, +nocomments — toggles comment lines in the output. default is to print comments.
  • +rrcomments, +norrcomments — toggles per-record comments in the output (like the human-readable key info on DNSKEY records 🔑). default is to print per-record comments.
  • +crypto, +nocrypto — toggles display of cryptographic fields in DNSSEC records. those field contents are honestly unnecessary for debugging most DNSSEC validation failures, and removing them makes the common failures way easier to spot 👀. default is to display the fields. when omitted, they get replaced by the string [omitted] or — in the DNSKEY case — the key ID shows up as the replacement, like [ key id = value ].
  • +restarts — when name server mode (delv +ns) is in use, this sets the max number of CNAME queries to follow before resolution gets terminated. saves delv from hanging forever in a CNAME loop 😭. default is 11.
  • +maxqueries — the maximum number of queries to send while resolving a name before giving up. default is 50.
  • +maxtotalqueries — the maximum number of queries to send while resolving a client request before giving up. default is 200.
  • +trust, +notrust — show the trust level when printing a record, or don't. default is to display it.
  • +split[=W], +nosplit — splits long hex- or base64-formatted fields in resource records into chunks of W characters (and W gets rounded up to the nearest multiple of 4 🎀). +nosplit or +split=0 means no splitting at all. default is 56 characters, or 44 characters when multiline mode is active.
  • +all, +noall — sets or clears the display options +comments, +rrcomments, and +trust as one big group 🫶.
  • +multiline, +nomultiline — prints long records (RRSIG, DNSKEY, SOA, the whole crew) in a verbose multi-line format with human-readable comments 🌸. default is one line per record, so machines can parse the delv output without drama.
  • +dnssec, +nodnssec — says whether to display RRSIG records in the delv output. default is yes. heads up though — unlike in dig, this does not control whether DNSSEC records get requested or validated. DNSSEC records are always requested, and validation always happens unless it's suppressed with -i or +noroot ⚠️.
  • +root[=ROOT], +noroot — says whether to do conventional DNSSEC validation, and if so, names the trust anchor. default is validating with a trust anchor of "." (the root zone), which has a built-in key 🔑. if you want a different trust anchor, you gotta use -a to point at a file containing the key.
  • +tcp, +notcp — controls whether TCP is used to send queries. default is UDP, unless a truncated response came back.
  • +unknownformat, +nounknownformat — prints all RDATA in unknown RR-type presentation format (RFC 3597). default is to print RDATA for known types in that type's presentation format.
  • +yaml, +noyaml — prints response data in YAML format 🧚.

🎀 FILES 🎀

  • /etc/resolv.conf

💜 SEE ALSO 💜

dig(1), named(8), RFC 4034, RFC 4035, RFC 4431, RFC 5074, RFC 5155.

🌈 AUTHOR 🌈

Internet Systems Consortium

2026, Internet Systems Consortium

and that's the whole page, bestie — you ate that 🫶 this was delv from ISC, version 9.20.29, dated 2026-09-11, and it's iconic. go validate something 💅✨

📦 where this page comes from