Learning DNS - Basic Diagnostic & Troubleshooting Tools

#Introduction

A healthy DNS server will one day have problems: wrong answers, slow propagation, or simply "DNS not resolving". The skill that separates a regular engineer from a great one isn't preventing all problems — it's finding the root cause quickly.

Episode 8 builds your diagnostic toolkit. We'll master dig in various modes, get to know drill and kdig, use pdns_control to peek inside the daemons, and finally dissect raw DNS packets with tcpdump.

#Mastering dig

#Classic Query Modes

dig is the most versatile tool. Combining +noall and +answer shows only answers without noisy headers:

dig @127.0.0.1 example.com A +noall +answer
dig @127.0.0.1 example.com MX +short

dig +short displays record values without names and TTLs — great for scripts and quick checks. For deep debugging, drop those flags so headers and timing appear.

#+trace, +nssearch, and +dnssec

Three special modes solve three different problems:

dig +trace example.com
dig +nssearch example.com
dig +dnssec example.com SOA +noall +answer

• dig +trace example.com: traces resolution from the root servers down to the final answer, line by line. Perfect for finding which level resolution is stuck at.
• dig +nssearch example.com: queries every authoritative name server and compares their SOAs. It reveals which server is out of sync.
• dig +dnssec example.com: shows DNSKEY, RRSIG, and DS records — the DNSSEC investigation material we'll use in episodes 13-14.

#dig Alternatives: drill and kdig

#kdig and drill

Not every system has dig. kdig (from knot-dnsutils) is a convenient modern replacement, and drill (from ldns) excels at DNSSEC validation:

kdig @127.0.0.1 example.com A
drill -S example.com

drill -S example.com runs DNSSEC validation from the trust anchor and reports whether the signature chain is valid — a feature plain dig doesn't have. kdig@127.0.0.1 example.com is equivalent to a regular dig query, with cleaner output.

#Inspecting Authoritative from Within

#pdnsutil check-zone

Before blaming the network, check the data:

pdnsutil check-zone example.com
pdnsutil check-all-zones

pdnsutil check-zone validates a single zone; check-all-zones does it for every managed zone. Common mistakes like duplicate CNAMEs or missing NS records are detected right here.

#pdns_control and rec_control

Both daemons provide runtime control:

pdns_control ping
pdns_control list-zones
rec_control ping
rec_control get uptime

pdns_control ping confirms the Authoritative is still alive and responding. rec_control get uptime shows how long the Recursor has been running without a restart — a low uptime number can hint at repeated crashes.

#Dissecting Packets on Port 53

#tcpdump

When answers and logs look normal but the problem persists, look at the raw packets:

sudo tcpdump -i any port 53 -n -vv

While tcpdump runs, execute dig @127.0.0.1 example.com A in another terminal. You'll see queries going out and answers coming in along with source ports, addresses, and packet sizes. For deeper analysis, tshark displays fields one by one:

sudo tshark -i any -f "port 53" -Y "dns.flags.response == 1"

tshark -Y "dns.flags.response == 1" filters only response packets, making it easy to inspect the answers your server sends.

#A Systematic Troubleshooting Flow

#Recommended Sequence

When a problem appears, follow this sequence instead of guessing:

1. status service dan log (journalctl)
2. pdns_control ping / rec_control ping
3. pdnsutil check-zone / check-all-zones
4. dig @127.0.0.1 +noall +answer
5. dig +trace untuk melacak level kegagalan
6. tcpdump port 53 jika masih buntu

With this sequence, you move from "is the daemon alive" to "what's actually in the packets", and most problems surface before step five.

#Conclusion

Episode 8 equips you with diagnostic weapons: dig in +trace, +short, +dnssec, and +nssearch modes, the drill and kdig alternatives, internal validation via pdnsutil and pdns_control, and packet dissection with tcpdump and tshark.

Key takeaways:

• dig +short for quick checks, dig +trace to find the level where resolution fails.
• dig +nssearch compares the SOA of all authoritative servers and finds out-of-sync ones.
• drill -S validates DNSSEC; kdig is a modern dig alternative.
• pdnsutil check-zone validates data before blaming the network.
• tcpdump port 53 shows raw facts invisible in logs.

In episode 9, we'll cover primary and secondary servers — the master-slave concept with SOA serial as a zone version marker, the NOTIFY flow toward AXFR and IXFR, and its implementation in PowerDNS Authoritative with primary=yes, allow-axfr-ips, and also-notify.