.1host：dns資訊
參數：
一般情況下，host查找的是a，aaaa，和mx的記錄
案例：
dns伺服器查詢
host -t ns 域名
a記錄和mx記錄查詢
host 域名（host -t a 域名 + host -t mx 域名）
ps：a (address) 記錄是用來指定主機名（或域名）對應的ip位址記錄。使用者可以将該域名下的網站伺服器指向到自己的web server上。同時也可以設定您域名的子域名。通俗來說a記錄就是伺服器的ip,域名綁定a記錄就是告訴dns,當你輸入域名的時候給你引導向設定在dns的a記錄所對應的伺服器。
ps：mx記錄也叫做郵件路由記錄，使用者可以将該域名下的郵件伺服器指向到自己的mail server上，然後即可自行操控所有的郵箱設定。您隻需線上填寫您伺服器的ip位址，即可将您域名下的郵件全部轉到您自己設定相應的郵件伺服器上。簡單的說，通過操作mx記錄，您才可以得到以您域名結尾的郵局。
4.2dig ：dns挖掘
root@kali:/home/dnt# dig -h
usage: dig [@global-server] [domain] [q-type] [q-class] {q-opt}
{global-d-opt} host [@local-server] {local-d-opt}
[ host [@local-server] {local-d-opt} [...]]
where: domain is in the domain name system
q-class is one of (in,hs,ch,...) [default: in]
q-type is one of (a,any,mx,ns,soa,hinfo,axfr,txt,...) [default:a]
(use ixfr=version for type ixfr)
q-opt is one of:
-x dot-notation (shortcut for reverse lookups)
-i (use ip6.int for ipv6 reverse lookups)
-f filename (batch mode)
-b address[#port] (bind to source address/port)
-p port (specify port number)
-q name (specify query name)
-t type (specify query type)
-c class (specify query class)
-k keyfile (specify tsig key file)
-y [hmac:]name:key (specify named base64 tsig key)
-4 (use ipv4 query transport only)
-6 (use ipv6 query transport only)
-m (enable memory usage debugging)
d-opt is of the form +keyword[=value], where keyword is:
+[no]vc (tcp mode)
+[no]tcp (tcp mode, alternate syntax)
+time=### (set query timeout) [5]
+tries=### (set number of udp attempts) [3]
+retry=### (set number of udp retries) [2]
+domain=### (set default domainname)
+bufsize=### (set edns0 max udp packet size)
+ndots=### (set ndots value)
+[no]edns[=###] (set edns version) [0]
+[no]search (set whether to use searchlist)
+[no]showsearch (search with intermediate results)
+[no]defname (ditto)
+[no]recurse (recursive mode)
+[no]ignore (don't revert to tcp for tc responses.)
+[no]fail (don't try next server on servfail)
+[no]besteffort (try to parse even illegal messages)
+[no]aaonly (set aa flag in query (+[no]aaflag))
+[no]adflag (set ad flag in query)
+[no]cdflag (set cd flag in query)
+[no]cl (control display of class in records)
+[no]cmd (control display of command line)
+[no]comments (control display of comment lines)
+[no]rrcomments (control display of per-record comments)
+[no]question (control display of question)
+[no]answer (control display of answer)
+[no]authority (control display of authority)
+[no]additional (control display of additional)
+[no]stats (control display of statistics)
+[no]short (disable everything except short
form of answer)
+[no]ttlid (control display of ttls in records)
+[no]all (set or clear all display flags)
+[no]qr (print question before sending)
+[no]nssearch (search all authoritative nameservers)
+[no]identify (id responders in short answers)
+[no]trace (trace delegation down from root [+dnssec])
+[no]dnssec (request dnssec records)
+[no]nsid (request name server id)
+[no]sigchase (chase dnssec signatures)
+trusted-key=#### (trusted key when chasing dnssec sigs)
+[no]topdown (do dnssec validation top down mode)
+[no]split=## (split hex/base64 fields into chunks)
+[no]multiline (print records in an expanded format)
+[no]onesoa (axfr prints only one soa record)
+[no]keepopen (keep the tcp socket open between queries)
global d-opts and servers (before host name) affect all queries.
local d-opts and servers (after host name) affect only that lookup.
-h (print help and exit)
-v (print version and exit)
常用：dig 域名 any
root@kali:/home/dnt# dig cnblogs.com any
; <<>> dig 9.9.5-9+deb8u2-debian <<>> cnblogs.com any
;; global options: +cmd
;; got answer:
;; ->>header<<- opcode: query, status: noerror, id: 18664
;; flags: qr rd ra; query: 1, answer: 2, authority: 0, additional: 0
;; question section:
;cnblogs.com. in any
;; answer section:
cnblogs.com. 5 in ns ns4.dnsv4.com.
cnblogs.com. 5 in ns ns3.dnsv4.com.
;; query time: 2010 msec
;; server: 192.168.232.2#53(192.168.232.2)
;; when: thu dec 24 23:19:22 cst 2015
;; msg size rcvd: 71
4.3ns lookup ：dns褲子
windows+linux都自帶
nslookup最簡單的用法就是查詢域名對應的ip位址，包括a記錄和cname記錄
幫助文檔：man nslookup
我們看看windows裡面的幫助文檔（明了一點）
常用指令：nslookup
0.設定預設伺服器
server 8.8.8.8
1.簡單查詢域名資訊
> set type=any
> cnblogs.com
2.查詢域名cname記錄(别名指向)
> set type=cname
3.查詢域名a記錄（通俗來說a記錄就是伺服器的ip，域名綁定a記錄就是告訴dns，當你輸入域名的時候給你引導向設定在dns的a記錄所對應的伺服器）
4.查詢域名mx記錄(郵件記錄)
> set type=mx
5.查詢域名ns記錄(域名所使用的dns)
不懂什麼意思？給你看個圖：（阿裡雲解析）
在不懂就百度谷歌吧