nslookup is a command-line tool that asks a DNS server about a name or IP address. The basic form nslookup example.com shows the server that answered and the domain’s addresses; adding -type=MX, -type=TXT or another record type shows those records, and adding a server address at the end (nslookup example.com 8.8.8.8) asks that server instead of your default resolver. It is built into Windows and macOS; on Linux it comes with the dnsutils or bind-utils package.
12 examples
| Task | Command |
|---|---|
| IP address of a domain | nslookup example.com |
| IPv6 address only | nslookup -type=AAAA example.com |
| Mail servers | nslookup -type=MX example.com |
| TXT records (SPF, verification) | nslookup -type=TXT example.com |
| DMARC policy | nslookup -type=TXT _dmarc.example.com |
| Nameservers | nslookup -type=NS example.com |
| SOA record (serial, primary server) | nslookup -type=SOA example.com |
| Reverse lookup (PTR) of an IP | nslookup 8.8.8.8 |
| Ask a specific resolver | nslookup example.com 1.1.1.1 |
| Ask the authoritative server | nslookup example.com ns1.provider.net |
| Show the TTL and details | nslookup -debug example.com |
| Wait longer for slow servers | nslookup -timeout=10 example.com |
Reading the output
Server: one.one.one.one
Address: 1.1.1.1
Non-authoritative answer:
Name: example.com
Addresses: 2001:db8::10
203.0.113.10- Server / Address: the DNS server that answered.
- Non-authoritative answer: the answer came from a resolver (often from its cache), not from the domain’s own nameserver. This is normal and not an error.
- Name / Addresses: the result. Several addresses mean the site uses more than one server or a CDN.
- *** can’t find …: Non-existent domain means NXDOMAIN: the name does not exist. See NXDOMAIN vs SERVFAIL.
- DNS request timed out means the server did not answer; try another server or check your connection.
Interactive mode
Run nslookup without arguments to get a > prompt. Then type set type=MX, server 8.8.8.8 and domain names one after another; type exit to leave. It is convenient when you check many records in a row.
“nslookup: command not found” on Linux
sudo apt install dnsutils # Debian, Ubuntu
sudo dnf install bind-utils # Fedora, RHEL, AlmaLinux, RockyThe same packages install dig, which gives more detailed output; see how to use dig. PowerShell users can use Resolve-DnsName instead. No command line at hand? Use our DNS Lookup or, for addresses, Reverse DNS Lookup.
Common Questions
What does 'Non-authoritative answer' mean in nslookup?
The answer was returned by a recursive resolver, usually from its cache, rather than by the domain's authoritative nameserver. It is the normal result for everyday lookups.
Is nslookup or dig better?
Both query DNS. nslookup is available everywhere including Windows; dig shows more detail, such as TTLs and flags, and is preferred on Linux and macOS.
Why does nslookup show a different IP than ping?
ping may use a cached result or an IPv6 address, and sites behind CDNs return different addresses on each query. Both can be correct.
Does nslookup use my hosts file?
No. nslookup always asks a DNS server, while browsers and ping also read the hosts file, which can explain different results.