> ## Content Index
> Fetch the complete content index at: https://www.pinglabz.com/llms.txt
> Use this file to discover other available public pages before exploring further.

# host: The Fastest DNS Lookup Tool
- URL: https://www.pinglabz.com/host-command-linux/
- Published: 2026-08-19T14:25:13.000Z
- Updated: 2026-08-19T14:25:13.000Z
- Description: One name in, one line out, and the only exit status of the three you can trust. Plus the timing test that complicates the fastest claim.
- Author: Jaime
- Tags: Linux, DNS, Troubleshooting

`host` is the DNS client you use when you already know what you want. One name in, one line out, no header, no sections, no flags to remember. It ships in the same package as `dig` and `nslookup`, so it is on every box that has either of them, and it is the fastest of the three to type by a wide margin.

It is also the most honest about failure. `dig` returns exit status 0 when a name does not exist, because the query succeeded. `host` returns 1, which makes it the right tool for a shell loop or a monitoring check. This guide covers the whole command, including the timing measurements that complicate its reputation. Every capture is real output from a Debian 13 host querying an authoritative server for `pinglabz.lab` across a Cisco Modeling Labs topology. It is part of the [Linux networking commands](https://www.pinglabz.com/linux-networking-commands/) cluster.

## One line in, one line out

The syntax is `host [options] name [server]`. Like `nslookup`, the server goes last with no flag. Unlike `nslookup`, the answer is a sentence:

```
j@llmbits:~$ host www.pinglabz.lab 10.77.3.10
Using domain server:
Name: 10.77.3.10
Address: 10.77.3.10#53
Aliases:

www.pinglabz.lab has address 10.77.2.10
www.pinglabz.lab has IPv6 address 2001:db8:77:2::10
```

Drop the server argument and that "Using domain server" preamble disappears entirely, leaving just the answer. This is the form people actually use:

```
j@llmbits:~$ host pinglabz.com
pinglabz.com has address 178.128.137.126

j@llmbits:~$ host 9.9.9.9
9.9.9.9.in-addr.arpa domain name pointer dns9.quad9.net.
```

Two commands, two lines of output, nothing to filter. That is the entire pitch.

By default `host` queries A, AAAA and MX for a name. Ask about a zone apex and you get all three families in one answer:

```
j@llmbits:~$ host pinglabz.lab 10.77.3.10
pinglabz.lab has address 10.77.3.10
pinglabz.lab has IPv6 address 2001:db8:77:3::10
pinglabz.lab mail is handled by 10 mail.pinglabz.lab.
pinglabz.lab mail is handled by 20 mail2.pinglabz.lab.
```

That is four records from one word of typing. It is also the reason the "fastest tool" claim needs qualifying, which comes up below.

## Reverse lookups take the same shape

Hand it an address and it does a PTR lookup. No `-x`, no `-t PTR`:

```
j@llmbits:~$ host 10.77.3.10 10.77.3.10
10.3.77.10.in-addr.arpa domain name pointer srv1.pinglabz.lab.

j@llmbits:~$ host 10.77.2.10 10.77.3.10
10.2.77.10.in-addr.arpa domain name pointer www.pinglabz.lab.

j@llmbits:~$ host 10.77.0.1 10.77.3.10
1.0.77.10.in-addr.arpa domain name pointer gw.pinglabz.lab.
```

The `in-addr.arpa` name is shown so you can see the reversal, and the answer is spelled out. For a quick sanity check on reverse zones this is hard to beat.

## Record types with -t

`-t` takes a type and switches off the default A/AAAA/MX behavior. The output stays in plain English for every type:

```
j@llmbits:~$ host -t MX pinglabz.lab 10.77.3.10
pinglabz.lab mail is handled by 10 mail.pinglabz.lab.
pinglabz.lab mail is handled by 20 mail2.pinglabz.lab.

j@llmbits:~$ host -t NS pinglabz.lab 10.77.3.10
pinglabz.lab name server ns1.pinglabz.lab.
pinglabz.lab name server ns2.pinglabz.lab.

j@llmbits:~$ host -t TXT pinglabz.lab 10.77.3.10
pinglabz.lab descriptive text "v=spf1 ip4:10.77.3.10 ip4:10.77.2.10 -all"
pinglabz.lab descriptive text "pinglabz-lab-verification=phase3"

j@llmbits:~$ host -t SOA pinglabz.lab 10.77.3.10
pinglabz.lab has SOA record ns1.pinglabz.lab. hostmaster.pinglabz.lab. 2026081901 7200 3600 1209600 3600

j@llmbits:~$ host -t SRV _http._tcp.pinglabz.lab 10.77.3.10
_http._tcp.pinglabz.lab has SRV record 10 100 80 www.pinglabz.lab.

j@llmbits:~$ host -t CNAME portal.pinglabz.lab 10.77.3.10
portal.pinglabz.lab is an alias for www.pinglabz.lab.
```

"Is an alias for" is the clearest CNAME rendering of the three tools. If you are explaining a CNAME chain to somebody who does not do DNS, this is the output to show them.

## \-a and -v, the everything switches

`-a` is shorthand for `-v -t ANY`. It drops the friendly formatting and gives you something very close to a `dig` response:

```
j@llmbits:~$ host -a pinglabz.lab 10.77.3.10
Trying "pinglabz.lab"
Using domain server:
Name: 10.77.3.10
Address: 10.77.3.10#53

;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 59312
;; flags: qr aa rd; QUERY: 1, ANSWER: 9, AUTHORITY: 0, ADDITIONAL: 4

;; QUESTION SECTION:
;pinglabz.lab.			IN	ANY

;; ANSWER SECTION:
pinglabz.lab.		3600	IN	SOA	ns1.pinglabz.lab. hostmaster.pinglabz.lab. 2026081901 7200 3600 1209600 3600
pinglabz.lab.		3600	IN	NS	ns1.pinglabz.lab.
pinglabz.lab.		3600	IN	NS	ns2.pinglabz.lab.
pinglabz.lab.		3600	IN	A	10.77.3.10
pinglabz.lab.		3600	IN	AAAA	2001:db8:77:3::10
pinglabz.lab.		3600	IN	MX	10 mail.pinglabz.lab.
pinglabz.lab.		3600	IN	MX	20 mail2.pinglabz.lab.
pinglabz.lab.		3600	IN	TXT	"v=spf1 ip4:10.77.3.10 ip4:10.77.2.10 -all"
pinglabz.lab.		3600	IN	TXT	"pinglabz-lab-verification=phase3"

;; ADDITIONAL SECTION:
ns1.pinglabz.lab.	3600	IN	A	10.77.3.10
ns2.pinglabz.lab.	3600	IN	A	10.77.3.10
mail.pinglabz.lab.	3600	IN	A	10.77.3.20
mail2.pinglabz.lab.	3600	IN	A	10.77.3.21

Received 614 bytes from 10.77.3.10#53 in 8 ms
```

Flags, TTLs, sections and timing, all of it. If `host` is what your fingers type and you suddenly need protocol detail, `-a` gets you there without switching tools.

`-v` on its own is more interesting, because it exposes exactly what `host` does behind that one-line output. Four separate queries for one command:

```
j@llmbits:~$ host -v www.pinglabz.lab 10.77.3.10
Trying "www.pinglabz.lab"
;; QUESTION SECTION:
;www.pinglabz.lab.		IN	A
;; ANSWER SECTION:
www.pinglabz.lab.	3600	IN	A	10.77.2.10
Received 66 bytes from 10.77.3.10#53 in 12 ms

Trying "www.pinglabz.lab"
;; QUESTION SECTION:
;www.pinglabz.lab.		IN	AAAA
;; ANSWER SECTION:
www.pinglabz.lab.	3600	IN	AAAA	2001:db8:77:2::10
Received 78 bytes from 10.77.3.10#53 in 4 ms

Trying "www.pinglabz.lab"
;; QUESTION SECTION:
;www.pinglabz.lab.		IN	MX
;; AUTHORITY SECTION:
pinglabz.lab.		3600	IN	SOA	ns1.pinglabz.lab. hostmaster.pinglabz.lab. 2026081901 7200 3600 1209600 3600
Received 121 bytes from 10.77.3.10#53 in 8 ms

Trying "www.pinglabz.lab"
;; QUESTION SECTION:
;www.pinglabz.lab.		IN	HTTPS
;; AUTHORITY SECTION:
pinglabz.lab.		3600	IN	SOA	ns1.pinglabz.lab. hostmaster.pinglabz.lab. 2026081901 7200 3600 1209600 3600
Received 121 bytes from 10.77.3.10#53 in 8 ms
```

A, AAAA, MX and HTTPS. That fourth one is new: modern BIND asks for the HTTPS service binding record too. Two of the four came back as NODATA with the SOA in the authority section, and `host` silently discarded them because it had nothing friendly to say. Worth knowing before you write a firewall rule counting DNS queries per lookup.

## Exit status is what makes host scriptable

This is the real reason to keep `host` in your toolkit. The exit code matches reality:

```
j@llmbits:~$ host www.pinglabz.lab 10.77.3.10 > /dev/null 2>&1; echo "exit status: $?"
exit status: 0

j@llmbits:~$ host nothere.pinglabz.lab 10.77.3.10 > /dev/null 2>&1; echo "exit status: $?"
exit status: 1

j@llmbits:~$ host -W 2 -R 1 pinglabz.lab 10.77.9.9 > /dev/null 2>&1; echo "exit status: $?"
exit status: 1
```

One subtlety worth catching. A NODATA answer, where the name exists but has no record of that type, still exits 0:

```
j@llmbits:~$ host -t AAAA gw.pinglabz.lab 10.77.3.10 > /dev/null 2>&1; echo "exit status: $?"
exit status: 0
```

That is correct, if surprising. The lookup worked; the answer was "no such record here". If your check needs to fail on a missing AAAA, test the output, not the exit code.

The failure messages are as readable as the successes:

```
j@llmbits:~$ host nothere.pinglabz.lab 10.77.3.10
Host nothere.pinglabz.lab not found: 3(NXDOMAIN)

j@llmbits:~$ host -t AAAA gw.pinglabz.lab 10.77.3.10
gw.pinglabz.lab has no AAAA record

j@llmbits:~$ host -W 2 -R 1 pinglabz.lab 10.77.9.9
;; communications error to 10.77.9.9#53: host unreachable
;; communications error to 10.77.9.9#53: timed out
;; no servers could be reached
```

"Not found: 3(NXDOMAIN)" gives you the RCODE number and the name. "Has no AAAA record" is NODATA in plain English, which no other tool does this clearly. "No servers could be reached" is a reachability failure with no RCODE at all, because nothing answered.

## A real loop over a name list

Put the exit status to work. This is the sweep that `host` exists for:

```
j@llmbits:~$ cat /tmp/hosts.txt
www
srv1
web1
ns1
mail
portal
nothere

j@llmbits:~$ while read n; do host -W 2 $n.pinglabz.lab 10.77.3.10 >/dev/null 2>&1 && echo "UP   $n" || echo "MISS $n"; done < /tmp/hosts.txt
UP   www
UP   srv1
UP   web1
UP   ns1
UP   mail
UP   portal
MISS nothere
```

Seven names, one line of shell, no parsing. The `-W 2` is doing real work there: without it a dead name against a dead server holds the loop for fifteen seconds per entry.

## The flags worth knowing

**`-t TYPE`**Query one record type instead of the A/AAAA/MX/HTTPS default set. 

**`-a`**Everything, in dig-like format. Shorthand for `-v -t ANY`. 

**`-v`**Verbose. Shows every query it sends, which is more than you expected. 

**`-W N`**Wait N seconds for a reply. The most important flag for anything in a loop. 

**`-R N`**Retry N times. Pair with `-W` to fail fast against a dead resolver. 

**`-T`**Use TCP. The one-character way to test whether TCP 53 is permitted end to end. 

**`-4` / `-6`**Transport family for reaching the server. Not a filter on the records returned, which surprises people. 

**`-c CLASS`**DNS class, almost always `IN`. You will use this roughly once in your career. 

That `-4` behavior is worth demonstrating, because the name suggests something it does not do:

```
j@llmbits:~$ host -4 www.pinglabz.lab 10.77.3.10
www.pinglabz.lab has address 10.77.2.10
www.pinglabz.lab has IPv6 address 2001:db8:77:2::10
```

The AAAA record still came back. `-4` forced the transport to the server to be IPv4; it did not filter the answer. To ask for one family only, use `-t A` or `-t AAAA`.

`-T` for TCP is the useful one operationally:

```
j@llmbits:~$ host -T pinglabz.lab 10.77.3.10
pinglabz.lab has address 10.77.3.10
pinglabz.lab has IPv6 address 2001:db8:77:3::10
pinglabz.lab mail is handled by 10 mail.pinglabz.lab.
pinglabz.lab mail is handled by 20 mail2.pinglabz.lab.
```

If that works and the UDP version does not, or the reverse, you have a firewall to go read.

## Is host actually the fastest?

To type, unambiguously yes. On the wire, it depends on what you compare, and the honest answer complicates the reputation. Twenty lookups of the same name, three tools, same server, same host:

```
j@llmbits:~$ time (for i in $(seq 20); do dig @10.77.3.10 www.pinglabz.lab +short >/dev/null; done)
real	0m1.172s

j@llmbits:~$ time (for i in $(seq 20); do host www.pinglabz.lab 10.77.3.10 >/dev/null; done)
real	0m1.553s

j@llmbits:~$ time (for i in $(seq 20); do nslookup www.pinglabz.lab 10.77.3.10 >/dev/null; done)
real	0m1.338s
```

`dig +short` wins, because it sends one query. `host` comes last, because it sends four. `nslookup` sits in the middle with two. That ordering is entirely explained by the `-v` capture above, and it will hold on any network where round trip time dominates.

So the accurate claim is narrower than the slogan. `host` is the fastest tool for a human to use: fewest keystrokes, least output to read, clearest answer. If you are firing thousands of lookups in a script, `dig +short` with an explicit type is the cheaper call. Both facts are true, and knowing which one applies is the point.

## The three tools side by side

**host** Queries sent by default: **4** (A, AAAA, MX, HTTPS). Exit status on NXDOMAIN: 1. Shows TTL: only with `-v` or `-a`. Shows flags: only with `-a`. 

**dig** Queries sent by default: **1** (A). Exit status on NXDOMAIN: **0**. Shows TTL: always. Shows flags: always. 

**nslookup** Queries sent by default: **2** (A, AAAA). Exit status on NXDOMAIN: 1. Shows TTL: only with `-debug`. Shows flags: authoritative or not, and nothing else. 

## FAQ

### Why does host return MX records I did not ask for?

Because with no `-t` it queries A, AAAA, MX and HTTPS and prints whatever came back. Add `-t A` to get one record type and one query.

### Does host read /etc/hosts?

No. Like `dig` and `nslookup`, it speaks DNS directly and bypasses the C library resolver, so `/etc/hosts`, mDNS and NSS modules are invisible to it. To test the path an application actually takes, use `getent hosts`. That distinction is the subject of [how Linux resolves names](https://www.pinglabz.com/linux-dns-resolution/).

### What is that HTTPS record in verbose output?

A service binding record. It lets a client learn ALPN protocols, alternative ports and an IP hint in a single lookup, so a browser can go straight to HTTP/3 without a redirect. Modern BIND clients query it alongside A and AAAA. Most zones do not have one yet, which is why you usually see it come back as NODATA.

### How do I make host fail fast?

`-W 2 -R 1`. Two seconds, one attempt. Without those flags a dead server costs about fifteen seconds per name, which turns a hundred-name sweep into a coffee break.

### Can host do a zone transfer?

`host -t AXFR domain server` will attempt one, and against a correctly configured server it will be refused. That is the healthy outcome. If it succeeds against your own authoritative servers from an unauthorized host, that is a finding to fix. The attacker's use of open transfers is covered in the [DNS enumeration cluster](https://www.pinglabz.com/dns-enumeration/).

### Which package provides host?

`dnsutils` on Debian and Ubuntu, `bind-utils` on RHEL, Rocky and Fedora. Same package as `dig` and `nslookup`, so you never get one without the others.

## Key takeaways

- `host name` and `host address` both work with no flags. Forward and reverse look the same to you.
- Exit status 0 on success, 1 on NXDOMAIN. That is what makes it the right tool for a shell loop, and where `dig` cannot help.
- NODATA still exits 0\. "Has no AAAA record" is a successful lookup with nothing to return.
- Without `-t` it sends four queries per name: A, AAAA, MX and HTTPS. `host -v` proves it.
- Fastest to type, not fastest on the wire. Twenty lookups took 1.55s against 1.17s for `dig +short`, and the reason is the query count.
- `-W 2 -R 1` before you put it in a loop, or a dead resolver will cost you fifteen seconds a name.
- `-4` selects the transport to the server, not the record family in the answer. Use `-t A` for that.
- `-a` gets you dig-style output with flags, TTLs and sections without leaving the command.

For the protocol-level view, read [the complete dig guide](https://www.pinglabz.com/dig-command/). For interactive exploration and cross-platform habit, see [nslookup](https://www.pinglabz.com/nslookup-linux/). For why none of these three see `/etc/hosts`, read [how Linux resolves names](https://www.pinglabz.com/linux-dns-resolution/). All three are indexed on the [Linux networking commands](https://www.pinglabz.com/linux-networking-commands/) pillar.