Example 1: Basic Hostname to IP Address Lookup
The most common use of host is looking up the IP address(es) associated with a domain name. This performs a forward DNS lookup.
host www.google.com
www.google.com has address 142.250.80.46
www.google.com has IPv6 address 2607:f8b0:4004:c07::93
host binghamton.edu
binghamton.edu has address 128.226.160.80
binghamton.edu mail is handled by 10 binghamton-edu.mail.protection.outlook.com.
host github.com
github.com has address 140.82.114.4
Understanding Basic DNS Lookup:
- A records: IPv4 addresses shown with "has address"
- AAAA records: IPv6 addresses shown with "has IPv6 address"
- Multiple IPs: Large sites often have multiple IPs for load balancing
- Mail records: MX records automatically shown for many domains
- Default behavior: Queries for A and AAAA records by default
- System resolver: Uses /etc/resolv.conf to determine DNS servers to query
- Clean output: More readable than nslookup for simple queries
- Quick check: Fastest way to verify domain resolves correctly
Troubleshooting Tip: If host returns "Host not found" or "NXDOMAIN", the domain doesn't exist or DNS isn't configured properly. Check spelling first, then verify DNS server connectivity.
Example 2: Reverse DNS Lookup (IP to Hostname)
Reverse DNS lookup queries an IP address to find its associated hostname. This uses PTR (pointer) records.
host 8.8.8.8
8.8.8.8.in-addr.arpa domain name pointer dns.google.
host 1.1.1.1
1.1.1.1.in-addr.arpa domain name pointer one.one.one.one.
host 142.250.80.46
46.80.250.142.in-addr.arpa domain name pointer lga34s32-in-f14.1e100.net.
host 192.168.1.1
Host 1.1.168.192.in-addr.arpa. not found: 3(NXDOMAIN)
Reverse DNS Mechanics:
- PTR records: Map IP addresses back to hostnames
- in-addr.arpa: Special domain for IPv4 reverse lookups (reversed octets)
- ip6.arpa: Used for IPv6 reverse lookups
- Not always present: Many IPs don't have reverse DNS configured
- Email servers: Often require valid reverse DNS for spam prevention
- Private IPs: RFC 1918 addresses (192.168.x.x, 10.x.x.x) usually don't resolve
- Verification: Useful for identifying server owners or ISP information
- Security: Can help identify suspicious connections in logs
Email Server Check: Mail servers should have matching forward and reverse DNS. Check both: host mail.example.com and host <IP> should reference same domain.
Example 3: Query Specific Record Type (-t)
The -t option specifies which type of DNS record to query. This gives you precise control over what information to retrieve.
host -t MX google.com
google.com mail is handled by 10 smtp.google.com.
host -t NS binghamton.edu
binghamton.edu name server axton.binghamton.edu.
binghamton.edu name server ns1.binghamton.edu.
binghamton.edu name server ns2.binghamton.edu.
host -t TXT google.com
google.com descriptive text "v=spf1 include:_spf.google.com ~all"
google.com descriptive text "facebook-domain-verification=22rm551cu4k0ab0bxsw536tlds4h95"
google.com descriptive text "docusign=05958488-4752-4ef2-95eb-aa7ba8a3bd0e"
host -t SOA example.com
example.com has SOA record ns.icann.org. noc.dns.icann.org. 2024110401 7200 3600 1209600 3600
host -t AAAA google.com
google.com has IPv6 address 2607:f8b0:4004:c07::71
google.com has IPv6 address 2607:f8b0:4004:c07::8b
google.com has IPv6 address 2607:f8b0:4004:c07::8a
google.com has IPv6 address 2607:f8b0:4004:c07::64
DNS Record Types Explained:
- MX (Mail Exchange): Lists mail servers for domain, with priority numbers (lower = higher priority)
- NS (Name Server): Authoritative DNS servers for the domain
- TXT (Text): Arbitrary text data; used for SPF, DKIM, domain verification, etc.
- SOA (Start of Authority): Primary nameserver, contact email, serial number, refresh timers
- AAAA: IPv6 addresses (quad-A record)
- CNAME: Canonical name (alias pointing to another domain)
- PTR: Pointer for reverse DNS lookups
- A: IPv4 address (can query explicitly with -t A)
SPF Records: Check email authentication: host -t TXT domain.com. Look for "v=spf1" entries that specify which servers can send mail for the domain.
Example 4: Query Specific DNS Server
By default, host uses your system's configured DNS servers. You can query a specific DNS server by providing it as the last argument.
host google.com 8.8.8.8
Using domain server:
Name: 8.8.8.8
Address: 8.8.8.8#53
Aliases:
google.com has address 142.250.80.46
google.com has IPv6 address 2607:f8b0:4004:c07::71
google.com mail is handled by 10 smtp.google.com.
host example.com 1.1.1.1
Using domain server:
Name: 1.1.1.1
Address: 1.1.1.1#53
Aliases:
example.com has address 93.184.216.34
example.com has IPv6 address 2606:2800:220:1:248:1893:25c8:1946
example.com mail is handled by 0 .
host -t NS reddit.com 208.67.222.222
Using domain server:
Name: 208.67.222.222
Address: 208.67.222.222#53
Aliases:
reddit.com name server ns-1029.awsdns-00.org.
reddit.com name server ns-557.awsdns-05.net.
reddit.com name server ns-1887.awsdns-43.co.uk.
reddit.com name server ns-378.awsdns-47.com.
Querying Specific DNS Servers:
- Syntax: host domain server_ip
- Server information: Shows which DNS server was queried
- Port 53: DNS queries use UDP/TCP port 53
- Google DNS: 8.8.8.8 and 8.8.4.4 (public, reliable)
- Cloudflare DNS: 1.1.1.1 and 1.0.0.1 (privacy-focused, fast)
- OpenDNS: 208.67.222.222 and 208.67.220.220 (content filtering available)
- Testing: Useful for comparing results between different DNS servers
- Troubleshooting: Helps identify DNS propagation issues or local resolver problems
Propagation Check: After DNS changes, query multiple DNS servers: host domain.com 8.8.8.8 vs host domain.com 1.1.1.1. Different results indicate propagation in progress.
Example 5: Verbose Output (-v)
The -v flag provides verbose output showing the complete DNS query and response, useful for debugging and understanding DNS internals.
host -v example.com
Trying "example.com"
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 12345
;; flags: qr rd ra; QUERY: 1, ANSWER: 2, AUTHORITY: 0, ADDITIONAL: 0
;; QUESTION SECTION:
;example.com. IN A
;; ANSWER SECTION:
example.com. 86400 IN A 93.184.216.34
Received 56 bytes from 192.168.1.1#53 in 25 ms
Trying "example.com"
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 54321
;; flags: qr rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 0
;; QUESTION SECTION:
;example.com. IN AAAA
;; ANSWER SECTION:
example.com. 86400 IN AAAA 2606:2800:220:1:248:1893:25c8:1946
Received 68 bytes from 192.168.1.1#53 in 28 ms
Trying "example.com"
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 67890
;; flags: qr rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 0
;; QUESTION SECTION:
;example.com. IN MX
;; ANSWER SECTION:
example.com. 86400 IN MX 0 .
Received 46 bytes from 192.168.1.1#53 in 22 ms
Verbose Output Components:
- Header section: Query ID, status codes, flags
- Flags: qr (query response), rd (recursion desired), ra (recursion available)
- QUERY count: Number of questions asked
- ANSWER count: Number of answers received
- AUTHORITY: Number of authority records (NS records)
- ADDITIONAL: Extra helpful records
- TTL value: 86400 seconds = 24 hours cache time
- Response time: Shows latency (25 ms in example)
- Source server: Which DNS server provided the response
Debugging DNS: Verbose mode reveals caching behavior (TTL), response times, and exact query flow. Essential for diagnosing slow resolution or incorrect caching.
Example 6: Query All DNS Records (-a)
The -a flag (equivalent to -v -t ANY) attempts to retrieve all available DNS records for a domain. This provides comprehensive information.
host -a example.com
Trying "example.com"
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 15243
;; flags: qr rd ra; QUERY: 1, ANSWER: 6, AUTHORITY: 0, ADDITIONAL: 0
;; QUESTION SECTION:
;example.com. IN ANY
;; ANSWER SECTION:
example.com. 86400 IN A 93.184.216.34
example.com. 86400 IN AAAA 2606:2800:220:1:248:1893:25c8:1946
example.com. 86400 IN NS a.iana-servers.net.
example.com. 86400 IN NS b.iana-servers.net.
example.com. 86400 IN SOA ns.icann.org. noc.dns.icann.org. 2024110401 7200 3600 1209600 3600
example.com. 86400 IN TXT "v=spf1 -all"
Received 245 bytes from 192.168.1.1#53 in 45 ms
Comprehensive Record Query:
- ANY query: Requests all record types (though some servers limit this)
- Complete picture: See all DNS configuration at once
- A and AAAA: Both IPv4 and IPv6 addresses
- NS records: Authoritative name servers for domain
- SOA record: Zone authority information and serial number
- TXT records: Text data including SPF, verification tokens
- Server limitations: Some DNS servers restrict ANY queries for security
- Alternative: If -a returns limited results, query each record type separately
Domain Investigation: Use host -a domain.com when taking over a domain or troubleshooting configuration. Reveals complete DNS setup in one command.
Example 7: Set Query Timeout (-W)
The -W option sets the timeout period for DNS queries. Useful when dealing with slow or unreliable DNS servers.
host -W 10 slow-server.example.com
slow-server.example.com has address 192.0.2.45
host -W 2 unreachable.example.com 203.0.113.1
;; connection timed out; no servers could be reached
time host -W 1 google.com
google.com has address 142.250.80.46
google.com has IPv6 address 2607:f8b0:4004:c07::8b
real 0m0.045s
user 0m0.008s
sys 0m0.004s
Timeout Configuration:
- -W seconds: Maximum time to wait for response
- Default timeout: Usually 5 seconds if not specified
- Network issues: Helps identify if problem is slow DNS or network connectivity
- Script automation: Prevents scripts from hanging on slow queries
- Fast failure: Lower timeout forces quick failure for unreachable servers
- Time command: Use with time to measure actual query duration
- Production monitoring: Set appropriate timeouts for health checks
- Retry behavior: host may retry if first attempt times out
Monitoring Script: Use short timeout in scripts: host -W 3 service.example.com || echo "DNS lookup failed". Prevents monitoring delays from slow DNS.
Example 8: Disable Recursion (-r)
The -r flag disables recursive queries, asking only the specified DNS server without following referrals. Useful for testing authoritative servers.
host -r example.com a.iana-servers.net
Using domain server:
Name: a.iana-servers.net
Address: 199.43.135.53#53
Aliases:
example.com has address 93.184.216.34
example.com has IPv6 address 2606:2800:220:1:248:1893:25c8:1946
example.com mail is handled by 0 .
host -r google.com 8.8.8.8
Using domain server:
Name: 8.8.8.8
Address: 8.8.8.8#53
Aliases:
google.com has address 142.250.80.46
google.com has IPv6 address 2607:f8b0:4004:c07::8b
google.com mail is handled by 10 smtp.google.com.
Recursive vs Non-Recursive Queries:
- Recursive (default): DNS server follows referrals to get final answer
- Non-recursive (-r): Server only returns what it knows directly
- Authoritative check: Test if server is authoritative for domain
- Caching behavior: Non-recursive bypasses cache in some cases
- Root servers: Root DNS servers only respond to non-recursive queries
- Testing setup: Verify authoritative nameservers configured correctly
- Referral chains: Without recursion, may get NS referrals instead of answers
- Performance: Recursive queries do more work but give complete answers
Authoritative Test: Query domain's own nameservers: host -r domain.com ns1.domain.com. Should return immediate answer since it's authoritative.
Example 9: Multiple Domain Lookups in Scripts
The host command integrates well into shell scripts for batch processing, monitoring, and automation tasks.
cat check_domains.sh
#!/bin/bash
# Check if multiple domains resolve correctly
DOMAINS="google.com github.com stackoverflow.com reddit.com"
for domain in $DOMAINS; do
echo "Checking $domain..."
if host "$domain" > /dev/null 2>&1; then
IP=$(host "$domain" | grep "has address" | head -1 | awk '{print $4}')
echo " ✓ $domain resolves to $IP"
else
echo " ✗ $domain failed to resolve"
fi
done
./check_domains.sh
Checking google.com...
✓ google.com resolves to 142.250.80.46
Checking github.com...
✓ github.com resolves to 140.82.114.4
Checking stackoverflow.com...
✓ stackoverflow.com resolves to 151.101.1.69
Checking reddit.com...
✓ reddit.com resolves to 151.101.129.140
cat mx_check.sh
#!/bin/bash
# Check MX records for email domain
DOMAIN="$1"
if [ -z "$DOMAIN" ]; then
echo "Usage: $0 <domain>"
exit 1
fi
echo "Mail servers for $DOMAIN:"
host -t MX "$DOMAIN" | grep "mail is handled" | while read -r line; do
priority=$(echo "$line" | awk '{print $5}')
server=$(echo "$line" | awk '{print $6}')
echo " Priority $priority: $server"
done
./mx_check.sh google.com
Mail servers for google.com:
Priority 10: smtp.google.com.
Scripting with host:
- Exit codes: 0 = success, non-zero = failure (use with if statements)
- Output parsing: Use grep, awk, cut to extract specific information
- Redirect stderr: 2>&1 captures errors for cleaner output
- Null output: > /dev/null hides output when only checking success
- Batch processing: Loop through domain lists from files
- Monitoring: Check DNS health periodically with cron jobs
- Error handling: Always check exit codes and provide feedback
- Timeout integration: Add -W flag to prevent script hangs
Production Monitoring: if ! host -W 5 critical.example.com > /dev/null; then send_alert "DNS down"; fi. Simple but effective monitoring.
Example 10: Check DNSSEC Validation
While host doesn't have built-in DNSSEC validation display, you can check if a domain uses DNSSEC by querying for DNSKEY and DS records.
host -t DNSKEY example.com
example.com has DNSKEY record 256 3 13 6saiq99qDBhjMBKCNMX1D4gJLHPEBYcT6lK7mT0InfqBJo4SLwTTAQVE wjMi9wvlGHj6GDxiVHWuE8JKQqJSBA==
example.com has DNSKEY record 257 3 13 8PDw1vCpOZGZ1uy7ZLcYUJpKuwD+5DpH7HKYzOvFXb2jMOJBPUyE KR5B5xI4EvgOKWRDbQsBLETlEj4vjXA8BQ==
host -t DS example.com
example.com has DS record 31589 13 1 3490A6806D47F17A34C29E2CE80E8A999FFBE4BE
example.com has DS record 31589 13 2 3079AB2889D743CE9DCCC84CE73F8ACAC36F04CBAF0A65D9178193A3A9A 2F88A
host -t DNSKEY cloudflare.com
cloudflare.com has DNSKEY record 257 3 13 mdsswUyr3DPW132mOi8V9xESWE8jTo0dxCjjnopKl+GqJxpVXckHAeF+ KkxLbxILfDLUT0rAK9iUzy1L53eKGQ==
host -t DS nodomain-dnssec.test
Host nodomain-dnssec.test not found: 3(NXDOMAIN)
DNSSEC Record Types:
- DNSKEY: Public keys used to verify DNS signatures
- DS (Delegation Signer): Hash of child zone's DNSKEY, stored in parent zone
- RRSIG: Cryptographic signature of DNS records (not shown by default)
- Security enhancement: DNSSEC prevents DNS spoofing and cache poisoning
- Chain of trust: DS records link parent and child zones securely
- KSK vs ZSK: Key-Signing Key (257) and Zone-Signing Key (256)
- Not universal: Many domains don't implement DNSSEC yet
- Validation: Requires DNSSEC-aware resolver to actually validate
DNSSEC Check: Presence of DNSKEY and DS records indicates DNSSEC is configured. For full validation testing, use dig +dnssec which shows more detail.