Understanding dig @ip address

What is the role of the ip address in the first dig command?

Why are the two results different?

What are the values 11 and 60 showing?

dig @1.1.1.1 instagram.com AAAA
; <<>> DiG 9.11.3-1ubuntu1.11-Ubuntu <<>> @1.1.1.1 instagram.com AAAA
; (1 server found)
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 61356
;; flags: qr rd ra; QUERY: 1, ANSWER: 8, AUTHORITY: 0, ADDITIONAL: 1
;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 1452
;; QUESTION SECTION:
;instagram.com. IN AAAA
;; ANSWER SECTION:
instagram.com. 11 IN AAAA 2406:da00:ff00::22e1:be08
instagram.com. 11 IN AAAA 2406:da00:ff00::3d7:facd
instagram.com. 11 IN AAAA 2406:da00:ff00::3e3:495a
instagram.com. 11 IN AAAA 2406:da00:ff00::22c4:a6ae
instagram.com. 11 IN AAAA 2406:da00:ff00::3d1:b623
instagram.com. 11 IN AAAA 2406:da00:ff00::3e6:95e
instagram.com. 11 IN AAAA 2406:da00:ff00::35e:9b98
instagram.com. 11 IN AAAA 2406:da00:ff00::22c0:373d
;; Query time: 135 msec
;; SERVER: 1.1.1.1#53(1.1.1.1)
;; WHEN: Fri Apr 17 00:26:29 GMT 2020
;; MSG SIZE rcvd: 279

dig instagram.com AAAA
; <<>> DiG 9.11.3-1ubuntu1.11-Ubuntu <<>> instagram.com AAAA
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 546
;; flags: qr rd ra; QUERY: 1, ANSWER: 8, AUTHORITY: 0, ADDITIONAL: 1
;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 65494
;; QUESTION SECTION:
;instagram.com. IN AAAA
;; ANSWER SECTION:
instagram.com. 60 IN AAAA 2406:da00:ff00::3405:b701
instagram.com. 60 IN AAAA 2406:da00:ff00::36d1:47be
instagram.com. 60 IN AAAA 2406:da00:ff00::36d2:852d
instagram.com. 60 IN AAAA 2406:da00:ff00::3457:87a8
instagram.com. 60 IN AAAA 2406:da00:ff00::36a5:4ba
instagram.com. 60 IN AAAA 2406:da00:ff00::22c6:3041
instagram.com. 60 IN AAAA 2406:da00:ff00::3e1:6d03
instagram.com. 60 IN AAAA 2406:da00:ff00::3650:6426
;; Query time: 13 msec
;; SERVER: 127.0.0.53#53(127.0.0.53)
;; WHEN: Fri Apr 17 00:26:42 GMT 2020
;; MSG SIZE rcvd: 266

1 Answer

@IPAddress tells dig which DNS server to query. Without it, dig queries whatever DNS server your OS is configured to use (probably shown in /etc/resolv.conf).

The results could be different because Instagram, or Instagram's CDN, gives out different responses to do load balancing. Or it could be that their CDN is directing you to different CDN edge nodes/servers that are closest to where your DNS query appeared to come from.

11 and 60 in your examples were the time-to-live values, letting DNS systems know how long they should cache those answers before re-querying for updated answers.