host is a simple utility for performing DNS lookups. It's part of the BIND utilities and provides quick DNS resolution without the complexity of dig.
Basic Usage
- host <hostname> - Basic lookup
- host <ip> - Reverse lookup
- host <hostname> <dns-server> - Use specific DNS server
Query Types
- host -t A <hostname> - IPv4 address
- host -t AAAA <hostname> - IPv6 address
- host -t MX <hostname> - Mail servers
- host -t NS <hostname> - Name servers
- host -t TXT <hostname> - TXT records
- host -t CNAME <hostname> - Canonical name
- host -t SOA <hostname> - Start of authority
- host -t PTR <ip> - Pointer record (reverse)
- host -t ANY <hostname> - All records
Options
- -a - Equivalent to -v -t ANY
- -v - Verbose output
- -l - Zone transfer (AXFR)
- -C - Compare SOA records from all NS
- -4 - Use IPv4 only
- -6 - Use IPv6 only
- -r - Non-recursive query
- -T - Use TCP instead of UDP
- -W <seconds> - Wait timeout
- -R <number> - Number of retries
Common Examples
Basic Lookup
host example.comGet IP addresses for domain.
Reverse Lookup
host 8.8.8.8Find hostname for IP.
MX Records
host -t MX example.comFind mail servers.
Name Servers
host -t NS example.comFind authoritative name servers.
TXT Records
host -t TXT example.comGet TXT records (SPF, DKIM, etc.).
Use Specific DNS
host example.com 8.8.8.8Query using Google DNS.
All Records
host -a example.comVerbose output with all record types.
Zone Transfer (AXFR)
host -l example.com ns1.example.comAttempt zone transfer (usually blocked).
SOA Record
host -t SOA example.comGet start of authority info.
Compare NS Records
host -C example.comCompare SOA from all name servers.
Output Examples
A Record Output
$ host example.com
example.com has address 93.184.216.34
example.com has IPv6 address 2606:2800:220:1:248:1893:25c8:1946MX Record Output
$ host -t MX example.com
example.com mail is handled by 10 mail.example.com.Reverse Lookup Output
$ host 8.8.8.8
8.8.8.8.in-addr.arpa domain name pointer dns.google.Comparison with Other Tools
host vs dig
- host - Simple, quick, human-readable
- dig - Detailed, more options, scriptable
host vs nslookup
- host - Simpler output, CLI focused
- nslookup - Interactive mode, legacy tool
Tips
- Use for quick DNS lookups
- Try zone transfers (-l) during recon
- Check MX records for mail server enumeration
- Use -t TXT to find SPF/DKIM records
- Query different DNS servers to compare
- Use dig for more detailed analysis
- Great for quick command-line lookups
- Reverse lookups can reveal shared hosting