10

I'm writing a script that needs to query DNS record with a user specified DNS server. The DNS server may be in any protocol, including UDP, TCP, DNS over HTTPS (DoH), and DNS over TLS (DoT).

I know dig is able to handle DNS for UDP and TCP (with +tcp flag). Is there a way I can use dig or other tool to query DoH and DoT server?

I prefer already existing popular tools like curl so my script would be more portable, but other suggestions are welcomed as well.

1
  • 1
    Here's one tool I found that uses curl for DoH query: github.com/curl/doh. It doesn't support DoT though. – Shou Ya Mar 15 '20 at 21:17
11

I didn't find a single tool for both the purpose, but I did find ways to use them.

There are two ways to query DoH:

# json
curl -H 'accept: application/dns-json' 'https://cloudflare-dns.com/dns-query?name=example.com&type=A' | jq .
# dns wireformat
curl -H 'accept: application/dns-message' 'https://dns.google/dns-query?dns=q80BAAABAAAAAAAAA3d3dwdleGFtcGxlA2NvbQAAAQAB'  | hexdump -c

For DoT, you can use kdig tool provided by knot. The command line is similar to dig:

apt-get install knot-dnsutils
# For macOS:
# brew install knot
kdig -d @8.8.8.8 +tls-ca +tls-host=dns.google.com example.com

where the 8.8.8.8 is the pre-resolved address of the tls host (dns.google.com).


Update: Here is a tool (https://github.com/ameshkov/dnslookup) that supports all major DNS protocols on its own and is able to produce machine-readable output.

3
5

curl has official DoH support since version 7.62.0 (the question is how many of your target endpoints have curl uptodate to this version.)

Use it by utilizing the --doh-url option. Example:

curl --doh-url https://cloudflare-dns.com/dns-query https://www.google.com

See: https://github.com/curl/curl/wiki/DOH-implementation https://daniel.haxx.se/blog/2018/09/06/doh-in-curl/

1

Dog is a dig alternative written in Rust and supporting DOH/DOT. installation

Examples:

dog -H @https://dns.google/dns-query google.com

dog google.com --tls @dns.google

It can also output as json.

0

If dig is compiled to support it +tls:

dig @127.0.0.1 google.com +tls

; <<>> DiG 9.17.8 <<>> @127.0.0.1 google.com +tls
; (1 server found)
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 54991
;; flags: qr rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 1

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 1232
; COOKIE: 065928dae0bd1d28010000005fdd61d904c6723221991bf3 (good)
;; QUESTION SECTION:
;google.com.                    IN      A

;; ANSWER SECTION:
google.com.             300     IN      A       172.217.0.238

;; Query time: 1123 msec
;; SERVER: 127.0.0.1**#853**(127.0.0.1) **(TLS)**
;; WHEN: Sat Dec 19 02:13:45 UTC 2020
;; MSG SIZE  rcvd: 83
0

There is q (https://github.com/natesales/q) which supports DNS-over-QUIC as well as DNS-over-TLS and DNS-over-HTTPS. It also supports DNSSEC.

Some examples of queries and responses.

# DOH
$ q --dnssec A AAAA example.com @https://dns.example.com
example.com. 23h57m40s A 127.0.0.1

#DOT
$ q --dnssec A AAAA example.com @tls://dns.example.com
example.com. 23h57m40s A 127.0.0.1
example.com. 23h57m40s RRSIG A 8 2 86400 20210416051959 20210325232537 45150 example.com. N40WYg7CBxSc.....

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.