SDIG(1)

📦
version 5.1.4 · 10 versions
, in alpine 3.24, epel 10, epel 9, fedora 43, fedora 44, ubuntu stonking

🦋 SDIG(1) — PowerDNS Authoritative Server 🦋

okay bestie, so this is sdig, from the PowerDNS Authoritative Server era, and honestly? it's giving "dig but make it yours". let's get into it 💅

✨ NAME ✨

sdig — perform a DNS query and show the results 💖

✨ SYNOPSIS ✨

sdig IP-ADDRESS-OR-DOH-URL PORT QNAME QTYPE [OPTION]

✨ DESCRIPTION ✨

so sdig sends a DNS query to IP-ADDRESS-OR-DOH-URL on port PORT, and then shows you the answer in a formatted way. cute, right? 🎀

if the address starts with an h, it's assumed to be a DoH endpoint, and PORT just gets ignored entirely (not me, not my port 🌸). if qname and qtype are both - and tcp is used, multiple lines get read from stdin, where each line contains a qname and a type. and if the address is stdin, a DNS packet is read from stdin instead of from the network, and PORT is ignored — yes, again, PORT said "not today" 💀.

all input is literal and case-sensitive, periodt. no vibes-based parsing here, fr fr.

one thing, and this is important bestie: queries need the recurse option to expect a resource record reply if the query target is not known to be the authoritative server for that record. like, if you don't know them like that, ask nicely. 🙈

✨ OPTIONS ✨

these options can be added to the commandline in any order. go off, honestly. 👑

  • class CLASSNUM — send the query in the numbered class (like 3 for CHAOS) instead of the default 1 (for IN). switching classes, main character behavior 💅
  • dnssec — set the DO bit to request DNSSEC information. get that dnssec tea ☕✨
  • ednssubnet SUBNET — send SUBNET in the edns-client-subnet option. if this option is not set, no edns-client-subnet option is set in the query. if you don't set it, it simply doesn't happen — that's the whole thing 🫶
  • hidesoadetails — don't show the SOA serial in the response. privacy era 🔥
  • hidttl — replace TTLs with [ttl] in the response. ttl? never heard of her 💀
  • proxy TCP? SRC DST — wrap query in PROXYv2 protocol with these parameters. the first parameter accepts 0 for UDP and 1 for TCP. the second and third take IP addresses and port. very "we come as a package deal" of it 🎁
  • recurse — set the RD bit in the question. asking them to go find it for you, lowkey iconic
  • showflags — show the NSEC3 flags in the response (they are hidden by default). unmasking the truth 🌈
  • dumpluaraw — display record contents in a form suitable for dnsdist's SpoofRawAction. raw and unfiltered, just like the group chat 😭
  • tcp — use TCP instead of UDP to send the query. reliable queen behavior 💖
  • dot — use DoT instead of UDP to send a query. implies tcp. yes it comes with a plus-one 🧚
  • insecure — when using DoT, do not validate the server certificate. bestie this is literally the "trust me bro" flag, be careful 😭🔥
  • fastOpen — when using TCP or, DoT, enable TCP Fast Open. zoom zoom ⚡
  • subjectName name — when using DoT, verify the server certificate is issued for name. the openssl provider will accept an empty name and still make sure the certificate is issued by a trusted CA, gnutls will only do the validation if a name is given. default is the empty name. also, note that older provide libraries might not validate at all. 👀 so yeah, "might not validate at all" — read that twice, bestie, that's a real caveat, not a vibe.
  • caStore file — when using DoT, read the trusted CA certificates from file. default is to use the system provided CA store. 🔐
  • tlsProvider name — when using DoT, use TLS provider name. currently supported (if compiled in): openssl and gnutls. default is openssl if available. pick your fighter 🌸
  • opcode OPNUM — use opcode OPNUM instead of 0 (Query). for example, sdig 192.0.2.1 53 example.com SOA opcode 4 sends a NOTIFY. look at us doing NOTIFY things ✨
  • cookie COOKIE — if COOKIE is - send a random client cookie. otherwise, send the given cookie, which should be a hex string received from a server earlier. leftover cookies but make it DNS 🍪
  • traceid TraceID — include a TraceID and an empty SpanID value into the EDNS data. if TraceID is -, a random TraceID is generated; otherwise, it is a hex string. tracking the lore 🔍

✨ EXAMPLES ✨

simple queries to local resolvers 🫶

sdig 127.0.0.1 53 example.com AAAA recurse
sdig ::1 53 example.com A recurse

query to a DNS-over-HTTPS server requesting dnssec and recursion 🌈

sdig https://dns.example.net/dns-query 443 example.com A dnssec
recurse

✨ AUTHOR ✨

PowerDNS.COM BV 👑

PowerDNS.COM BV 💜

and that's the whole page, bestie! 🎀 this one's dated Aug 05, 2026, it's the SDIG(1) page, and it comes to you straight from the PowerDNS Authoritative Server and PowerDNS.COM BV — love that for them, slay, bye 💅✨

📦 where this page comes from