Which Resolver Answered?

"DNS is fine, I checked" is one of the most expensive sentences on an incident call — because the person who said it checked a resolver, and the failing app uses a different one. A name does not have one answer; it has one answer per resolver. So rung 1 isn't "does it resolve?" — it's "does it resolve from the resolver the app uses?"

Pin the resolver with @

dig uses your default resolver unless you tell it otherwise. Name it explicitly with @ and compare:

dig +short @8.8.8.8 api.internal      # a public resolver
dig +short @10.0.0.2  api.internal    # your VPC / corporate resolver

An internal name will resolve from 10.0.0.2 and return nothing from 8.8.8.8 — because a public resolver has never heard of your private zone. Same name, two truths. The SERVER: line from the last lesson is how you prove which one you actually asked.

Where your default comes from

When you don't say @, the resolver is chosen for you:

/etc/resolv.conf

The file listing your default nameserver IPs. cat it to see who your box asks by default — the answer to "what does dig use when I omit @?".

Stub resolver

The local client (in your libc, or systemd-resolved) that reads resolv.conf and forwards the query. Often 127.0.0.53 on modern distros.

Recursive resolver

The server that does the legwork — walking from the root down to the authoritative server and caching the result. This is the 8.8.8.8 or 10.0.0.2 in your config.

Authoritative server

The server that actually owns the zone and gives the original answer. Everyone else is quoting it from cache.

Watch the whole walk with +trace

To see a name resolved from the root down — stub asks recursive, recursive asks root, then the .com servers, then the zone's authoritative server — bypass the cache and trace it:

dig +trace example.com

Each block is one hop closer to the authoritative answer. You rarely need this on call, but running it once makes "recursive vs authoritative" stop being words.

Next: when a lookup doesn't work, dig tells you which kind of "no" it is — and, exactly like refused versus timeout, each kind rules different things out.