⚡⚡ Daily Ops Cheat Sheet — DNS & Linux Networking

dig +short example.com                  # values only - for scripts, but see the WARNING
dig +noall +answer example.com          # values + TTL + type - the everyday form
dig example.com                         # everything, when you need the header

# a specific type
dig +noall +answer example.com MX
dig +noall +answer example.com TXT
dig +noall +answer example.com AAAA     # ALWAYS check this too - see A5

D=example.com
for t in SOA NS A AAAA MX TXT CAA DNSKEY; do
  out=$(dig +noall +answer "$D" "$t")
  [ -n "$out" ] && echo "$out" || printf '%-8s  (none)\n' "$t"
done

N=admin.example.com

# 1. wildcard check FIRST - without this, nothing below means anything
dig "zz$RANDOM-probe.example.com" +noall +comments | grep -o 'status: [A-Z]*'
#    NXDOMAIN  -> no wildcard, results are trustworthy
#    anything else -> a wildcard exists, every name "resolves", stop here

# 2. the name itself, with status visible
dig "$N" +noall +comments +answer

# 3. other types - a name can exist as CNAME or TXT only
dig "$N" AAAA +short ; dig "$N" CNAME +short ; dig "$N" TXT +short

# 4. confirm against an AUTHORITATIVE server - no cache involved
dig @"$(dig +short example.com NS | head -1)" "$N" +noall +comments +answer

dig +noall +answer www.example.com      # shows the CNAME AND the resolved target
dig +short www.example.com              # first line a hostname = it is a chain

dig +short -x 8.8.8.8                   # -x builds the in-addr.arpa name for you
dig +short -x 2001:4860:4860::8888      # works for IPv6 too

dig +short example.com NS       # nameserver hostnames name the DNS PROVIDER
dig +short example.com MX       # MX targets name the MAIL PLATFORM

D=example.com
NS=$(dig +short $D NS | head -1)
dig @"$NS" "$D" A +noall +comments +answer

D=example.com
for ns in $(dig +short $D NS); do
  printf '%-30s %s\n' "$ns" "$(dig @$ns $D A +short +norecurse | head -1)"
done

# and the serial - the number that reveals a missed bump
for ns in $(dig +short $D NS); do
  printf '%-30s serial %s\n' "$ns" \
    "$(dig @$ns $D SOA +short +norecurse | awk '{print $3}')"
done

D=example.com
for ns in $(dig +short $D NS); do
  printf '%-30s ' "$ns"
  out=$(dig @"$ns" "$D" SOA +norecurse +time=3 +tries=1 2>/dev/null)
  st=$(echo "$out" | grep -o 'status: [A-Z]*' | head -1 | cut -d' ' -f2)
  if   [ -z "$st" ]; then echo "NO RESPONSE  <-- unreachable"
  elif echo "$out" | grep -q 'flags:.* aa'; then echo "$st  aa=yes  OK"
  else echo "$st  aa=NO   <-- LAME DELEGATION"; fi
done

D=example.com ; PARENT="${D#*.}"

# what the CHILD says
dig +short $D NS | sort

# what the PARENT says - +norecurse is ESSENTIAL
dig @"$(dig +short $PARENT NS | head -1)" $D NS \
    +norecurse +noall +authority | awk '$4=="NS"{print $5}' | sort

N=api.example.com

dig "$N" +noall +comments | grep -E 'status|flags'   # 1 and 2
dig "$N" +cd +noall +comments | grep status          # 3
getent hosts "$N"                                    # 4

N=api.example.com

echo "1. what DNS says"        ; dig +short "$N"
echo "2. what the SYSTEM says" ; getent hosts "$N"
echo "3. is it overridden?"    ; grep -n "${N%%.*}" /etc/hosts /etc/nsswitch.conf
echo "4. which resolver?"      ; resolvectl query "$N" 2>/dev/null || cat /etc/resolv.conf

resolvectl status | grep -E 'Link|Current DNS Server|DNS Domain'   # systemd hosts
grep -E '^(nameserver|search|options)' /etc/resolv.conf
grep '^hosts' /etc/nsswitch.conf

# the tiebreaker - configuration describes intent, the capture shows reality
sudo timeout 5 tcpdump -n -i any 'udp port 53' &
sleep 1 ; getent hosts example.com > /dev/null ; wait

dig +trace example.com | tail -8          # bypasses EVERY cache, walks from the root

S=1.1.1.1 ; N=org

dig @$S $N SOA +noall +comments | grep status              # baseline
dig @$S $N NS +dnssec +ignore +noall +comments | grep flags # tc set? (+ignore = do not retry)
dig @$S $N NS +dnssec +tcp +noall +stats | grep -E 'SERVER|MSG SIZE'
dig @$S $N SOA +noedns +noall +comments | grep status      # EDNS-hostile middlebox?

N=example.org ; R=1.1.1.1

dig @$R $N A +noall +comments | grep status       # SERVFAIL?
dig @$R $N A +cd +noall +comments | grep status   # NOERROR with +cd? -> DNSSEC
dig $N A +dnssec +noall +answer | awk '/RRSIG/{print "expires:",$9}'   # check this FIRST
dig $N DS +noall +answer ; dig $N DNSKEY +noall +answer | head -2
delv @$R $N A +rtrace 2>&1 | tail -5

D=example.com ; N=www.example.com

dig +noall +answer "$N" | awk '{print "current TTL:",$2}'   # how long until it drains?
for ns in $(dig +short $D NS); do                            # baseline: do they agree now?
  printf '%-30s %s\n' "$ns" "$(dig @$ns $N +short +norecurse | head -1)"
done
dig "$N" +noall +stats | grep 'MSG SIZE'                     # size headroom

D=example.com ; N=www.example.com

# 1. did it land, and do ALL authoritative servers agree?
for ns in $(dig +short $D NS); do
  printf '%-30s %-18s serial %s\n' "$ns" \
    "$(dig @$ns $N +short +norecurse | head -1)" \
    "$(dig @$ns $D SOA +short +norecurse | awk '{print $3}')"
done

# 2. ground truth, no caches at all
dig +trace "$N" | tail -4

# 3. how far has it reached, and how much longer?
for r in 1.1.1.1 8.8.8.8 9.9.9.9; do
  printf '%-10s %s\n' "$r" "$(dig @$r "$N" +noall +answer | head -1)"
done

# Route 53 - the ONLY 100% complete source
ZONE=$(aws route53 list-hosted-zones-by-name --dns-name example.com \
        --query 'HostedZones[0].Id' --output text)
aws route53 list-resource-record-sets --hosted-zone-id "$ZONE" --output table

# machine-readable, for a diff
aws route53 list-resource-record-sets --hosted-zone-id "$ZONE" \
  --query 'ResourceRecordSets[].[Name,Type,TTL,ResourceRecords[0].Value]' --output text

D=example.com

# 1. wildcard check - if one exists, everything below is meaningless
dig "zz$RANDOM-probe.$D" +noall +comments | grep -o 'status: [A-Z]*'

# 2. zone transfer, against EVERY nameserver (the open one is the forgotten secondary)
for ns in $(dig +short $D NS); do
  if dig "@$ns" "$D" AXFR +time=3 +tries=1 2>/dev/null | grep -q "^$D"; then
    echo "OPEN AXFR on $ns  <-- FINDING, report it"
  else echo "refused/timeout on $ns  (expected)"; fi
done

# 3. Certificate Transparency - finds one-off and historic names no wordlist would guess
curl -s "https://crt.sh/?q=%25.$D&output=json" \
  | jq -r '.[].name_value' | sed 's/^\*\.//' | sort -u > ct-names.txt

# 4. which of those are still LIVE?
while read -r n; do
  dig +short "$n" A | grep -q . && echo "LIVE  $n" || echo "dead  $n"
done < ct-names.txt

# 5. dictionary sweep - use a real tool, not a shell loop
dnsx -d "$D" -w /usr/share/seclists/Discovery/DNS/dns-Jhaddix.txt -a -resp -silent

D=example.com
NAMES="www mail smtp dev demo jira confluence support crm gw intranet api"

for n in $NAMES; do
  for ip in $(dig +short "$n.$D" A | grep -E '^[0-9]+\.'); do
    printf '%-16s %s\n' "$ip" "$n.$D"
  done
done | sort -V

echo "--- reverse DNS of each distinct address ---"
for n in $NAMES; do dig +short "$n.$D" A; done | grep -E '^[0-9]+\.' | sort -u \
  | while read -r ip; do printf '%-16s %s\n' "$ip" "$(dig +short -x "$ip" | head -1)"; done

ss -tulnp                       # every listening TCP+UDP socket, with the process
ss -tulnp | grep ':53'          # is a DNS server actually running here?
ss -tnp state established       # current connections and their processes
ss -s                           # summary counts - quick health glance

ping -c 3 example.com                     # resolves AND tests reachability
ping -c 3 93.184.216.34                   # by IP - removes DNS from the question

nc -zv example.com 443                    # is the TCP port open? fast and definitive
nc -zvu 8.8.8.8 53                        # UDP check

ip route get 93.184.216.34                # which interface and gateway will be used?
ip -brief addr                            # my addresses, one line per interface
ip -brief link                            # interface state

traceroute -n example.com                 # -n so a DNS problem does not slow the trace
mtr -n --report --report-cycles 20 example.com   # traceroute + ping, over time. Better

# force a specific IP for a hostname WITHOUT touching /etc/hosts - the safest test there is
curl -sv --resolve example.com:443:93.184.216.34 https://example.com/ -o /dev/null

# timing breakdown - where do the milliseconds go?
curl -s -o /dev/null -w 'dns:%{time_namelookup}s connect:%{time_connect}s tls:%{time_appconnect}s ttfb:%{time_starttransfer}s total:%{time_total}s\n' https://example.com/

# just the status and the address it actually reached
curl -s -o /dev/null -w '%{http_code} %{remote_ip}\n' https://example.com/

# what does the server actually present, and when does it expire?
echo | openssl s_client -connect example.com:443 -servername example.com 2>/dev/null \
  | openssl x509 -noout -subject -issuer -dates

# every hostname the certificate covers - useful for inventory
echo | openssl s_client -connect example.com:443 -servername example.com 2>/dev/null \
  | openssl x509 -noout -ext subjectAltName

# days until expiry, for monitoring
echo | openssl s_client -connect example.com:443 -servername example.com 2>/dev/null \
  | openssl x509 -noout -checkend $((30*86400)) && echo "OK >30 days" || echo "EXPIRES SOON"

sudo tcpdump -n -i any 'udp port 53 or tcp port 53'      # all DNS, both transports
sudo tcpdump -n -i any 'port 53' -c 20                   # stop after 20 packets
sudo tcpdump -n -i any 'host 1.1.1.1'                    # one peer
sudo tcpdump -n -i any 'port 53' -w /tmp/dns.pcap        # save for Wireshark

systemctl status named bind9 systemd-resolved     # whichever exists
systemctl is-active systemd-resolved

journalctl -u named -n 50 --no-pager              # last 50 lines
journalctl -u named -f                            # follow
journalctl -u systemd-resolved --since '10 min ago'

resolvectl statistics                              # cache hits/misses
resolvectl flush-caches                            # empty the local cache

#!/usr/bin/env bash
# dns-audit.sh <domain> [wordlist]
set -uo pipefail
D="${1:?usage: dns-audit.sh <domain> [wordlist]}"; W="${2:-}"
hr(){ printf '\n== %s ==\n' "$1"; }

hr "ZONE RECORDS: $D"
for t in SOA NS A AAAA MX TXT CAA DNSKEY; do
  o=$(dig +noall +answer "$D" "$t")
  [ -n "$o" ] && echo "$o" || printf '%-8s  (none)\n' "$t"
done

hr "AUTHORITATIVE SERVERS"
dig +short "$D" NS | sort

hr "WILDCARD CHECK"
st=$(dig "zz$RANDOM$RANDOM-probe.$D" +noall +comments | grep -o 'status: [A-Z]*' | head -1)
if [ "$st" = "status: NXDOMAIN" ]; then
  echo "no wildcard -> existence checks are trustworthy"
else
  echo "WILDCARD PRESENT ($st) -> every name resolves; enumeration unreliable"
fi

hr "AXFR ATTEMPT (every nameserver)"
for ns in $(dig +short "$D" NS); do
  if dig "@$ns" "$D" AXFR +time=3 +tries=1 2>/dev/null | grep -q "^$D"; then
    echo "OPEN AXFR on $ns  <-- FINDING, report it"
  else
    echo "refused/timeout on $ns  (expected)"
  fi
done

hr "DELEGATION HEALTH"
for ns in $(dig +short "$D" NS); do
  printf '  %-30s ' "$ns"
  out=$(dig "@$ns" "$D" SOA +norecurse +time=3 +tries=1 2>/dev/null)
  s=$(echo "$out" | grep -o 'status: [A-Z]*' | head -1 | cut -d' ' -f2)
  if [ -z "$s" ]; then
    echo "NO RESPONSE  <-- unreachable"
  elif echo "$out" | grep -q 'flags:.* aa'; then
    echo "$s aa=yes  serial $(dig @$ns $D SOA +short +norecurse | awk '{print $3}')"
  else
    echo "$s aa=NO   <-- LAME DELEGATION"
  fi
done

[ -z "$W" ] && { hr "DONE"; exit 0; }

hr "NAME -> ADDRESS"
while read -r w; do
  [ -z "$w" ] && continue
  ans=$(dig +noall +answer "$w.$D" A); [ -z "$ans" ] && continue
  ips=$(echo "$ans" | awk '$4=="A"{print $5}'     | paste -sd, -)
  cn=$( echo "$ans" | awk '$4=="CNAME"{print $5}' | head -1)
  if [ -n "$cn" ]; then printf '%-34s %-8s CNAME %s -> %s\n' "$w.$D" "ALIAS" "$cn" "${ips:--}"
  else                  printf '%-34s %-8s %s\n'             "$w.$D" "A"     "$ips"; fi
done < "$W"

hr "REVERSE DNS OF DISCOVERED ADDRESSES"
while read -r w; do [ -z "$w" ] && continue; dig +short "$w.$D" A; done < "$W" \
  | grep -E '^[0-9]+\.' | sort -u \
  | while read -r ip; do printf '%-16s %s\n' "$ip" "$(dig +short -x "$ip" | head -1)"; done

#!/usr/bin/env bash
# watch-change.sh <name> <expected-value>
# Poll the big public resolvers until they all agree with you.
N="${1:?usage: watch-change.sh <name> <expected-value>}"; WANT="${2:?}"
while :; do
  printf '%s  ' "$(date +%H:%M:%S)"
  ok=0
  for r in 1.1.1.1 8.8.8.8 9.9.9.9; do
    got=$(dig @"$r" "$N" +short | head -1)
    if [ "$got" = "$WANT" ]; then printf '%-10s OK       ' "$r"; ok=$((ok+1))
    else                          printf '%-10s %-9s' "$r" "${got:-none}"; fi
  done
  echo
  [ "$ok" -eq 3 ] && { echo "all resolvers agree"; break; }
  sleep 10
done

# Exits 0 only if status is NOERROR AND a real record came back.
# Never test for empty output - that reports the same failure for a deleted
# record, a broken resolver, a policy refusal and a network partition.
check_dns() {
  local out
  out=$(dig "$1" A +noall +comments +answer 2>/dev/null) || return 1
  echo "$out" | grep -q 'status: NOERROR' || return 1
  echo "$out" | grep -qE 'IN[[:space:]]+(A|CNAME)'
}

check_dns api.example.com && echo OK || echo FAIL

# Alerts if the authoritative servers do not all report the same serial.
# Catches missed serial bumps, failed transfers and expired zones in one check.
serial_agreement() {
  local d="$1" n
  n=$(for ns in $(dig +short "$d" NS); do
        dig @"$ns" "$d" SOA +short +norecurse 2>/dev/null | awk '{print $3}'
      done | sort -u | wc -l)
  [ "$n" -eq 1 ]
}

serial_agreement example.com && echo "in sync" || echo "DIVERGENCE - check transfers"

# Warn N days before the signatures expire. RRSIGs expire on a DATE,
# whether or not the zone changes - so this fires with no change to review.
rrsig_days_left() {
  local d="$1" exp
  exp=$(dig "$d" SOA +dnssec +noall +answer | awk '/RRSIG/{print $9; exit}')
  [ -z "$exp" ] && { echo "unsigned"; return; }
  echo $(( ( $(date -u -d "${exp:0:8} ${exp:8:2}:${exp:10:2}:${exp:12:2}" +%s) \
              - $(date -u +%s) ) / 86400 ))
}

d=$(rrsig_days_left example.org); echo "$d days of signature left"