How to use dig +trace to reveal DNS lookup internal

Back>

You might already know that dig can be used to solve domain name.
However, you might not know how the dns servers solve the domain name.

Just by simply add +trace flag, the dns resolving process will be revealed.

For example, the DNS lookup starts at the root level dns servers ., and continues from right to left, com. level servers are then queried, then lower level dns servers are queried, finally a DNS server is able to provide an authoritative A record.

For example, xxxxxx.blogspot.com domain names are all resolved to the same ip address, that ip address is one of public ip of google. Behind that ip, web servers dispatch the requests to a particular blog according to the parts before .blogspot.com. In other words, your blog don't have a dedicated ip address, which is good, in the sense of web server security, because google is managing the web server for you so that you just focus on contents.

demo>dig +trace xyzcode.blogspot.com

; <<>> DiG 9.10.6 <<>> +trace xyzcode.blogspot.com
;; global options: +cmd
. 220522 IN NS g.root-servers.net.
. 220522 IN NS h.root-servers.net.
. 220522 IN NS a.root-servers.net.
. 220522 IN NS l.root-servers.net.
. 220522 IN NS k.root-servers.net.
. 220522 IN NS b.root-servers.net.
. 220522 IN NS f.root-servers.net.
. 220522 IN NS d.root-servers.net.
. 220522 IN NS m.root-servers.net.
. 220522 IN NS e.root-servers.net.
. 220522 IN NS c.root-servers.net.
. 220522 IN NS j.root-servers.net.
. 220522 IN NS i.root-servers.net.
;; Received 811 bytes from 68.105.28.11#53(68.105.28.11) in 14 ms

com. 172800 IN NS a.gtld-servers.net.
com. 172800 IN NS b.gtld-servers.net.
com. 172800 IN NS c.gtld-servers.net.
com. 172800 IN NS d.gtld-servers.net.
com. 172800 IN NS e.gtld-servers.net.
com. 172800 IN NS f.gtld-servers.net.
com. 172800 IN NS g.gtld-servers.net.
com. 172800 IN NS h.gtld-servers.net.
com. 172800 IN NS i.gtld-servers.net.
com. 172800 IN NS j.gtld-servers.net.
com. 172800 IN NS k.gtld-servers.net.
com. 172800 IN NS l.gtld-servers.net.
com. 172800 IN NS m.gtld-servers.net.
com. 86400 IN DS 30909 8 2 E2D3C916F6DEEAC73294E8268FB5885044A833FC5459588F4A9184CF C41A5766
com. 86400 IN RRSIG DS 8 1 86400 20200521170000 20200508160000 48903 . BemkQJ+5wV2uHyc1V/SzRxJKt9GfVupkuDq2TqFY9Kt0tsvaKC6OZp+Y WZuBPZ+qHOU59o3APTBgtBbpDwTH+bXXYrqU3RNutirrwA/Z9RW+J3Bx W771zw5at79UWcZBkq2LxAYW2e3ZVukbQtylm5Wa5TeaBKsfr471dtEP hStNZ1vFrJ7VRt/txo399pn5HIslwuXDDc7LI65Dc8mFxHzjv8f/COQX mOPLESd5QVVd9oatek2lC43ArqI8x6aohLLyXdcSCdm0mVWmaC+4lpzl 3NGwP7GOmRVnuGjFxTZFDPTILYHNTziDPDriEYrNWwGxrHteAA+QB9i4 MdP/kA==
;; Received 1180 bytes from 198.41.0.4#53(a.root-servers.net) in 26 ms

blogspot.com. 172800 IN NS ns2.google.com.
blogspot.com. 172800 IN NS ns1.google.com.
blogspot.com. 172800 IN NS ns3.google.com.
blogspot.com. 172800 IN NS ns4.google.com.
CK0POJMG874LJREF7EFN8430QVIT8BSM.com. 86400 IN NSEC3 1 1 0 - CK0Q1GIN43N1ARRC9OSM6QPQR81H5M9A  NS SOA RRSIG DNSKEY NSEC3PARAM
CK0POJMG874LJREF7EFN8430QVIT8BSM.com. 86400 IN RRSIG NSEC3 8 2 86400 20200513044951 20200506033951 39844 com. DQ9LaY7nv4abiSkEn0gpiP0cQ8J7yqT4l29DPEUyTure4dT/cQOGGhB4 YaB6r/2IAy0Q32WN2JIPrBQZWYFans5vdqZKOE0bT5WIOCK3TFqfmpKy wcaRIcAqloo2ucXB5WSk30r4+ep3DgkfgQyAmgDfJWM0jMEMPxRYhm3l DBVkbvRe4un6nc1i07mz7d1i25O8nmx24r929EcMKPlF4w==
7E75D4UKK0QJCF521ERANMKGUOOD8KFM.com. 86400 IN NSEC3 1 1 0 - 7E75QJA0KQJU8DPN58K6SB69223LRR8I  NS DS RRSIG
7E75D4UKK0QJCF521ERANMKGUOOD8KFM.com. 86400 IN RRSIG NSEC3 8 2 86400 20200514045819 20200507034819 39844 com. GzCoHQxYKhuO56zahxwBj0Nkp23OwKNjSwyfyvFHvu/QLqeBHTl0uWJT IBBcsBW4lHtfv1arTf73ASrE9x/el1aGZpt2rWe3TIeN73OB70xWFT5G g8T30AP5PxsaJoBJTam2rY8VMpQzVdyd3NC0JqWBZLl7kmqWte2gY9Oa Oh3raD8YKH5kvAQ/tuJt+f6fBrkkXqg2y/mi1F+1jl1l5A==
;; Received 853 bytes from 2001:500:856e::30#53(d.gtld-servers.net) in 63 ms

xyzcode.blogspot.com. 3600 IN CNAME blogspot.l.googleusercontent.com.
blogspot.l.googleusercontent.com. 300 IN A 172.217.12.129
;; Received 108 bytes from 216.239.38.10#53(ns4.google.com) in 37 ms

demo>dig +trace xyzcodexxxxxxxxxxx.blogspot.com

; <<>> DiG 9.10.6 <<>> +trace xyzcodexxxxxxxxxxx.blogspot.com
;; global options: +cmd
. 226599 IN NS m.root-servers.net.
. 226599 IN NS a.root-servers.net.
. 226599 IN NS b.root-servers.net.
. 226599 IN NS c.root-servers.net.
. 226599 IN NS d.root-servers.net.
. 226599 IN NS e.root-servers.net.
. 226599 IN NS f.root-servers.net.
. 226599 IN NS g.root-servers.net.
. 226599 IN NS h.root-servers.net.
. 226599 IN NS i.root-servers.net.
. 226599 IN NS j.root-servers.net.
. 226599 IN NS k.root-servers.net.
. 226599 IN NS l.root-servers.net.
;; Received 811 bytes from 68.105.28.11#53(68.105.28.11) in 12 ms

com. 172800 IN NS c.gtld-servers.net.
com. 172800 IN NS b.gtld-servers.net.
com. 172800 IN NS h.gtld-servers.net.
com. 172800 IN NS j.gtld-servers.net.
com. 172800 IN NS m.gtld-servers.net.
com. 172800 IN NS l.gtld-servers.net.
com. 172800 IN NS f.gtld-servers.net.
com. 172800 IN NS d.gtld-servers.net.
com. 172800 IN NS g.gtld-servers.net.
com. 172800 IN NS k.gtld-servers.net.
com. 172800 IN NS e.gtld-servers.net.
com. 172800 IN NS a.gtld-servers.net.
com. 172800 IN NS i.gtld-servers.net.
com. 86400 IN DS 30909 8 2 E2D3C916F6DEEAC73294E8268FB5885044A833FC5459588F4A9184CF C41A5766
com. 86400 IN RRSIG DS 8 1 86400 20200521170000 20200508160000 48903 . BemkQJ+5wV2uHyc1V/SzRxJKt9GfVupkuDq2TqFY9Kt0tsvaKC6OZp+Y WZuBPZ+qHOU59o3APTBgtBbpDwTH+bXXYrqU3RNutirrwA/Z9RW+J3Bx W771zw5at79UWcZBkq2LxAYW2e3ZVukbQtylm5Wa5TeaBKsfr471dtEP hStNZ1vFrJ7VRt/txo399pn5HIslwuXDDc7LI65Dc8mFxHzjv8f/COQX mOPLESd5QVVd9oatek2lC43ArqI8x6aohLLyXdcSCdm0mVWmaC+4lpzl 3NGwP7GOmRVnuGjFxTZFDPTILYHNTziDPDriEYrNWwGxrHteAA+QB9i4 MdP/kA==
;; Received 1191 bytes from 2001:500:2::c#53(c.root-servers.net) in 23 ms

blogspot.com. 172800 IN NS ns2.google.com.
blogspot.com. 172800 IN NS ns1.google.com.
blogspot.com. 172800 IN NS ns3.google.com.
blogspot.com. 172800 IN NS ns4.google.com.
CK0POJMG874LJREF7EFN8430QVIT8BSM.com. 86400 IN NSEC3 1 1 0 - CK0Q1GIN43N1ARRC9OSM6QPQR81H5M9A  NS SOA RRSIG DNSKEY NSEC3PARAM
CK0POJMG874LJREF7EFN8430QVIT8BSM.com. 86400 IN RRSIG NSEC3 8 2 86400 20200513044951 20200506033951 39844 com. DQ9LaY7nv4abiSkEn0gpiP0cQ8J7yqT4l29DPEUyTure4dT/cQOGGhB4 YaB6r/2IAy0Q32WN2JIPrBQZWYFans5vdqZKOE0bT5WIOCK3TFqfmpKy wcaRIcAqloo2ucXB5WSk30r4+ep3DgkfgQyAmgDfJWM0jMEMPxRYhm3l DBVkbvRe4un6nc1i07mz7d1i25O8nmx24r929EcMKPlF4w==
7E75D4UKK0QJCF521ERANMKGUOOD8KFM.com. 86400 IN NSEC3 1 1 0 - 7E75QJA0KQJU8DPN58K6SB69223LRR8I  NS DS RRSIG
7E75D4UKK0QJCF521ERANMKGUOOD8KFM.com. 86400 IN RRSIG NSEC3 8 2 86400 20200514045819 20200507034819 39844 com. GzCoHQxYKhuO56zahxwBj0Nkp23OwKNjSwyfyvFHvu/QLqeBHTl0uWJT IBBcsBW4lHtfv1arTf73ASrE9x/el1aGZpt2rWe3TIeN73OB70xWFT5G g8T30AP5PxsaJoBJTam2rY8VMpQzVdyd3NC0JqWBZLl7kmqWte2gY9Oa Oh3raD8YKH5kvAQ/tuJt+f6fBrkkXqg2y/mi1F+1jl1l5A==
;; Received 864 bytes from 192.43.172.30#53(i.gtld-servers.net) in 28 ms

xyzcodexxxxxxxxxxx.blogspot.com. 3600 IN CNAME blogspot.l.googleusercontent.com.
blogspot.l.googleusercontent.com. 300 IN A 172.217.12.129
;; Received 119 bytes from 216.239.34.10#53(ns2.google.com) in 39 ms

demo>