dig

#What it is

dig (from the dnsutils package on Debian) sends a DNS query and prints the full response. It's the quickest way to find out whether a resolver works, whether something is blocked, and whether DNSSEC validated.

#The forms I use

dig pi-hole.net @127.0.0.1 -p 5335   # ask a specific server on a specific port
dig doubleclick.net @192.168.1.213   # is Pi-hole blocking it? (expect 0.0.0.0)
dig +short example.com               # just the answer
dig +short -x 192.168.1.66           # reverse lookup: IP to hostname

#Reading the output

• status: in the header. NOERROR means it worked, NXDOMAIN means the name doesn't exist, SERVFAIL means the resolver couldn't (or, for DNSSEC, wouldn't) give an answer.
• flags: includes ad when the answer was DNSSEC-validated.
• ANSWER SECTION has the actual records.
• Query time shows caching at work: slow the first time, near zero after.

#On Windows

nslookup name server does the basic job, and PowerShell's Resolve-DnsName name -Server server gives more detail.