nslookup command: syntax, record types and real output on Windows, Linux and macOS

Short answer: nslookup NAME asks your DNS server for the addresses of a name; nslookup -type=mx NAME asks for another record type, and a second argument, as in nslookup NAME 1.1.1.1, sends the question to that server instead. The command is built into Windows and macOS. On Linux it comes with the BIND tools package, which minimal images leave out. The outputs below come from nslookup 9.18 on Debian 12, shortened where marked; Windows prints the same answers in a slightly different layout.

Options go before the name and start with a hyphen. Replace example.com with the domain you are checking and 203.0.113.10 with the IP address you want a name for.

How do you read nslookup output?

nslookup example.com

Server:         1.1.1.1
Address:        1.1.1.1#53

Non-authoritative answer:
Name:   example.com
Address: 104.20.23.154
Name:   example.com
Address: 172.66.147.243
Name:   example.com
Address: 2606:4700:10::ac42:93f3
Name:   example.com
Address: 2606:4700:10::6814:179a

• Server / Address: the DNS server that answered and its port, #53. Without a second argument this is the first server in /etc/resolv.conf on Linux and macOS, or the adapter’s DNS server on Windows. On Ubuntu it reads 127.0.0.53: that is the local systemd-resolved stub, which forwards to the real servers that resolvectl status lists.
• Non-authoritative answer: the answer came from a resolver that looked it up or had it cached, not from a server that hosts the zone. That is normal for every everyday lookup and does not mean the answer is doubtful.
• Name / Address pairs: one per record. Without -type, BIND 9.11 and later (any current Linux) ask for A and then AAAA, so IPv4 and IPv6 addresses both appear. The nslookup bundled with macOS is BIND 9.10 and asks for A only, so add -type=aaaa there.

On Windows, the first two lines show the resolver’s name, found by a reverse lookup of its address. Server: UnKnown only means that address has no PTR record. It does not affect the answer.

To get an authoritative answer, ask one of the zone’s own name servers. The “Non-authoritative” line disappears:

nslookup example.com elliott.ns.cloudflare.com

Server:         elliott.ns.cloudflare.com
Address:        108.162.195.228#53

Name:   example.com
Address: 172.66.147.243
Name:   example.com
Address: 104.20.23.154

This is how you check a DNS change before caches catch up: the zone’s own server has the new value at once, while a resolver may serve the old one until its TTL runs out.

How do you look up MX, TXT, NS and other records?

Add -type= (or its synonym -query=) with the record type. Case does not matter.

MX: which servers receive mail

nslookup -type=mx google.com

Non-authoritative answer:
google.com      mail exchanger = 10 smtp.google.com.

The number is the preference: senders try the lowest first. example.com answers mail exchanger = 0 ., a “null MX” (RFC 7505) that says the domain accepts no mail at all. If no MX record exists, senders fall back to the domain’s address record. After answers like this, the Linux and macOS version often prints an empty Authoritative answers can be found from: heading; it has nothing to list and can be ignored.

TXT: SPF, DMARC, DKIM and verification strings

nslookup -type=txt example.com
nslookup -type=txt _dmarc.google.com

example.com     text = "v=spf1 -all"
example.com     text = "_k2n1y4vw3qtb4skdx9e7dxt97qrmmq9"

_dmarc.google.com       text = "v=DMARC1; p=reject; rua=mailto:mailauth-reports@google.com"

SPF lives on the domain itself, DMARC under _dmarc., and a DKIM key under SELECTOR._domainkey., where SELECTOR is the name your mail provider gave you. A long record such as a DKIM key is often split into several quoted strings; receivers join them without spaces. To check that the records also parse correctly, the DMARC checker and its SPF and DKIM siblings go further than a raw lookup.

NS and SOA: who serves the zone

nslookup -type=ns vmheaven.io
nslookup -type=soa vmheaven.io

vmheaven.io     nameserver = aisha.ns.cloudflare.com.
vmheaven.io     nameserver = dimitris.ns.cloudflare.com.

vmheaven.io
        origin = aisha.ns.cloudflare.com
        mail addr = dns.cloudflare.com
        serial = 2415933946
        refresh = 10000
        retry = 2400
        expire = 604800
        minimum = 1800

origin is the primary name server, mail addr the zone contact with the first dot standing for @, and serial changes with every edit. The last field, minimum, together with the SOA record’s own TTL caps how long resolvers may cache a “name does not exist” answer. That is why a record you just created can stay invisible for a while; DNS_PROBE_FINISHED_NXDOMAIN shows the arithmetic.

AAAA and CNAME

nslookup -type=aaaa one.one.one.one
nslookup www.github.com

Name:   one.one.one.one
Address: 2606:4700:4700::1111
Name:   one.one.one.one
Address: 2606:4700:4700::1001

www.github.com  canonical name = github.com.
Name:   github.com
Address: 140.82.121.4

A plain lookup follows a CNAME and prints both steps. -type=cname shows only the alias. Other types work the same way: -type=srv _service._tcp.example.com, -type=caa or -type=ptr.

Why -type=any does not show all records

Many tutorials say -type=any lists every record of a name. Since RFC 8482, both resolvers and a domain’s own name servers may answer an ANY query with a minimal response, so what you get depends on whom you ask:

nslookup -type=any example.com 1.1.1.1
** server can't find example.com: NOTIMP

nslookup -type=any example.com 8.8.8.8
example.com     hinfo = "RFC8482" ""

nslookup -type=any google.com 8.8.8.8
(35 records: A, AAAA, MX, NS, SOA, TXT, CAA, HTTPS)

Cloudflare’s resolver refuses ANY outright. example.com is hosted on Cloudflare’s name servers, which answer every ANY with that placeholder HINFO record, and Google’s resolver passes it on. google.com’s own servers still return the full set. Other resolvers may answer from whatever they have cached: Quad9 returned the google.com set without its CAA record. Ask for each type separately, or use the DNS lookup tool: its “All” option asks for A, AAAA, CNAME, MX, NS, TXT, SOA and CAA as separate queries and shows each record with its TTL.

How do you query a specific DNS server?

Put the server after the name, as an IP address or a host name:

nslookup example.com 1.1.1.1
nslookup example.com 9.9.9.9
nslookup -port=5335 example.com 127.0.0.1
nslookup -vc example.com 1.1.1.1

Comparing two public resolvers shows whether a change has reached them. When your own resolver fails and 1.1.1.1 answers, the problem is your DNS configuration, not the domain; on Linux, “Temporary failure in name resolution” is the error you will see then. -port= reaches a resolver on a non-standard port, such as a local unbound instance behind Pi-hole (5335 in Pi-hole’s own guide), and -vc sends the query over TCP instead of UDP. That helps on networks that block or tamper with UDP port 53. To see all resolvers at once instead of one by one, the DNS propagation checker asks twelve public resolvers and the domain’s own name server in parallel.

How do you do a reverse DNS lookup with nslookup?

Give an IP address instead of a name. nslookup turns it into a PTR query under in-addr.arpa (IPv4) or ip6.arpa (IPv6):

nslookup 1.1.1.1
nslookup 2606:4700:4700::1111
nslookup -type=ptr 1.1.1.1.in-addr.arpa

1.1.1.1.in-addr.arpa    name = one.one.one.one.

1.1.1.1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.7.4.0.0.7.4.6.0.6.2.ip6.arpa        name = one.one.one.one.

The third form asks for the PTR record by its full name and returns the same answer; it is what you type when you want to check the reversed spelling yourself. The PTR record is set by whoever holds the address block, not by the domain owner, so a missing or generic name says nothing about the domain. For a mail server it matters: receivers check that the PTR names a host whose A record points back to the same address. On a VMHeaven VPS you set the PTR yourself in the panel; changes take effect within about 30 minutes, and the name must resolve back to the IP, or mail providers ignore it. Use a fully qualified domain name there, not a bare host name. The full setup, with the forward-confirmed check, is in Reverse DNS and PTR records.

How does interactive mode work?

Run nslookup with no arguments, or nslookup - 9.9.9.9 to start with a given server. The prompt changes to >, and each line is a name to look up or a setting:

> server 9.9.9.9
Default server: 9.9.9.9
Address: 9.9.9.9#53
> set type=mx
> vmheaven.io
Server:         9.9.9.9
Address:        9.9.9.9#53

Non-authoritative answer:
vmheaven.io     mail exchanger = 10 mail.vmheaven.io.

Authoritative answers can be found from:
> set type=a
> one.one.one.one
Server:         9.9.9.9
Address:        9.9.9.9#53

Non-authoritative answer:
Name:   one.one.one.one
Address: 1.1.1.1
Name:   one.one.one.one
Address: 1.0.0.1
> exit

set all prints the current settings, set debug and set nodebug switch the packet view, and exit leaves. Windows’ nslookup also has ls, which requests a full zone transfer. Nearly every public server refuses that; BIND’s nslookup does not implement ls at all, and dig axfr example.com @NAMESERVER is the tool for your own servers.

How do you see TTLs? Use -debug

nslookup -debug -type=a example.com 1.1.1.1

------------
    QUESTIONS:
        example.com, type = A, class = IN
    ANSWERS:
    ->  example.com
        internet address = 172.66.147.243
        ttl = 126
    ->  example.com
        internet address = 104.20.23.154
        ttl = 126
    AUTHORITY RECORDS:
    ADDITIONAL RECORDS:
------------

The ttl is how many more seconds this resolver will keep serving the cached answer. Ask twice and it counts down; ask the authoritative server and you see the full value set in the zone. On Windows, -d2 prints every field of every packet; the BIND version prints its own internal trace instead, which rarely helps.

What do nslookup’s error messages mean?

The “No answer” case trips people up: nslookup -type=aaaa github.com prints it because GitHub has no IPv6 records, not because something is broken. For scripts, note that BIND’s nslookup exits with status 1 on NXDOMAIN, SERVFAIL, REFUSED and timeouts, but with 0 on “No answer”. Windows waits two seconds per attempt by default; -timeout=2 -retry=1 makes the Linux version give up after a single two-second try instead of about fifteen seconds. A domain that fails in the browser with an NXDOMAIN page is the subject of DNS_PROBE_FINISHED_NXDOMAIN, with the checks for both visitors and site owners.

nslookup vs dig vs host vs Resolve-DnsName

Switch to dig when you need the response flags (aa for authoritative, ad for DNSSEC-validated), the Extended DNS Error codes newer resolvers send, +trace to see where a delegation breaks, or +short for scripts. nslookup, dig and host never read /etc/hosts: they ask a DNS server directly. To see what your programs actually get, including hosts entries, use getent hosts example.com on Linux. How resolvers, caches and authoritative servers fit together is explained in What is DNS.

What is the PowerShell alternative to nslookup?

Resolve-DnsName ships with Windows and returns objects you can filter. Without -Type it asks for A and AAAA together:

Resolve-DnsName example.com
Resolve-DnsName example.com -Type MX -Server 1.1.1.1
Resolve-DnsName _dmarc.google.com -Type TXT
Resolve-DnsName 1.1.1.1 -Type PTR
Resolve-DnsName example.com -DnsOnly -NoHostsFile -TcpOnly

-DnsOnly skips LLMNR and NetBIOS, -NoHostsFile ignores the hosts file, -TcpOnly uses TCP, and -DnssecOk requests DNSSEC records. Unlike nslookup, it can answer from the hosts file and the Windows DNS cache, which is closer to what Windows programs get.

How do you fix nslookup: command not found?

nslookup, dig and host ship together in the BIND client tools, which minimal server images and containers leave out:

sudo apt update && sudo apt install -y bind9-dnsutils

sudo dnf install -y bind-utils

apk add --no-cache bind-tools

The old package name dnsutils still works: on Debian 12 and Ubuntu it is a transitional package that pulls in bind9-dnsutils, and on Debian 13 it is a virtual name that bind9-dnsutils provides. Alpine already has a small BusyBox nslookup without the extra package. Arch Linux packs the tools in bind. The same fix for dig, with Docker and WSL cases, is in dig: command not found.

Frequently asked