Use host to Test DNS Answers Without Guessing

A site that "works for me but not for them" is often a DNS question in disguise, and host answers it faster than opening a browser. This guide builds a small set of repeatable DNS checks: resolve a name, run a reverse lookup, ask for a particular record type, and compare answers from a chosen name server. The examples use BIND 9 host version 9.18.39-0ubuntu0.24.04.7-Ubuntu, provided here by bind9-host.

Allow about ten minutes. You need a shell and network access for the public DNS examples. The commands are read-only: they do not edit DNS, restart a resolver or require elevated privileges. Your answers may differ from the examples because DNS is distributed and can change under you.

1. Check the installed command

Confirm which program is on your path and record its version:

$ command -v host
/usr/bin/host
$ host -V
host 9.18.39-0ubuntu0.24.04.7-Ubuntu

The local manpage is the contract for this installed build. If host is missing, install the distribution package that provides bind9-host through your normal package-management process; that is an administrative change, so do not add installation commands to a troubleshooting script unless the machine's change policy allows it.

2. Resolve a name with the configured resolver

With just a name, host queries the name servers listed in /etc/resolv.conf:

$ host example.com
example.com has address 172.66.147.243
example.com has address 104.20.23.154

Those addresses illustrate the output shape, not a promise about today's answer: a successful lookup can return several A or AAAA records, and a DNS provider may change them. For a local check whose answer is stable on most Linux hosts, use:

$ host localhost
localhost has address 127.0.0.1
localhost has IPv6 address ::1

If the command says the name was not found, check the spelling first. If it times out, compare the resolver and network path before treating that as evidence the domain is absent.

3. Ask for one record type

Use -t when the question is specific, so you do not mistake the command's default selection for a complete inventory:

$ host -t MX example.com
example.com mail is handled by 0 .
$ host -t NS example.com
example.com name server hera.ns.cloudflare.com.
example.com name server elliott.ns.cloudflare.com.

With no type supplied, the installed command automatically looks for A, AAAA and MX records, and it can query recognised types such as CNAME, NS, SOA, TXT and DNSKEY. Ask for the exact type you need, then read the result as a DNS answer, not as proof every other type exists.

For an authoritative-zone health check, -C asks for SOA records from every listed authoritative server. This sends more queries than an ordinary lookup, so save it for a domain you administer or have permission to inspect:

$ host -C example.com
Nameserver 172.64.35.228:
	example.com has SOA record elliott.ns.cloudflare.com. dns.cloudflare.com. 2415729022 10000 2400 604800 1800
Nameserver 108.162.192.162:
	example.com has SOA record elliott.ns.cloudflare.com. dns.cloudflare.com. 2415729022 10000 2400 604800 1800

The exact response depends on the zone. A refusal or timeout is a result to investigate, not a reason to retry indefinitely.

4. Reverse-resolve an address

Pass an IPv4 or IPv6 address as the name and host selects a PTR query automatically:

$ host 127.0.0.1
1.0.0.127.in-addr.arpa domain name pointer localhost.
$ host ::1
1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.ip6.arpa domain name pointer ip6-localhost.
1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.ip6.arpa domain name pointer ip6-loopback.

Reverse DNS is separate data from forward DNS. A forward lookup can succeed while the reverse lookup has no PTR record, and a PTR name is not proof the address is trustworthy. For logs or access controls, treat it as a name to verify, not authentication.

5. Compare a particular name server

Add a server name or address as the final argument when you need to take the configured resolver out of the comparison:

$ host -W 2 -t A example.com 1.1.1.1
Using domain server:
Name: 1.1.1.1
Address: 1.1.1.1#53
Aliases:

example.com has address 172.66.147.243
example.com has address 104.20.23.154

That final argument is a DNS server, not a web server, and the normal DNS port is 53. Use -p only when your DNS service deliberately listens elsewhere, and confirm the network path actually permits the selected transport.

Use -W for a bounded wait; this example waits up to two seconds for a reply. The documented defaults are five seconds for UDP and ten seconds for TCP, with possible overrides from /etc/resolv.conf. Avoid -w in automation unless waiting forever is genuinely safe.

6. Inspect resolver configuration before changing it

Read the two resolver files separately. Ordinary users can inspect them; editing them normally needs elevated privileges and can disrupt every program that uses DNS:

$ sed -n '1,120p' /etc/resolv.conf
$ sed -n '1,120p' /etc/host.conf

/etc/resolv.conf supplies name servers, search or domain settings, and options such as ndots, timeout and attempts, which explain why a short name might expand unexpectedly or a lookup wait longer than you expect. host.conf is different: it configures parts of the glibc resolver library, not DNS records themselves.

• multi on makes the resolver library return all valid addresses for a host found in /etc/hosts, instead of only the first. It is off by default because a large hosts file makes this slower.
• reorder on attempts to put local addresses first.
• trim strips configured local suffixes from DNS-derived hostnames.

Do not expect host.conf to control the order of all host lookups: the manpage points to nsswitch.conf as the modern control for that. Also note that host is a DNS lookup utility, while getent hosts NAME exercises the system's name-service configuration, a better comparison when you are investigating /etc/hosts behaviour.

$ getent hosts localhost
::1             localhost ip6-localhost ip6-loopback

Environment variables can override parts of host.conf for a single process: RESOLV_HOST_CONF selects another configuration file, while RESOLV_MULTI, RESOLV_REORDER and the trim-related variables adjust specific settings. Check the environment before blaming a file you just read:

$ env | grep '^RESOLV_' || true

Do not export these variables globally as a quick fix. A wrapper, service unit or shell profile can make the behaviour hard to reproduce later. If you must test an override, put it on one command line and record it alongside the result.

7. Use diagnostic options carefully

-r clears the recursion-desired flag, useful when testing an authoritative or forwarding server, though a recursive resolver may then return a referral or no useful answer. -T forces TCP; ordinary queries use UDP, and queries that require TCP, such as zone transfers, select it automatically. -4 and -6 constrain the query transport to IPv4 or IPv6.

-v or -d prints debugging traces. The output is verbose and can include configuration details, so keep it out of routine logs if those logs are shared.