You run a DNS lookup, and a wall of text scrolls past: ANSWER SECTION, flags, TTLs, record types, a status code, some numbers you don't recognize. Most people glance at the IP address they were looking for and ignore the rest. But that "rest" is full of useful information: whether the answer is authoritative, how long it will be cached, whether DNSSEC validated, and clues about why something isn't resolving the way you expect.
Learning to read DNS lookup output turns these tools from black boxes into precise diagnostic instruments. Whether you use dig on the command line, nslookup, or a web-based lookup tool, the underlying information is the same, and once you can read it, troubleshooting DNS becomes far less mysterious.
This guide walks through what each part of DNS lookup output means, using dig as the primary example since it's the most detailed, then covering nslookup and what to look for when things go wrong.
A Complete dig Output, Annotated
Here's a typical dig command and its full output. We'll break down every section.
