偶然发现一个跨平台的第三方 DNS 解析诊断工具 dnslookup，且在活跃更新维护中
下载后是个 12 MiB+ 大小的单文件，直接丢进系统路径 %windir%，就能免设置环境变量，在终端里直接使用了
支持所有已知的 DNS 协议：普通 DNS、普通 DNS-over-TCP、DoH、DoT、DoQ、DNSCrypt
项目地址
https://github.com/ameshkov/dnslookup
国内网盘外链：
https://www.alipan.com/s/RJEnxQNCQqf
提取码 bj85
测试效果
查询 某个域名 的私有 DNS DoH 解析结果
dnslookup 114514.example.com https://192.0.2.1:14514/dns-query
返回
dnslookup v1.12.0
Server: https://192.0.2.1:14514/dns-query
dnslookup result (elapsed 138.5485ms):
;; opcode: QUERY, status: NOERROR, id: 25452
;; flags: qr rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 0
;; QUESTION SECTION:
;114514.example.com. IN A
;; ANSWER SECTION:
114514.example.com. 10 IN A 192.0.2.1
在 Linux 下除了使用上述工具，软件仓库有个 knot-dnsutils 工具能实现类似效果
apt install knot-dnsutils
kdig +https @192.0.2.1#14514 114514.example.com A
返回
root@szdxJ8ZJo9pN:~# kdig +https @192.0.2.1#14514 114514.example.com A
;; TLS session (TLS1.3)-(ECDHE-SECP256R1)-(RSA-PSS-RSAE-SHA256)-(AES-256-GCM)
;; HTTP session (HTTP/2-POST)-(192.0.2.1/dns-query)-(status: 200)
;; ->>HEADER<<- opcode: QUERY; status: NOERROR; id: 0
;; Flags: qr rd ra; QUERY: 1; ANSWER: 1; AUTHORITY: 0; ADDITIONAL: 0
;; QUESTION SECTION:
;; 114514.example.com. IN A
;; ANSWER SECTION:
114514.example.com. 10 IN A 192.0.2.1
;; Received 70 B
;; Time 2026-06-26 08:53:35 CST
;; From 192.0.2.1@14514 (HTTPS) in 122.2 ms
官方 GitHub 使用说明
Plain DNS, use default system resolver:
dnslookup example.org
Plain DNS:
dnslookup example.org 94.140.14.14
Plain DNS-over-TCP:
dnslookup example.org tcp://94.140.14.14
DNS-over-TLS:
dnslookup example.org tls://dns.adguard-dns.com
DNS-over-TLS with IP:
dnslookup example.org tls://dns.adguard-dns.com 94.140.14.14
DNS-over-HTTPS with HTTP/2:
dnslookup example.org https://dns.adguard-dns.com/dns-query
DNS-over-HTTPS with HTTP/3 support (the version is chosen automatically):
HTTP3=1 dnslookup example.org https://dns.google/dns-query
DNS-over-HTTPS forcing HTTP/3 only:
Google DNS
dnslookup example.org h3://dns.google/dns-query
DNS-over-HTTPS with IP:
dnslookup example.org https://dns.adguard-dns.com/dns-query 94.140.14.14
DNS-over-HTTPS with basic auth (supported by AdGuard DNS):
dnslookup example.org https://username:password@d.adguard-dns.com/dns-query
DNSCrypt (stamp):
dnslookup example.org sdns://AQIAAAAAAAAAFDE3Ni4xMDMuMTMwLjEzMDo1NDQzINErR_JS3PLCu_iZEIbq95zkSV2LFsigxDIuUso_OQhzIjIuZG5zY3J5cHQuZGVmYXVsdC5uczEuYWRndWFyZC5jb20
DNSCrypt (parameters):
dnslookup example.org 176.103.130.130:5443 2.dnscrypt.default.ns1.adguard.com D12B:47F2:52DC:F2C2:BBF8:9910:86EA:F79C:E449:5D8B:16C8:A0C4:322E:52CA:3F39:0873
DNS-over-QUIC:
AdGuard DNS
dnslookup example.org quic://dns.adguard-dns.com
Quad9
dnslookup example.org quic://9.9.9.9
Sending a PTR query for an IPv4 address (IP address is recognized automatically when RRTYPE is not specified):
dnslookup 8.8.8.8
Sending a PTR query for an IPv6 address (IP address is recognized automatically when RRTYPE is not specified):
dnslookup 2606:4700:4700::1111
Machine-readable format:
JSON=1 dnslookup example.org 94.140.14.14
Disable certificates verification:
VERIFY=0 dnslookup example.org tls://127.0.0.1
Specify the type of resource record (default A):
RRTYPE=AAAA dnslookup example.org tls://127.0.0.1
RRTYPE=HTTPS dnslookup example.org tls://127.0.0.1
Specify the class of query (default IN):
CLASS=CH dnslookup example.org tls://127.0.0.1
Set DNSSEC DO bit in the request's OPT record:
DNSSEC=1 dnslookup example.org tls://8.8.8.8
Specify EDNS subnet:
SUBNET=1.2.3.4/24 dnslookup example.org tls://8.8.8.8
Add EDNS0 Padding:
PAD=1 dnslookup example.org tls://127.0.0.1
Specify EDNS option with code point code and optionally payload of value as a hexadecimal string: EDNSOPT=code:value. Example (equivalent of dnsmasq's --add-cpe-id=12345678):
EDNSOPT=65074:3132333435363738 RRTYPE=TXT dnslookup o-o.myaddr.l.google.com tls://8.8.8.8
Combine multiple options:
RRTYPE=TXT SUBNET=1.1.1.1/24 PAD=1 dnslookup o-o.myaddr.l.google.com tls://8.8.8.8
Verbose-level logging:
VERBOSE=1 dnslookup example.org tls://dns.adguard-dns.com
