VMware ESXi and vSphere Cluster Management

Linux host Command: DNS Lookups and Record Queries

Learn how to use the Linux host command for forward and reverse DNS lookups, specific record queries, SOA checks, resolver comparison, and troubleshooting.

The Linux host command is a command-line DNS lookup utility. It sends DNS queries to a resolver or name server and displays the DNS records returned.

Its two most common jobs are resolving a hostname to one or more IP addresses and performing a reverse lookup from an IP address to a hostname. It can also query specific record types such as NS, MX, TXT, and SOA.

DNS and the host Command

DNS, the Domain Name System, maps names and other data to records distributed across DNS servers. A hostname is a domain name used to identify a host or service, such as www.example.com. An IP address is a numeric network address, either IPv4 or IPv6.

A DNS resolver receives a query and obtains an answer, often from its cache or by asking other DNS servers. An authoritative name server holds the official records for a DNS zone, which is an administrative portion of the DNS namespace.

Use host when you need a short, readable DNS result. For more protocol details, tracing, and diagnostic controls, the dig command is usually more suitable.

Basic Syntax and Help Output

The general syntax is:

host [options] name [server]

• options modify the record type or output.
• name is the hostname, domain name, or IP address to query.
• server is an optional DNS server to use instead of the system-configured resolver.

Running host without a query target normally prints a short usage summary:

host

The exact help text varies by implementation. In general, it lists the command form and available options. Options change what DNS data is requested or how results are displayed.

Forward Hostname Lookups

A forward lookup starts with a hostname and requests address or related records. Query a fully qualified domain name (FQDN) like this:

host example.com

A successful result may include an IPv4 A record, an IPv6 AAAA record, or both. Typical wording includes:

example.com has address 192.0.2.10
example.com has IPv6 address 2001:db8::10

The phrase has address indicates an IPv4 address. The phrase has IPv6 address indicates an IPv6 address. Real output depends on the domain's records and the resolver's answer.

To request IPv6 data explicitly, use:

host -t AAAA example.com

Reverse IP Address Lookups

A reverse lookup starts with an IP address and requests a PTR record. IPv4 reverse names use the in-addr.arpa namespace; IPv6 reverse names use ip6.arpa. The host command constructs the reverse query for you.

host 8.8.8.8

An answer might identify a hostname associated with the address. Reverse DNS is controlled by the owner of the address space, so an IP address may have no PTR record. In that case, the lookup can report that no name is associated with the address. Missing reverse DNS does not by itself mean that the address or host is invalid.

IPv6 addresses can also be supplied directly:

host 2001:db8::10

Querying Specific DNS Record Types

Use -t TYPE to select a DNS record type:

host -t TYPE name

Targeted queries are generally clearer and more dependable than asking for every possible record.

NS Records

An NS record identifies the authoritative name servers for a zone:

host -t NS example.com

This is useful when checking delegation or deciding which authoritative servers to query directly.

TXT Records

TXT records carry text data. Common uses include domain-verification tokens and email-policy information such as SPF-related data and other service configuration:

host -t TXT example.com

TXT output can contain long strings and multiple records. Read each returned value in the context of the service that published it.

SOA Records

The SOA, or Start of Authority, record describes important administrative and timing information for a DNS zone:

host -t SOA example.com

Its fields include:

• Primary name server: the name server listed as the zone's primary source.
• Responsible party: an email-style contact represented in DNS notation.
• Serial number: the zone data version used when comparing copies.
• Refresh: how often secondary servers should check for changes.
• Retry: how long a secondary should wait before retrying a failed check.
• Expire: how long a secondary may continue serving data when it cannot refresh the zone.
• Negative-cache TTL: how long negative answers may be cached.

Frequently Used Record Types

SOA Consistency Checking

The -C option checks SOA consistency across a zone's authoritative name servers:

host -C example.com

This is different from host -t SOA example.com. The latter requests and displays an SOA record through the selected resolver. The -C check discovers the zone's authoritative servers and compares their SOA data.

Different serial numbers can indicate that one authoritative server has stale data or that a zone transfer or publication has not completed. Other differing SOA values can also point to inconsistent zone configuration. Investigate the authoritative servers, zone-transfer status, replication, or DNS provider publication state.

All-Record and Verbose Queries

The -a option requests verbose output and an ANY-style query:

host -a example.com

An ANY query asks for broad information about available record types. Modern authoritative servers commonly minimize, restrict, or refuse ANY responses for security and traffic-management reasons. A small response does not prove that the zone has no other records.

For reliable results, ask for the type you need:

host -t A example.com
host -t AAAA example.com
host -t MX example.com
host -t TXT example.com

Choosing a DNS Server

Without a server argument, host uses the system-configured resolver, commonly selected through the operating system's DNS configuration. Append a DNS server address or hostname to query a specific server:

host example.com 1.1.1.1

This can bypass the default resolver for comparison testing. You can also query a known authoritative name server:

host -t SOA example.com ns1.example.net

Comparing answers from the default resolver, another public resolver, and an authoritative server can reveal caching differences, stale data, delegation problems, or propagation delays.

Interpreting DNS Responses and Errors

NXDOMAIN Versus SERVFAIL

NXDOMAIN is an authoritative negative answer stating that the requested domain name does not exist. It is different from a temporary inability to answer. SERVFAIL means the responding DNS server failed to complete the query; it does not necessarily mean the name does not exist.

Practical Troubleshooting Sequence

1. Verify the spelling and query a fully qualified domain name.
2. Run a normal lookup with host name.
3. Repeat it against another resolver, for example host name 1.1.1.1.
4. Use host -t NS name to identify authoritative name servers.
5. Query the relevant record type directly, such as A, AAAA, MX, or TXT.
6. For suspected propagation or synchronization problems, run host -C name and compare SOA serial numbers.
7. For a timeout, check local network access, firewall rules, and whether DNS traffic to the selected server is permitted.
8. For deeper failures such as DNSSEC or delegation issues, use dig for expanded diagnostic output.

Key Exam Notes

• host name performs a forward lookup; returned address records are usually A and AAAA.
• host IP-address performs a reverse lookup using a PTR record.
• -t TYPE selects a record type, such as NS, TXT, or SOA.
• -C compares SOA consistency among authoritative name servers; it is not merely an SOA display query.
• -a makes an ANY-style, verbose request, but servers may restrict or refuse it.
• An appended server argument selects the DNS resolver or name server to query.
• NXDOMAIN means the name does not exist, while SERVFAIL indicates that the server could not complete the query.