nslookup Command: Complete Guide to DNS Queries

nslookup is a command-line tool for querying DNS servers. It ships with Windows, macOS, and most Linux distributions, so you almost certainly already have it. When you need to check what IP address a domain resolves to, verify an MX record, or figure out why a domain is not resolving correctly, nslookup is the fastest way to get answers.

The name stands for "name server lookup." It sends DNS queries directly to a DNS server and shows you the raw response. No caching layers, no browser magic -- just the actual DNS data. For background on how DNS works and why these lookups matter, see the DNS Guide.

Basic Syntax

The simplest nslookup command takes a domain name as an argument.

nslookup example.com

Output:

Server:    8.8.8.8
Address:   8.8.8.8#53

Non-authoritative answer:
Name:    example.com
Address: 93.184.216.34

Two things to note in this output:

• Server tells you which DNS server answered the query. In this case, it is Google's public DNS at 8.8.8.8.
• Non-authoritative answer means the response came from a caching resolver, not from the domain's authoritative nameserver. This is normal for most queries.

The answer section shows the domain name and its resolved IP address. By default, nslookup queries for A records (IPv4 addresses).

Querying Specific Record Types

DNS stores many types of records beyond A records. You can tell nslookup which type to look up using the -type or -query flag.

A Records (IPv4 Addresses)

nslookup -type=A example.com

This is the default, so it is the same as running nslookup example.com without any flags.

AAAA Records (IPv6 Addresses)

nslookup -type=AAAA example.com

example.com    has AAAA address 2606:2800:220:1:248:1893:25c8:1946

MX Records (Mail Servers)

nslookup -type=MX example.com

example.com    mail exchanger = 10 mail.example.com.

The number before the mail server is the priority. Lower numbers have higher priority. If a domain has multiple MX records, mail will be attempted in priority order. For more detail on checking MX records, see How to Check DNS Records.

CNAME Records

nslookup -type=CNAME www.example.com

www.example.com    canonical name = example.com.

TXT Records

nslookup -type=TXT example.com

example.com    text = "v=spf1 -all"

TXT records are used for SPF, DKIM, DMARC, domain verification, and various other purposes. A domain can have multiple TXT records. For a full breakdown of record types, see DNS Record Types Explained.

NS Records (Nameservers)

nslookup -type=NS example.com

example.com    nameserver = a.iana-servers.net.
example.com    nameserver = b.iana-servers.net.

SOA Records

nslookup -type=SOA example.com

The SOA (Start of Authority) record contains the primary nameserver, administrator email, serial number, and timing values for zone transfers and caching.

Query Any Record Type

nslookup -type=ANY example.com

The ANY query asks the server to return all record types it has cached for the domain. In practice, many DNS servers restrict or ignore ANY queries for security reasons (they can be used in amplification attacks). Do not rely on ANY queries for thorough record checking -- query each type individually.

Specifying a DNS Server

By default, nslookup uses whatever DNS server your operating system is configured to use (typically your router or ISP's resolver). You can override this by adding a server address after the domain name.

nslookup example.com 8.8.8.8

This sends the query to Google's public DNS. Common DNS servers you might want to test against:

| Server | Address | |--------|---------| | Google Public DNS | 8.8.8.8 or 8.8.4.4 | | Cloudflare DNS | 1.1.1.1 or 1.0.0.1 | | Quad9 | 9.9.9.9 | | OpenDNS | 208.67.222.222 |

Querying the Authoritative Nameserver

To get the most accurate, up-to-date answer, query the domain's authoritative nameserver directly. First, find the nameserver:

nslookup -type=NS example.com

Then query that nameserver:

nslookup example.com a.iana-servers.net

The response from an authoritative server will not say "Non-authoritative answer" because you are going straight to the source. This is useful when you have recently changed DNS records and want to confirm the authoritative server has the new values, even if caching resolvers have not picked them up yet.

Interactive Mode vs Non-Interactive Mode

nslookup has two modes of operation.

Non-Interactive Mode

This is what you have seen so far. You type a single command, get a result, and return to your shell prompt. Non-interactive mode is best for quick one-off lookups.

nslookup -type=MX example.com 8.8.8.8

Interactive Mode

Launch interactive mode by running nslookup with no arguments:

nslookup
>

You get a > prompt where you can run multiple queries without retyping the command. This is useful when you need to check several things in a row.

> set type=MX
> example.com
Server:    8.8.8.8
Address:   8.8.8.8#53

example.com    mail exchanger = 10 mail.example.com.

> set type=A
> example.com
Server:    8.8.8.8
Address:   8.8.8.8#53

Name:    example.com
Address: 93.184.216.34

> server 1.1.1.1
Default server: 1.1.1.1
Address: 1.1.1.1#53

> example.com
Server:    1.1.1.1
Address:   1.1.1.1#53

Name:    example.com
Address: 93.184.216.34

> exit

Key interactive commands:

• set type=RECORD_TYPE -- change the query type
• server ADDRESS -- change the DNS server
• set debug -- turn on verbose output showing the full DNS response packet
• set nodebug -- turn off debug mode
• exit -- leave interactive mode

The set debug option is particularly useful for troubleshooting. It shows the raw DNS response including TTL values, flags, and the full answer and authority sections.

Common Use Cases

Verifying DNS Changes

You just updated an A record at your registrar and want to confirm the change has taken effect.

# Check what the authoritative nameserver says
nslookup -type=NS example.com
nslookup example.com ns1.your-provider.com

# Check what public resolvers see
nslookup example.com 8.8.8.8
nslookup example.com 1.1.1.1

If the authoritative server shows the new value but public resolvers show the old one, propagation is still in progress. The old record's TTL needs to expire before resolvers fetch the updated version.

Troubleshooting Email Delivery

When emails are not being delivered, check the MX records first.

nslookup -type=MX yourdomain.com

Verify that the MX records point to the correct mail server and that the mail server hostname itself resolves to an IP:

nslookup mail.yourdomain.com

If MX records are missing or pointing to the wrong server, that is your problem. For a deeper look at troubleshooting DNS issues, see the DNS Troubleshooting Guide.

Checking SPF, DKIM, and DMARC

These email authentication records are stored as TXT records.

# SPF record
nslookup -type=TXT yourdomain.com

# DKIM record (selector varies by provider)
nslookup -type=TXT selector1._domainkey.yourdomain.com

# DMARC record
nslookup -type=TXT _dmarc.yourdomain.com

Reverse DNS Lookups

nslookup can also look up the hostname associated with an IP address.

nslookup 93.184.216.34

34.216.184.93.in-addr.arpa    name = edge-star-mini-shv-02-iad3.facebook.com.

Reverse DNS is useful for verifying that an IP address maps back to an expected hostname. Many mail servers check reverse DNS to help identify spam.

Checking TTL Values

Use debug mode to see TTL values in the response:

nslookup -debug example.com

The debug output includes the TTL for each record, which tells you how long resolvers will cache that answer before querying again. This is critical when you are planning DNS changes -- if the current TTL is 86400 seconds (24 hours), you should lower it ahead of time so the transition happens faster.

nslookup vs dig

Both nslookup and dig query DNS servers, but they have different strengths.

| Feature | nslookup | dig | |---------|----------|-----| | Available on Windows | Yes (built-in) | No (must install) | | Available on macOS/Linux | Yes | Yes | | Output format | Human-friendly | Detailed, script-friendly | | Shows TTL by default | No (need debug mode) | Yes | | Batch queries | Interactive mode | Command-line flags | | DNSSEC information | Limited | Full support | | Scripting | Harder to parse | Easy to parse with +short |

For quick lookups on any operating system, nslookup is hard to beat. It is everywhere and the output is easy to read. For detailed troubleshooting, scripting, and DNSSEC validation, dig is more powerful. The dig equivalent of a basic nslookup:

# nslookup
nslookup -type=MX example.com 8.8.8.8

# dig equivalent
dig @8.8.8.8 example.com MX

dig's +short flag is especially useful for scripting:

dig +short example.com MX
10 mail.example.com.

On Windows, dig is not installed by default. You can get it by installing BIND tools or using WSL (Windows Subsystem for Linux). If you are on Windows and do not want to install anything extra, nslookup is your tool.

Troubleshooting nslookup Errors

"Server can't find domain: NXDOMAIN"

The domain does not exist in DNS. Either the domain name is misspelled, the domain has not been registered, or the DNS records have been deleted.

** server can't find nonexistent.example.com: NXDOMAIN

"Server can't find domain: SERVFAIL"

The DNS server encountered an error while processing the query. This can mean the nameserver is down, misconfigured, or the zone file has errors. Try querying a different DNS server to see if the problem is with the specific server or with the domain's DNS configuration.

"Connection timed out"

nslookup could not reach the DNS server. This usually means a network connectivity issue, a firewall blocking port 53, or the specified DNS server is down.

# Try a different DNS server
nslookup example.com 1.1.1.1

"Non-authoritative answer"

This is not an error. It just means the response came from a caching resolver rather than the authoritative nameserver. The data is almost always correct, just potentially not the absolute latest if a change was made very recently.

Summary

nslookup is the Swiss army knife of DNS troubleshooting. It is already on your machine, it handles every common DNS query type, and the output is straightforward. Use non-interactive mode for quick lookups, interactive mode for investigation sessions, and debug mode when you need the full picture including TTL values and authority records. For deeper DNS analysis or scripting, consider dig as a complement.

For ongoing monitoring rather than one-off lookups, an automated tool will catch DNS issues before they affect your users. Manual nslookup checks are reactive -- you run them after something breaks. Continuous monitoring is proactive.

References

• Microsoft, "nslookup," https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/nslookup