On this page
- What does the nslookup command do?
- nslookup command syntax on Windows, macOS and Linux
- How to query a specific DNS record type with nslookup
- How to query a specific DNS server with nslookup
- How to read nslookup output
- Can you run nslookup online without a terminal?
- Is ns look the same as nslookup?
- Frequently asked questions
What does the nslookup command do?
The nslookup command sends a DNS query to a name server and shows you the reply. You give it a name, it returns the records stored for that name: IP addresses, mail servers, name servers, text records and more.
It ships with Windows and macOS and is available on Linux, usually pre-installed or in the distribution's DNS utilities package. That makes it the one DNS tool you can count on finding on almost any machine.
People reach for it to answer questions like these:
- Which IP address does this domain point to right now?
- Which mail servers accept email for this domain?
- Did my DNS change reach a given public resolver yet?
- Is the problem my DNS server, or the domain itself?
Good to know: nslookup talks to the DNS server directly with its own resolver code. It does not read your hosts file or your operating system's DNS cache, so its answer can differ from what your browser uses.
nslookup command syntax on Windows, macOS and Linux
The basic form is the same on every system:
nslookup [options] name [server]- name is the domain to look up, or an IP address for a reverse lookup.
- server is optional. Leave it out and nslookup uses the DNS server your system is configured with.
- options start with a hyphen, for example
-type=mx.
First open a terminal:
Press Win + R, type cmd and press Enter. PowerShell and Windows Terminal work as well.
Open Terminal from Applications, Utilities, or search for it with Spotlight.
Open your terminal emulator. If the command is missing, install your distribution's DNS utilities package, named dnsutils or bind-utils on most systems.
Then run the simplest lookup there is:
nslookup example.comWith no options, nslookup returns the address records for the name: the IPv4 address (A record) and, where one exists, the IPv6 address (AAAA record).
How to run the command nslookup in interactive mode
Type nslookup on its own and you get a > prompt. Settings stay active until you change them, which is handy when you want several lookups against the same server.
nslookup
> server 1.1.1.1
> set type=mx
> example.com
> set type=txt
> example.com
> exitFor a single question, the one-line form is quicker and easier to paste into a ticket or a script.
How to query a specific DNS record type with nslookup
Add -type= followed by the record type. The option goes before the domain name. -q= and -querytype= do the same thing.
| Record | What it tells you | Command |
|---|---|---|
| A | IPv4 address of the name | nslookup -type=a example.com |
| AAAA | IPv6 address of the name | nslookup -type=aaaa example.com |
| MX | Mail servers and their priority | nslookup -type=mx example.com |
| NS | Authoritative name servers for the zone | nslookup -type=ns example.com |
| TXT | Text data such as SPF and site verification strings | nslookup -type=txt example.com |
| CNAME | The canonical name an alias points to | nslookup -type=cname www.example.com |
| SOA | Primary name server, admin contact, serial and timers for the zone | nslookup -type=soa example.com |
| PTR | Hostname behind an IP address | nslookup 192.0.2.10 |
How to check MX records with nslookup
nslookup -type=mx example.comEach line lists a mail server with a preference number. The lowest number is tried first. If the answer is empty, the domain publishes no MX record.
How to look up TXT, SPF and DMARC records
SPF lives in a TXT record on the domain itself. DMARC lives in a TXT record on the _dmarc subdomain, so you query that name instead:
nslookup -type=txt example.com
nslookup -type=txt _dmarc.example.comHow to do a reverse lookup with nslookup
Give nslookup an IP address instead of a name and it switches to a PTR query on its own:
nslookup 192.0.2.10The answer is the hostname the owner of that address published. Many addresses have none, and that is not an error on your side. To run the same check from a browser, the rDNS Check resolves any IPv4 or IPv6 address to its PTR hostname.
About -type=any: it looks like a shortcut for "show me everything", but many DNS servers now return a minimal answer to ANY queries, as described in RFC 8482. Ask for each record type separately if you need a complete picture.
How to query a specific DNS server with nslookup
Put the server's address after the domain. This sends the question to that server instead of your default one:
nslookup example.com 8.8.8.8
nslookup -type=mx example.com 1.1.1.1This is the most useful trick the command has. If your default server gives a wrong or empty answer and a public resolver gives the right one, the fault is with your resolver, not with the domain. If you are not sure which server your machine uses, see how to find your DNS server address.
How to get an authoritative answer
Resolvers answer from cache. To see what the domain's own name servers say, ask them directly:
- Find the name servers
Run nslookup -type=ns example.com and note one of the server names in the answer.
- Ask that name server
Run the lookup again with that server name as the last argument. The "Non-authoritative answer" line disappears.
- Compare with a public resolver
If the two answers differ, the resolver is still serving an older cached copy.
nslookup -type=ns example.com
nslookup example.com ns1.example.netA mismatch right after a DNS change is expected: caches keep the old record until its TTL runs out. The post on what DNS propagation is explains how long that takes.
Which other nslookup options are worth knowing?
| Option | What it does |
|---|---|
-debug | Prints the full response, including the TTL of each record |
-timeout=5 | Seconds to wait for a reply before retrying |
-retry=2 | Number of attempts before giving up |
-port=5353 | Queries a DNS server on a port other than 53 |
Microsoft documents the Windows options in its nslookup command reference. On macOS and Linux, man nslookup lists what your version supports.
How to read nslookup output
A typical reply looks like this. The addresses below come from ranges reserved for documentation, so yours will differ:
Server: 192.168.1.1
Address: 192.168.1.1#53
Non-authoritative answer:
Name: example.com
Address: 192.0.2.10
Name: example.com
Address: 2001:db8::10- Server and Address at the top describe the DNS server that answered you, not the domain. Here it is a home router on port 53.
- Name and Address below are the answer: the domain and the IP addresses it resolves to.
- Several addresses for one name are normal. Large sites publish more than one.
What does non-authoritative answer mean?
It means the reply came from a resolver that looked the record up earlier and kept a copy, not from the name server that holds the zone. Nearly every everyday lookup is non-authoritative. It is a label, not a warning.
What do common nslookup errors mean?
| Message | Meaning | What to check |
|---|---|---|
| NXDOMAIN or "Non-existent domain" | The name does not exist in DNS | Spelling, and whether the domain is registered and delegated |
| No answer | The name exists but has no record of the type you asked for | Try another record type |
| SERVFAIL | The server could not complete the lookup | Try another resolver; the zone's name servers or DNSSEC may be broken |
| REFUSED | The server will not answer you | You are probably asking a server that does not serve outside clients |
| Timed out, or no servers could be reached | No reply arrived | Your network, a firewall blocking port 53, or a wrong server address |
On Windows, nslookup may append your computer's DNS suffix to the name you typed, so example.com can end up being tried as a name inside your company domain. End the name with a dot to stop that: nslookup example.com.
Can you run nslookup online without a terminal?
Yes. Pingie's DNS Lookup runs the same record queries from a browser against Google and Cloudflare public resolvers and shows each record with its TTL, which helps on a phone or a locked-down work laptop. It cannot choose which resolver answers, so to compare two specific servers or question an authoritative name server, use the command line as shown earlier.
Names with underscores are accepted, so _dmarc.example.com with type TXT works just like the command above.
A quick way to split the problem: if the online lookup returns the right record and nslookup on your machine does not, the domain is fine and your local DNS server is the one to fix.
Is ns look the same as nslookup?
Yes. "ns look" and "ns lookup" are just the way people split the name when searching. The command is one word, nslookup, short for name server lookup, and typing it with a space will not work in a terminal.
When should you use dig instead of nslookup?
dig prints the full DNS response by default, including TTLs and response flags, and has a +trace option that follows the delegation from the root servers down. It is the better choice for deep debugging on macOS and Linux. nslookup wins on availability: it is already there on Windows, and its short output is enough for most everyday checks.
Record types themselves are defined by the DNS standards, starting with RFC 1035, and the full list is kept in the IANA DNS parameters registry.
Check a domain's DNS records without opening a terminal
Enter a domain, pick the record type and see what public resolvers return, with the TTL of every record.
Frequently asked questions
Add the debug option: nslookup -debug example.com. The detailed output includes a ttl value for each record, in seconds. When you ask a caching resolver, that number counts down between queries, because it shows how long the cached copy remains valid, not the value set in the zone.
Ping resolves names through your operating system, which checks the hosts file and its local DNS cache first. nslookup skips both and asks the DNS server directly. A hosts file entry or a stale cached record therefore shows up in ping but not in nslookup. Flushing the DNS cache usually brings them back in line.
No. The maintainers of BIND once announced plans to retire it in favour of dig and host, then reversed that decision, and it is still shipped and maintained. On Windows it remains a standard built-in tool, alongside the newer Resolve-DnsName cmdlet in PowerShell. It is safe to keep using it for everyday checks.
Not reliably. The -type=any option exists, but many DNS servers answer ANY queries with a minimal response, so the list is often incomplete. Query each type you care about separately: A, AAAA, MX, NS, TXT and so on. DNS has no command that lists every record in a zone for outside users.
Before answering, nslookup on Windows tries a reverse lookup of the DNS server's own IP address to print its name. If that address has no PTR record, common with home routers, the server shows as UnKnown. It is cosmetic. The lookup of the domain you asked about still works normally.