nslookup

nslookup is a command-line tool that queries Domain Name System (DNS) servers to retrieve domain name records, IP addresses, and nameserver information on Linux, macOS, and Windows.

What nslookup Does and When to Use It

nslookup (name server lookup) sends queries to DNS servers and displays the responses. The tool maps domain names to IP addresses, retrieves mail exchange (MX) records, identifies authoritative nameservers, and performs reverse DNS lookups. Andrew Cherenson created nslookup in 1986 at UC Berkeley, and it first shipped with 4.3-Tahoe BSD as part of the BIND name server software.

nslookup operates on all major platforms -- Linux, macOS, and Windows. The tool comes preinstalled on most operating systems. System administrators use nslookup to diagnose DNS resolution failures, verify record propagation after changes, and troubleshoot mail delivery problems.

nslookup is not a replacement for dig or host. For scripted DNS queries, DNSSEC validation, or detailed packet inspection, dig provides more granular output. nslookup remains the standard choice for quick, interactive DNS lookups because of its availability and straightforward output format.

How to Install nslookup

nslookup ships preinstalled on Windows, macOS, and most Linux distributions. If the command is missing, install the dnsutils package (Debian/Ubuntu) or bind-utils package (RHEL/CentOS).

=== "Ubuntu / Debian"

sudo apt update && sudo apt install dnsutils

=== "RHEL / CentOS / Fedora"

sudo dnf install bind-utils

=== "macOS"

brew install bind

For a detailed walkthrough on Ubuntu, see How to install nslookup on Ubuntu.

Core Concepts of nslookup

nslookup Interactive Mode

nslookup supports an interactive mode for running multiple queries in a single session. Enter interactive mode by typing nslookup with no arguments. The prompt changes to >, and each subsequent line accepts a domain name, IP address, or set command. Interactive mode persists DNS server and query type settings across multiple lookups.

For a full walkthrough, see nslookup tutorial: interactive mode.

nslookup Non-Interactive Mode

nslookup runs in non-interactive mode when arguments follow the command on a single line. Non-interactive mode suits one-off lookups and shell scripts. The syntax is nslookup [options] {hostname} [dns-server].

nslookup Query Types

nslookup queries specific DNS record types with the -type= flag. The most common query types are A (IPv4 address), AAAA (IPv6 address), MX (mail exchange), NS (nameserver), SOA (start of authority), PTR (pointer/reverse), TXT (text), and CNAME (canonical name). The -type=any flag retrieves all available record types for a domain.

Authoritative vs. Non-Authoritative Answers in nslookup

nslookup labels each response as authoritative or non-authoritative. An authoritative answer comes directly from a nameserver that holds the zone file for the queried domain. A non-authoritative answer comes from a resolver's cache -- the resolver previously obtained the record from an authoritative source and stored it with a Time to Live (TTL) value.

Common Tasks with nslookup

How to Look Up an IP Address with nslookup

nslookup retrieves the A record (IPv4 address) of a domain with a basic query:

nslookup example.com

The output shows the DNS resolver used, plus the domain's IP address under "Non-authoritative answer."

How to Check MX Records with nslookup

nslookup displays mail exchange (MX) records when the -type=mx flag targets a domain:

nslookup -type=mx example.com

For the full procedure, see How to check MX records with nslookup.

How to Perform a Reverse DNS Lookup with nslookup

nslookup resolves an IP address back to its associated domain name by querying PTR records:

nslookup 203.0.113.50

For the full procedure, see How to perform a reverse DNS lookup with nslookup.

How to Query a Specific DNS Server with nslookup

nslookup directs a query to a specific nameserver by adding the server address as the second argument:

nslookup example.com 8.8.8.8

For the full procedure, see How to specify a DNS server with nslookup.

nslookup Command Reference

For the full reference, see nslookup references.

Related Tools and Guides

dig (Domain Information Groper) provides more detailed DNS query output than nslookup, including DNSSEC validation and granular packet inspection. See the dig articlefor DNS lookups with scriptable output.

host is a streamlined DNS lookup utility that produces simpler output than nslookup. It suits quick lookups where only the resolved address matters.

The whois command retrieves domain registration data -- registrar, expiration date, and nameserver assignments -- which complements the DNS record data that nslookup returns.