Web Server Rescue
Read-onlyShow the DNS Answer TTL
You need to see how long a DNS answer can remain cached.
Command
dig +noall +answer example.com ABefore you run this
System impact: Read-only. Low when scoped to the shown target.
When not to use it: Do not treat the displayed TTL as the original zone TTL after a resolver has already cached it.
Expected output
A DNS answer line showing name, TTL, class, type, and value.
System impact
Read-only. Nothing changes. The command prints the answer section including TTL.
Recovery / rollback: no state is changed.
When to use it
Use during DNS cutovers or when deciding whether stale answers are expected.
When not to use it
Do not treat the displayed TTL as the original zone TTL after a resolver has already cached it.
next steps
Related commands
Compare DNS Answers Across Resolvers
One resolver can still have the old edge IP while another has the new one.
for r in 1.1.1.1 8.8.8.8 9.9.9.9; do printf '%s ' "$r"; dig @"$r" +short example.com A; done
Compare A and AAAA Records
IPv4 worked. IPv6 sent users to a different edge.
printf 'A '; dig +short example.com A; printf 'AAAA '; dig +short example.com AAAA
Compare Authoritative Nameserver Answers
The recursive resolver was not the problem. One nameserver disagreed.
for ns in $(dig +short NS example.com); do printf '%s ' "$ns"; dig @"$ns" +short example.com A; done
Check CAA Certificate Issuers
The certificate request failed because DNS allowed the wrong issuer.
dig +short example.com CAA
Show TLS Certificate Names
The cert was valid, but not for this hostname.
openssl s_client -connect example.com:443 -servername example.com </dev/null 2>/dev/null | openssl x509 -noout -subject -ext subjectAltName
Study mapping
Use this as independent command practice: read the notes, predict the output, then compare it with the example before using a real shell.
Independent study support only. No affiliation, endorsement, exam dumps, or real exam questions.