nslookup - Look Up DNS Records
The nslookup command queries a DNS server and shows how a domain name maps to an IP address (the result of name resolution).
When a website won’t load or email isn’t arriving, it is a good first step for finding out whether DNS is the cause.
Basic syntax of the nslookup command
nslookup [-<option>] [<name or IP address to look up>] [<DNS server to query>]If you run it without arguments, it starts interactive mode, described below.
Look up an IP address from a domain name
Specify the domain name you want to look up.
nslookup example.com
The output has two parts.
- The first two lines: the name and address of the DNS server that received the query (the one configured on your PC)
- The rest: the domain name you looked up and its IP addresses
A “Non-authoritative answer” means the reply came from an intermediate DNS server that holds a cache, not from the DNS server that actually manages the domain. It appears often in normal queries and is not an error.
The output above is only an example. The DNS server name and the number and order of IP addresses depend on your network and when you run the query.
Look up a domain name from an IP address (reverse lookup)
If you specify an IP address instead of a domain name, nslookup performs a reverse lookup to find the host name for that address.
nslookup 8.8.8.8
中小企業経営者のためのRPA入門 RPA導入を成功させる方法
60分でわかる！ AIエージェント 超 入門
コマンドラインの黒い画面が怖いんです。
知識・才能ゼロでもらく～に月10万円稼ぐ! よくわかるAI副業超入門
For an IP address that has no reverse record (PTR record), no name is found and an error may appear.
If the DNS server you are querying has no PTR record for its own address, the first line shows Server: UnKnown. This has nothing to do with your query result and is not an error.
Query a specific DNS server
If you specify a DNS server as the second argument, nslookup queries that server instead of the one configured on your PC.
nslookup example.com 1.1.1.1If the result differs from your PC’s default DNS server, the settings or cache of the default server may be the problem.
This is also useful right after you change DNS records, to check whether the change has propagated to several servers.
Specify the record type
DNS stores many kinds of information (records) besides IP addresses. Use the -type= option to choose which kind to look up.
nslookup -type=<record type> <domain name>| Record type | Description |
|---|---|
A | IPv4 address for the domain name |
AAAA | IPv6 address for the domain name |
MX | Where mail is delivered (mail servers) |
NS | Name servers that manage the domain |
TXT | Text information (also used for email authentication like SPF) |
CNAME | Alias (points to the canonical name) |
SOA | Administrative information about the domain |
PTR | Host name for an IP address (used for reverse lookups) |
ANY | All records (some servers do not respond to this) |
Look up mail servers (MX records)
nslookup -type=MX example.comWhen email isn’t arriving, you can check whether the destination mail servers are configured correctly.
Look up name servers (NS records)
nslookup -type=NS example.comYou can see which DNS servers are responsible for the domain. This is commonly used after a domain transfer or a change of DNS settings.
Look up TXT records
nslookup -type=TXT example.comYou can check strings used to verify domain ownership, as well as email authentication settings such as SPF.
Use interactive mode
If you run nslookup without arguments, a > prompt appears and you can enter queries repeatedly.
These are the commands you will use most often in interactive mode.
| Command | Description |
|---|---|
set type=<type> | Change the record type to look up |
server <DNS server> | Change the DNS server to query |
<domain name> | Query the name you typed |
exit | Leave interactive mode |
Interactive mode is more efficient when you want to query the same domain repeatedly while changing the record type or DNS server.
How to read error messages
Non-existent domain
The domain name you queried does not exist in DNS. Possible causes are a typo in the domain name, or a domain that was never registered or has expired.
DNS request timed out
The output varies by Windows version.
This means the DNS server did not reply in time. Possible causes are a wrong DNS server address, no network connection, or a firewall blocking DNS (port 53 over UDP/TCP).
ping resolves host names through your PC’s own name resolution mechanism (including the hosts file and the DNS cache), whereas nslookup queries the DNS server directly. So if nslookup succeeds but ping cannot resolve the name, the cause may be a PC-side setting such as the hosts file or the local cache. Conversely, if ping connects to a different address than nslookup shows, a hosts file entry may be responsible. You can view the DNS cache with ipconfig /displaydns and clear it with ipconfig /flushdns.
Using it in a batch file
You can filter the output of nslookup with the findstr command to pick out only the lines you need.
@echo off
nslookup -type=MX example.com | findstr /i /c:"mail exchanger"The | (pipe) passes the output of nslookup to findstr. Because findstr treats a space in the search string as “or”, /c: is added so that the whole string mail exchanger is searched. As a result, only the MX record lines (MX preference = ..., mail exchanger = ...) are displayed.
The actual output depends on how the domain is configured.
The format of the nslookup output can change with the Windows version, the display language, and the information returned. Processing that assumes a specific line or position in the output may stop working when the environment changes, so test it thoroughly.