One CLI for Every DNS Protocol You'll Ever Need to Debug

You're debugging a DNS issue. Maybe it's a misbehaving resolver, a certificate problem on your DoH endpoint, or a DNSCrypt server that just won't answer. You reach for dig, and it handles plain DNS fine—but the moment you need to test DNS-over-QUIC or check a DNSCrypt stamp, you're stuck juggling four different tools. dnslookup is a single command line utility that speaks every DNS protocol you're likely to encounter, from plain DNS to DoQ, all through one consistent interface.

What It Does

dnslookup is a simple command line tool for making DNS lookups. It's written in Go and supports plain DNS, plain DNS-over-TCP, DNS-over-HTTPS (DoH), DNS-over-TLS (DoT), DNS-over-QUIC (DoQ), and DNSCrypt. Instead of remembering different flags and syntaxes for each protocol, you tell dnslookup which protocol you want by the shape of the server address you pass in—tcp://, tls://, https://, quic://, or an sdns:// stamp for DNSCrypt.

The tool handles the protocol details for you. It'll negotiate HTTP/2 or HTTP/3 for DoH automatically, recognize IP addresses and turn them into PTR queries, and let you set resource record types, query classes, and a range of EDNS options through environment variables. Output is human-readable by default, but you can flip it to JSON for scripting.

Why It's Cool

One tool, every protocol. The real value here is consolidation. If you've ever tried to verify that your DoQ server is actually responding correctly, you know the pain of finding a client that supports it. dnslookup means you learn one syntax and it works across all the major encrypted DNS transports. That's a genuine quality-of-life improvement for anyone working with modern DNS infrastructure.

The address scheme is the interface. Rather than adding a --protocol flag, dnslookup infers the transport from the URL prefix. tls://dns.adguard-dns.com is DoT. quic://9.9.9.9 is DoQ. https://dns.google/dns-query is DoH. It's a small design decision that makes the tool feel lighter—you're describing where to send the query, not configuring a client.

Sensible defaults with escape hatches. It defaults to an A record lookup against your system resolver, which is what you want 90% of the time. But when you need more, the options are there: RRTYPE=AAAA for IPv6 records, RRTYPE=HTTPS for HTTPS records, CLASS=CH for chaos class queries, DNSSEC=1 to set the DO bit, SUBNET=1.2.3.4/24 for EDNS client subnet, and PAD=1 for EDNS0 padding. All through environment variables, which keeps the command line itself clean.

Practical touches for real debugging. The VERBOSE=1 flag gives you detailed logging when something goes wrong. VERIFY=0 disables certificate verification—useful when you're testing a local DoT server with a self-signed cert. JSON=1 gives you machine-readable output for piping into jq or a script. And the EDNSOPT=code:value escape hatch lets you craft arbitrary EDNS options, which is the kind of thing that's invaluable when you're debugging obscure resolver behavior.

DNSCrypt support without the hassle. DNSCrypt is often overlooked, but dnslookup handles it both via stamps (sdns://...) and via explicit parameters (IP, provider name, and public key). If you're running a DNSCrypt server or need to verify one, this saves you from hunting down a separate client.

How to Try It

Installation is straightforward. Pick whichever method fits your setup:

Using Homebrew:

brew install ameshkov/tap/dnslookup

From source (requires Go):

go install github.com/ameshkov/dnslookup@latest

You can also grab a binary from the releases page or install from the Snap Store.

Once installed, start simple:

# Query your system resolver
dnslookup example.org

# Query a specific plain DNS server
dnslookup example.org 94.140.14.14

# Try DNS-over-TLS
dnslookup example.org tls://dns.adguard-dns.com

# Try DNS-over-HTTPS
dnslookup example.org https://dns.adguard-dns.com/dns-query

# Try DNS-over-QUIC
dnslookup example.org quic://dns.adguard-dns.com

Then start layering on options. Look up an IPv6 address:

RRTYPE=AAAA dnslookup example.org tls://127.0.0.1

Get JSON output:

JSON=1 dnslookup example.org 94.140.14.14

Check a PTR record by passing an IP directly:

dnslookup 8.8.8.8

The repository has plenty more examples covering DNSCrypt, EDNS options, and combined flags. Check it out at github.com/ameshkov/dnslookup.

Final Thoughts

dnslookup isn't trying to be a full-featured DNS swiss army knife like dig or drill. It's a focused tool that does one thing well: make a DNS query over whatever protocol you specify and show you the result. That focus is what makes it useful. If you work with encrypted DNS—whether you're running a resolver, debugging a client, or just curious about how DoH and DoQ behave in practice—this is a tool worth having in your path. It's small, it's fast, and it removes the friction of testing modern DNS protocols.