I'm trying to learn more about the dig command and have come across the -x option which is meant for reverse lookup, i.e. you give an IP address and get back a domain name.

I tried doing dig -x www.google.com which I guess doesn't really make sense with the -x option, but I got back this response:

; <<>> DiG 9.9.4-RedHat-9.9.4-29.el7_2.3 <<>> -x www.google.com
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NXDOMAIN, id: 2959
;; flags: qr rd ra ad; QUERY: 1, ANSWER: 0, AUTHORITY: 1, ADDITIONAL: 1

; EDNS: version: 0, flags:; udp: 4096
;com.google.www.in-addr.arpa.   IN  PTR

in-addr.arpa.       3180    IN  SOA b.in-addr-servers.arpa. nstld.iana.org. 2015074802 1800 900 604800 3600

;; Query time: 0 msec
;; WHEN: Sun Oct 16 17:06:24 PDT 2016
;; MSG SIZE  rcvd: 124

Can anybody help me get a better understanding of what this reponse tells us, I thought you weren't supposed to use the -x option with a domain name.


Notice in the response that you got back status: NXDOMAIN and ANSWER: 0. This means there was no record found matching your query.

The -x option to dig is merely a convenience for constructing a PTR query. It splits on dots, reverses it, appends in-addr.arpa., and sets the type to PTR.

The information you did get back is the SOA record for the authoritative domain (in-addr.arpa), and is for result caching. Negative lookups (queries which have no results) can be cached for a duration as specified in the SOA record.

See RFC-2308:

Name servers authoritative for a zone MUST include the SOA record of the zone in the authority section of the response when reporting an NXDOMAIN or indicating that no data of the requested type exists. This is required so that the response may be cached. The TTL of this record is set from the minimum of the MINIMUM field of the SOA record and the TTL of the SOA itself, and indicates how long a resolver may cache the negative answer.


It does not return an address record. The DNS request fails successfully. The -x wants an IP address to prepend to .in-addr.arpa.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.