What Is nslookup?
nslookup (name server lookup) is a command-line network administration utility used to query Domain Name System (DNS) servers. It translates human-readable hostnames into IP addresses — and performs the reverse — and can also retrieve other DNS record types. It is available on Windows, Linux, and most Unix-like operating systems, and it ships preinstalled on virtually every mainstream OS, which is why it remains one of the first tools a technician reaches for when a machine cannot reach a host by name.
DNS resolution underpins almost every networked application. When a device requests a URL, an API endpoint, an NTP server, or a cloud MQTT broker, the operating system asks a DNS resolver for the corresponding IP address. If that lookup fails, the application fails too — even when the physical link, switch, and router are perfectly healthy. nslookup isolates that layer, letting you confirm whether a name resolves at all, which server answered, and how long it took.
How nslookup Works
nslookup can run in two modes. In non-interactive mode you supply the query as arguments and the tool prints the answer and exits — ideal for scripts and quick checks. In interactive mode, typing nslookup alone drops you into a prompt where you can issue multiple queries, switch the target name server, and change record types without restarting the tool.
Typical usage patterns include:
| Command | Purpose |
|---|---|
nslookup example.com |
Resolve a hostname using the default resolver |
nslookup example.com 8.8.8.8 |
Query a specific DNS server directly |
nslookup -type=MX example.com |
Retrieve mail exchange records |
nslookup -type=TXT example.com |
Read TXT records (SPF, DKIM, verification tokens) |
nslookup 192.168.1.10 |
Reverse lookup — IP address to hostname |
nslookup -debug example.com |
Show detailed query/response packets |
Queries are sent over UDP port 53 by default, falling back to TCP for large responses or zone transfers. The response reports the answering server, whether the reply was authoritative or non-authoritative, and the resolved records with their TTL values. A "Non-existent domain" (NXDOMAIN) answer means the name genuinely does not exist; a timeout means the request never reached a server or the reply was blocked — two very different problems that nslookup distinguishes clearly.
Use Cases and Applications
-
Network troubleshooting: Confirming whether a hostname failure sits in DNS or in the network path.
-
DNS server validation: Comparing answers from an internal resolver against a public one to detect stale or hijacked records.
-
Deployment verification: Checking that a newly commissioned gateway, SCADA node, or edge device registers the expected A and PTR records.
-
Email and service diagnostics: Inspecting MX, TXT, and CNAME records for mail routing and service discovery.
-
Security review: Spotting unexpected DNS answers that may indicate cache poisoning or misconfiguration.
On Windows, nslookup is complemented by Resolve-DnsName in PowerShell; on Linux, dig and host from the BIND utilities offer similar functionality with different output
