What Is nslookup Command and How to Use It?

Learn how to troubleshoot network issues like a pro with our comprehensive guide to using the nslookup command.

Updated: 26 Oct, 24 by Susith Nonis 26 Min

List of content you will read in this article:

NSLookup (short for Name Server Lookup) is a command-line tool commonly used to query the Domain Name System (DNS) to obtain information about domain names, IP addresses, and other DNS records. It is available on most operating systems, including Windows, Linux, and macOS. The NSLookup command is used to diagnose and troubleshoot DNS-related issues and retrieve information about domain names and their associated IP addresses. It sends a query to a DNS server, which returns the requested information to the user.

NSLookup can perform various tasks, including checking the DNS records for a domain, verifying that a DNS server is working correctly, and troubleshooting DNS-related problems. The command also has various options that allow users to customize their queries and obtain more detailed information about DNS records. NSLookup is a powerful tool widely used by system administrators and network engineers to diagnose and resolve DNS-related issues.

NSLookup is a command-line tool that queries the Domain Name System (DNS) to obtain information about domain names, IP addresses, and other DNS records. It allows users to retrieve information such as the IP address of a domain name or the mail server associated with a domain name. NSLookup sends a query to a DNS server and receives a response, which is then displayed to the user. It is a powerful tool for diagnosing and troubleshooting DNS-related issues and is available on most operating systems, including Windows, Linux, and macOS. Overall, NSLookup is a fundamental tool for network administrators and system engineers working with DNS systems.

The nslookup command is a network administration tool used in operating systems like Windows, Linux, and macOS command-line interface. It is used to query the Domain Name System (DNS) to obtain information about domain names, IP addresses, and other DNS records.

The nslookup command operates in two modes: interactive and non-interactive. To activate the interactive mode, simply enter the command:

Nslookup

This prompts you to execute multiple server queries.

For instance, typing a domain name like:

www.google.com

will provide information about it.

Once nslookup displays the information, it presents another prompt.

In interactive mode, provide a choice on an additional line before the query is executed. Begin the selection with set:

set [option]

To exit interactive mode, type:

exit

Non-interactive mode allows you to issue single queries. The syntax is:

nslookup [options] [domain-name]

Both the command and the query are written in the same line.

Here's how to use the nslookup command:

  • Open a command prompt/terminal window on your computer.
  • Type nslookup followed by the domain name or IP address you want to look up. For example:

nslookup example.com

  • Press Enter. The command will retrieve and display the DNS information associated with the domain name or IP address you entered.

You can also use nslookup to query a specific DNS server by specifying its IP address. For example:

nslookup example.com 8.8.8.8

This will retrieve the DNS information, for example.com, from the DNS server at IP address 8.8.8.8.

The nslookup command can be useful for troubleshooting network connectivity issues, verifying DNS configurations, and performing various other network-related tasks.

nslookup Options

Here we provide a table presenting nslookup options which provide flexibility and control over nslookup queries:

Option

Description

-d    

Enable debugging output                     

-query

Specify query type (e.g., A, NS, MX, PTR)  

-port 

Specify port number to use for queries      

-timeout

Set query timeout in seconds              

-class

Specify query class (e.g., IN, CH)          

-type

Same as -query option (deprecated)          

-root 

Set root server to query                    

-server

Specify DNS server to use                   

-recurse

Enable or disable recursion                 

-retry

Set number of retries for a query           

-domain

Set default domain name to append to queries

-srchlist

Set domain search list                     

-msxfr

Request zone transfer from Microsoft DNS Server

-defname

Append default domain name to queries      

-tkey

Specify TSIG key for TSIG-secured queries   

-tsig

Specify TSIG algorithm and key for TSIG-secured queries

-l    

Enable or disable strict label checking     

-i    

Use IP address for reverse lookup           

-h    

Display help information                    

You ought to be advised that the "nslookup" command has been discontinued in many operating systems and has been displaced by other appliances such as "dig", or that "nslookup" might have been replaced by the newer "nslookup".

If you're running a Windows operating system, the "nslookup" tool should be installed by default. To open a command prompt, hit the Windows key + R, type "cmd" in the Run dialog, and then press Enter. Then you can use the "nslookup" command in the command prompt.

If you have a Linux-based machine, you are able to install the "dnsutils" package, which contains the "nslookup" command. The setting up procedure may differ based on your Linux distribution. For instance, on Ubuntu or Debian, you can open a terminal and enter the following command to install it:

sudo apt-get update

sudo apt-get install dnsutils

For other distributions, you can use their respective package managers, such as "yum" for CentOS or "dnf" for Fedora, to install the "dnsutils" package.

Note: Depending on your operating system and version, there may be several tools or commands available for performing DNS queries. For example, "dig" is a popular command-line tool for performing DNS queries that is accessible on a variety of operating systems.

Nslookup is a powerful tool that goes beyond simply translating website names into IP addresses.  Here's why you should consider adding it to your troubleshooting arsenal:

Troubleshooting Server Connections

Consider a website that refuses to load, or emails that remain in limbo. Nslookup can serve as your internet investigator. It assists in determining the root of the problem by allowing you to examine how domain names convert to IP addresses and monitor the health of those connections. 

Boosting Security and safety

Nslookup is useful not only for troubleshooting, but also for staying secure online. Malicious actors may try to modify DNS to steer you to bogus websites. Knowing how to use nslookup allows you to check the legitimacy of a domain before visiting it, providing an additional degree of protection to your browsing experience.

Knowing how to utilize nslookup is useful since it functions as a spotlight for your internet connection. When websites don't load or emails don't send, nslookup can help you debug by showing how domain names convert to IP addresses and checking the status of those connections. In this part of the blog post, we tell you how to use nslookup for different purposes.

View Domain's NS Records

Name Server (NS) records have significance components of the Domain Name System (DNS) infrastructure because they include the names of the domain's name servers. These name servers are accountable for converting domain names into IP addresses. To retrieve the NS records for a given domain, use the "nslookup" command with the "-type=ns" option after the domain name.

To perform this action, open a command prompt or terminal window on your operating system. Then, enter the following command:

nslookup -type=ns [domain-name]

Replace "[domain-name]" with the actual domain you want to query. By executing this command, you initiate a DNS lookup specifically for the NS records associated with the provided domain.

Upon execution, the output will display a list of available name servers associated with the queried domain.

View Domain's NS Records

View Domains MX Records

MX (Mail Exchange) records are essential in the email delivery process because they store information about the mail servers that handle incoming email for a specific domain. These records control the routing of email queries to the relevant mail servers. To retrieve the MX records for a given domain, use the "nslookup" command with the "-type=mx" option, followed by the domain name.

To perform this action, open a command prompt or terminal window on your operating system. Then, enter the following command:

nslookup -type=mx [domain-name]

Upon execution, the output will display a list of mail servers associated with the queried domain.

View Domains MX Records

Perform a Reverse DNS Lookup

A reverse DNS lookup is an algorithm for determining the domain name related to a specific IP address. While nslookup is typically used to find information about domain names, it can also be employed to make reverse DNS lookups.

To perform a reverse DNS lookup, use the nslookup command with the subsequent syntax:

nslookup [ip-address]

Replace "[ip-address]" with the actual IP address you want to investigate.

After performance, the command's result will show the domain name associated with the IP address. This data is very valuable when determining the hostname associated with a given IP address.

Perform a Reverse DNS Lookup

View SOA Records

Under the hood of every domain lies a critical record called the Start of Authority (SOA) record. Think of it as the domain's official document, containing important details like the administrator's email address, a unique serial number, and refresh intervals. These intervals determine how often other DNS servers check for updates to the domain's information. Additionally, the SOA record specifies how long results can be cached before they need to be refreshed, and how long it takes before outdated information is considered invalid.  If you're curious about a domain's SOA record, the `nslookup` command comes in handy.  Just type the following command:

nslookup -type=soa [domain-name]

Then, you'll see the relevant information displayed, giving you a glimpse into the domain's administrative details and update schedule.

View SOA Records

View Text Records

TXT records act like public bulletin boards for a domain. They hold snippets of information intended for users outside the domain itself. This information can be quite varied. For instance, websites like Google and Facebook use TXT records to verify ownership of a domain during account setups.  These records can also be used for other purposes, like displaying copyright notices or implementing email authentication protocols.  To see a domain's TXT records, run the following command:

nslookup -type=txt [domain-name]

The output will display each TXT record on a separate line, giving you a peek at the various bits of information the domain administrator has chosen to share publicly.

View Text Records

View All Records

To gain comprehensive insight into the DNS (Domain Name System) records of a domain, you can utilize the "nslookup" command with the "type=any" option. This approach allows you to retrieve various types of DNS records, including NS (Name Server), SOA (Start of Authority), MX (Mail Exchange), and TXT (Text) records.

To view all available DNS records of a domain, open a command prompt or terminal window and enter the following command:

nslookup -type=any [domain-name]

Upon execution, the output will display a comprehensive list of DNS records for the domain.

View All Records

View Information About a Specific Name Server

Want to zoom in on a specific nameserver for a domain? `nslookup` can help!  The standard `nslookup` command gives you a general overview of a domain's nameservers. But, if you know the exact nameserver you're interested in (perhaps from using `nslookup` earlier), you can get even more focused information.  Just use the following command:

nslookup [domain-name] [name-server]

This tells `nslookup` to look up the specific nameserver you provide, giving you details like its name and both IPv4 and IPv6 addresses. 

View Information About a Specific Name Server

View Pointer Records

Do you want to find out which website is hiding behind an IP address? nslookup can do a reverse DNS lookup, which is the inverse of a standard DNS lookup. A standard lookup converts a domain name to an IP address, but a reverse lookup uses the IP address to locate the appropriate domain name.

When performing a reverse DNS lookup with 'nslookup', you do not use the real IP address explicitly. Instead, invert the order and add a specific suffix. For example, 1.2.3.4 becomes 4.3.2.1.

nslookup -type=ptr [reversed-ip-address].in-addr.arpa

If the reverse lookup is successful, the domain name will be displayed. This is useful for troubleshooting or simply verifying the identification of a website based on its IP address.

View Pointer Records

Query a Non-Default Port

Universe of DNS runs on a well-defined channel: port 53. This is the default port for DNS servers to communicate and transform domain names into IP addresses. But what if you have a cause to go behind the scenes and investigate another port?

'nslookup' provides some flexibility in this area. The 'port' option allows you to define a non-standard port number. The syntax goes like this:

nslookup -port=[port-number] [domain-name]

It is typically only used for debugging or in certain network settings. If you're unsure about using different ports, the default port 53 is the safest option.

View Debugging Information

Sometimes, things don't go as planned in the internet world. Websites might not load, and emails might bounce back. When troubleshooting these DNS-related issues, the `nslookup` command can be a powerful tool. But what if the standard output doesn't provide enough clues?

This is where the `debug` option comes in.  Adding `-debug` to your `nslookup` command unlocks a more detailed view of the lookup process.  The syntax is simple:

nslookup -debug [domain-name]

With the `debug` flag enabled, the output will display additional information about each step `nslookup` takes during the lookup process.

View Debugging Information

The online nslookup tools provide a handy way to execute nslookup queries without having local command-line access. Here are several online tools for conducting NSLOOKUP:

  • MXToolbox: MXToolbox offers a wide range of network diagnostic tools, including nslookup. It provides various options to query DNS records, including MX, A, TXT, and NS records.
  • DNSstuff: DNSstuff offers a comprehensive suite of DNS tools, including nslookup. It allows you to perform DNS lookups, DNS traversal, and DNS resolution tests.
  • WhatIsMyDNS: WhatIsMyDNS provides a simple and easy-to-use interface for performing DNS lookups. It displays detailed information about DNS records, including NS records, A records, and MX records.
  • Network-Tools.com: Network-Tools.com offers a collection of network diagnostic tools, including an nslookup tool. It allows you to query DNS records for a domain and displays the results in a clear and concise format.

If you receive the "nslookup: command not found" problem, it usually indicates that the nslookup command-line utility is not installed or is not available in your system's PATH environment variable. Here we tell you how to repair it:

1- Check if nslookup is installed

Before anything, ensure that nslookup has been set up on your system. You are able to do this by entering this command into your terminal or command prompt:

nslookup

If you get the "nslookup: command not found" error, it means that nslookup is not installed. If nslookup is installed, it should launch the interactive mode.

2- Install nslookup

If nslookup is not installed, you'll need to install it. The method for installing nslookup varies depending on your operating system:

  • For Windows: nslookup normally comes by default in Windows installs. If it doesn't exist, you can enable it by selecting the "Remote Server Administration Tools (RSAT)" option from the Windows Features menu.
  • For Linux: On Debian-based systems (e.g., Ubuntu), you can install nslookup by running: sudo apt-get install dnsutils. On Red Hat-based systems (e.g., CentOS), you can install nslookup by running: sudo yum install bind-utils

Note: The package name might vary slightly depending on your Linux distribution.

3- Add nslookup to PATH

If nslookup has been installed but not discovered, it may not be in your system's PATH environment variable. You can add it to your PATH manually.

For Windows: You can add the directory containing nslookup to your PATH by following these steps:

  • Right-click on "This PC" or "My Computer" and select "Properties".
  • Click on "Advanced system settings".
  • Click on "Environment Variables".
  • Under "System variables", find the "Path" variable and click "Edit".
  • Add the directory containing nslookup (usually C:\Windows\System32\) to the list of paths.
  • Click "OK" to save the changes.

For Linux: The nslookup binary is typically located in /usr/bin/nslookup. You can add it to your PATH by modifying your ~/.bashrc or ~/.bash_profile file and adding the following line:

export PATH=$PATH:/usr/bin

Then, reload your shell configuration by running:

source ~/.bashrc

or

source ~/.bash_profile

Once you've completed these procedures, execute nslookup again to ensure that the problem has been repaired.

If the 'nslookup' function is unavailable or you are seeking for alternatives, you can use other command-line tools or web services to perform DNS lookups and troubleshooting. We are going explore several alternatives:

1- dig (Domain Information Groper): dig is a sophisticated DNS lookup application that is available on most Unix-like operating systems. It provides more detailed information than 'nslookup' and is favored by many system administrators.

Example usage:

     dig example.com

2- host: On Unix-like computers, you can also use the 'host' command to look up DNS. It's simpler than 'dig' yet still yields meaningful results.

Example usage:

     host example.com

3- ping: While primarily used for testing network connectivity, the `ping` command can also resolve hostnames to IP addresses.

Example usage:

     ping example.com

4- Online DNS lookup tools: If you're unwilling to employ command-line tools, there are multiple online DNS search services accessible. These services let you to do DNS lookups right from your web browser. Examples are MXToolbox, DNSstuff, WhatIsMyDNS, and Network-Tools.com.

5- GUI DNS utilities: There are various graphical DNS programs accessible for different operating systems. Such programs often offer a user-friendly interface for DNS lookups. Examples are DNSQuerySniffer for Windows and DnsTool for macOS.

Each of these choices has a unique combination of features and benefits, allowing you to pick the option that best meets your requirements and tastes.

Both 'nslookup' and 'ping' are command-line applications often used for network troubleshooting, however they perform different functions.

1- nslookup (Name Server Lookup)

  • Purpose: nslookup is primarily used for querying DNS (Domain Name System) servers to obtain domain name or IP address information.
  • Functionality: It allows you to perform various types of DNS queries, such as looking up IP addresses associated with domain names (forward lookup), finding domain names associated with IP addresses (reverse lookup), querying specific types of DNS records (e.g., MX, NS, SOA), and specifying DNS servers to use.
  • Example Usage: nslookup example.com

2- ping

  • Purpose: ping is used to test the reachability of a host on a network and measure the round-trip time for packets sent from your computer to the target host.
  • Functionality: It sends ICMP (Internet Control Message Protocol) Echo Request packets to the target host and waits for ICMP Echo Reply packets. This helps determine whether the target host is reachable and calculates the latency (round-trip time) between your computer and the target host.
  • Example Usage: ping example.com

nslookup is used for DNS-related operations, whereas whois is used to obtain domain registration information. Depending on your requirements, you can utilize one or both of these programs for network-related activities. Here are the main distinctions between them:

  • Purpose: nslookup is used for DNS-related tasks such as resolving domain names to IP addresses and vice versa, while whois is used for querying domain registration information.
  • Output: nslookup typically provides DNS-related information such as IP addresses, domain names, and DNS server details, while whois provides domain registration details such as registrar information, registration dates, and contact information.
  • Protocol: nslookup uses the DNS protocol to communicate with DNS servers, while whois uses the WHOIS protocol to query WHOIS databases.
  • Usage: nslookup is more focused on DNS troubleshooting and configuration, while whois is used for obtaining information about domain registrations and ownership.

We provided a table that outlines the essential characteristics, aims, functionalities, protocols, and example usages of WHOIS, Nslookup, and Ping, allowing for a clear comparison of these network tools:

Feature       

WHOIS                                           

Nslookup                                        

Ping                                             

Purpose      

Query domain registration information            

Query DNS (Domain Name System) information      

Test network connectivity and measure latency   

Functionality

Retrieve domain registration details such as registrar information, registration dates, and contact information

Perform DNS queries to obtain domain name or IP address information, including forward and reverse lookups, querying specific types of DNS records, and specifying DNS servers to use

Send ICMP Echo Request packets to target hosts and measure round-trip time for packets sent and received

Protocol     

WHOIS protocol                                  

DNS protocol                                    

ICMP protocol                                   

Usage        

Helps determine ownership and registration status of domain names

Used for DNS troubleshooting and configuration, including resolving domain names to IP addresses, querying DNS records, and specifying DNS servers

Used for basic network connectivity testing and latency measurement

In summary, the nslookup command is a versatile network administration tool that can be used for various DNS-related tasks, from troubleshooting network connectivity issues to testing DNS server performance. In conclusion, the nslookup command is a powerful tool for troubleshooting and verifying DNS configurations, testing DNS servers, and debugging network applications. Using the various options and syntax available with the nslookup command, you can retrieve detailed information about DNS records, test the performance and reliability of DNS servers, and identify and resolve problems with DNS resolution that may be affecting the performance or availability of your applications. Whether you are a network administrator, developer, or system administrator, understanding how to use the nslookup command can help you ensure your network and applications' optimal performance and reliability.

To use nslookup, open a command prompt or terminal and type `nslookup` followed by the domain name or IP address you want to query. Press Enter to execute the command.

The command to check DNS is `nslookup` (Name Server Lookup). By default, running `nslookup` without any arguments enters interactive mode, allowing you to perform multiple DNS queries from the command prompt.

The nslookup tool is used to query DNS (Domain Name System) servers to obtain information about domain names or IP addresses. It helps users perform various DNS-related tasks, including resolving domain names to IP addresses (forward lookup), finding domain names associated with IP addresses (reverse lookup), querying specific types of DNS records (e.g., MX, NS, SOA), and specifying DNS servers to use.

To find your hostname using nslookup, open a command prompt or terminal and type `nslookup` followed by your IP address. Press Enter to execute the command. Nslookup will perform a reverse DNS lookup and display the corresponding hostname associated with the IP address.

Susith Nonis

Susith Nonis

I'm fascinated by the IT world and how the 1's and 0's work. While I venture into the world of Technology, I try to share what I know in the simplest way with you. Not a fan of coffee, a travel addict, and a self-accredited 'master chef'.

user monovm

Isadore Ullrich

2024, Jul, 24

Great explanation of the nslookup command! This article covers everything from basic usage to advanced options. It's really helpful for anyone looking to troubleshoot DNS issues or dig deeper into their network's performance. The examples and step-by-step instructions make it easy to follow, whether you're a beginner or an experienced network admin. Thanks for sharing.