DNS check script: compare answers from several resolvers

After you change a DNS record, or when a site works for a colleague but not for you, the question is “who sees what?”. This script asks several resolvers the same question and lines up the answers. It only needs dig (package dnsutils on Debian and Ubuntu, bind-utils on RHEL family; preinstalled on macOS).

The script

#!/usr/bin/env bash
set -uo pipefail

RESOLVERS=${RESOLVERS:-"system 1.1.1.1 9.9.9.9 8.8.8.8"}
TYPE=${TYPE:-A}

if (( $# < 1 )); then
  echo "usage: $0 name [name ...]" >&2
  echo "  TYPE=AAAA|MX|TXT|CNAME $0 name      record type (default A)" >&2
  echo "  RESOLVERS=\"system 1.1.1.1\" $0 name  resolvers to compare" >&2
  exit 2
fi
command -v dig >/dev/null 2>&1 || { echo "dig not found (package dnsutils or bind-utils)" >&2; exit 2; }

status=0
for name in "$@"; do
  echo "== $name ($TYPE)"
  declare -A seen=()
  for r in $RESOLVERS; do
    if [[ $r == system ]]; then
      out=$(dig +short +time=3 +tries=1 "$name" "$TYPE" 2>&1)
      ttl=$(dig +noall +answer +time=3 +tries=1 "$name" "$TYPE" 2>/dev/null | awk '{print $2; exit}')
    else
      out=$(dig +short +time=3 +tries=1 "@$r" "$name" "$TYPE" 2>&1)
      ttl=$(dig +noall +answer +time=3 +tries=1 "@$r" "$name" "$TYPE" 2>/dev/null | awk '{print $2; exit}')
    fi
    if [[ -z $out ]]; then
      answer="(no answer)"
    elif [[ $out == *"connection timed out"* ]]; then
      answer="(timeout)"
    else
      answer=$(echo "$out" | sort | paste -sd ' ' -)
    fi
    seen["$answer"]=1
    printf '  %-12s %-50s ttl=%s\n' "$r" "$answer" "${ttl:--}"
  done
  if (( ${#seen[@]} > 1 )); then
    echo "  WARN: resolvers disagree (propagation in progress, split-horizon DNS or a stale cache)"
    status=1
  fi
  if grep -qE "^[^#]*[[:space:]]$name([[:space:]]|$)" /etc/hosts 2>/dev/null; then
    echo "  NOTE: /etc/hosts has an entry for $name; local programs will use it instead of DNS"
  fi
  unset seen
done
exit $status

How to use it

chmod +x dnscheck.sh
./dnscheck.sh example.com www.example.com
TYPE=MX ./dnscheck.sh example.com
RESOLVERS="system 1.1.1.1 ns1.example-dns.net" ./dnscheck.sh app.example.com

== app.example.com (A)
  system       192.0.2.10                                         ttl=287
  1.1.1.1      198.51.100.7                                       ttl=60
  9.9.9.9      198.51.100.7                                       ttl=60
  8.8.8.8      198.51.100.7                                       ttl=55
  WARN: resolvers disagree (propagation in progress, split-horizon DNS or a stale cache)

Reading the output

• All the same: DNS is consistent; if the site still fails, the problem is the connection or the service, not the name.
• Your system resolver differs from the public ones with a high TTL: your local resolver (router, ISP, systemd-resolved) still caches the old record. Wait for the TTL to run out, or flush it (resolvectl flush-caches on Linux with systemd-resolved, sudo dscacheutil -flushcache; sudo killall -HUP mDNSResponder on macOS).
• Only your system resolver answers and the public ones return nothing: the name exists only on an internal DNS server (split-horizon). That is expected inside company networks and VPNs.
• Public resolvers disagree with each other: the change is still propagating. Adding the authoritative name server to RESOLVERS shows the value that will eventually win.
• NOTE about /etc/hosts: a line there beats every resolver for programs on this machine, which is a classic source of “it only breaks on my laptop”.

Official documentation

• dig: DNS lookup utility (BIND 9 manual)
• resolvectl(1)