What nslookup Does
Every time you type a domain name into a browser, your operating system asks a DNS resolver to translate that name into an IP address. nslookup gives you direct access to that same process from the command line. You can query A records, MX records, TXT records, and more — and you can direct those queries to any DNS server you choose, bypassing your system's default resolver entirely. This makes nslookup invaluable for diagnosing DNS misconfigurations, verifying propagation after a DNS change, and testing public resolvers.
Two Modes: Non-Interactive and Interactive
nslookup operates in two distinct modes. In non-interactive mode, you pass all arguments on a single command line and get an immediate result. This is the mode you will use most often:
nslookup google.comOutput from a typical non-interactive lookup looks like this:
Server: 192.168.1.1
Address: 192.168.1.1#53
Non-authoritative answer:
Name: google.com
Address: 142.250.80.46The first two lines show which resolver answered the query. The "Non-authoritative answer" label means the data came from that resolver's cache, not directly from Google's authoritative name servers.
In interactive mode, you launch nslookup without arguments and enter a shell-like prompt where you can change settings between queries:
nslookup
> set type=MX
> google.com
> exitQuerying a Specific DNS Server
Add a second argument to direct the query to a specific resolver. This is one of the most useful nslookup features because it lets you compare what different resolvers return:
nslookup google.com 8.8.8.8
nslookup google.com 1.1.1.1In interactive mode, switch resolvers at any time with the server command:
> server 8.8.8.8
Default server: 8.8.8.8
> google.comQuerying Specific Record Types
By default nslookup queries for A records (IPv4 addresses). Use -type (non-interactive) or set type (interactive) to request other record types:
nslookup -type=MX gmail.com
nslookup -type=TXT google.com
nslookup -type=AAAA google.com
nslookup -type=NS google.comA TXT record lookup is especially useful for verifying SPF, DKIM, and DMARC email authentication records without logging into your DNS control panel.
Reverse DNS Lookup
Reverse DNS lookup resolves an IP address back to a hostname. Pass the IP as the argument:
nslookup 8.8.8.8nslookup constructs the in-addr.arpa PTR query automatically and returns the hostname if one is configured for that IP. This is commonly used to verify that a mail server's reverse DNS matches its forward DNS, which is a requirement for reliable email delivery.
Reading nslookup Output: Authoritative vs Non-Authoritative
When the answer comes from cache, nslookup labels it "Non-authoritative answer." When the answer comes directly from the zone's authoritative name server, nslookup shows no such label. To force an authoritative query, set the server to the domain's actual name server. First find the NS record, then query that server directly:
nslookup -type=NS example.com
nslookup example.com ns1.example.comUseful Flags and Interactive Commands
| Mode | Flag / Command | Effect |
|---|---|---|
| Non-interactive | -type=MX |
Query MX records (replace MX with any record type) |
| Non-interactive | -debug |
Show full query and response packets |
| Non-interactive | -timeout=10 |
Set query timeout in seconds |
| Non-interactive | -port=5353 |
Query a non-standard DNS port |
| Interactive | set type=TXT |
Switch to querying TXT records |
| Interactive | set debug |
Enable verbose packet output |
| Interactive | server 1.1.1.1 |
Switch to a different resolver |
| Interactive | exit |
Leave interactive mode |
When to Use nslookup Over dig
On Windows, nslookup is the built-in tool and dig is not available unless you install BIND utilities or use WSL. For any DNS troubleshooting on a Windows machine, nslookup is your primary tool. On Linux and macOS, dig provides more structured output and is better suited for scripting, but nslookup is universally available and sufficient for interactive diagnostics. If you need to quickly check whether a DNS record exists or which IP a domain resolves to, nslookup works identically across all three platforms.
Frequently Asked Questions
Is nslookup available on Windows?
Yes. nslookup is built into every version of Windows and is available from Command Prompt or PowerShell without any installation. It is also included by default on macOS and most Linux distributions.
How do I look up an MX record with nslookup?
In non-interactive mode, run: nslookup -type=MX example.com. In interactive mode, first type set type=MX, then type the domain name and press Enter. Both methods return the mail exchanger records for the domain.
What is the difference between authoritative and non-authoritative answers?
An authoritative answer comes directly from the DNS server that is responsible for the domain. A non-authoritative answer comes from a resolver that cached the record from a prior lookup. Cached answers may be slightly out of date but are usually correct.
How do I do a reverse DNS lookup with nslookup?
Pass the IP address as the argument: nslookup 8.8.8.8. nslookup automatically constructs the in-addr.arpa PTR query and returns the hostname associated with that IP address.
What is the difference between nslookup and dig?
dig provides more detailed output including the full DNS response sections (QUESTION, ANSWER, AUTHORITY, ADDITIONAL) and is preferred for scripting on Linux and macOS. nslookup is simpler and available on Windows by default, making it the practical choice in Windows environments.
How do I query a specific DNS server with nslookup?
Add the server IP as the second argument: nslookup example.com 8.8.8.8. This tells nslookup to send the query to 8.8.8.8 (Google's public resolver) instead of your system's configured DNS server. In interactive mode, type server 8.8.8.8 to switch resolvers mid-session.