Command Reference
nslookup
Gnojo Analysis
Understanding nslookup
What This Command Does
The nslookup (name server lookup) command is a network administration command-line tool available for many computer operating systems for querying the Domain Name System (DNS) to obtain domain name or IP address mapping or for any other specific DNS record. It is used to troubleshoot DNS-related issues, such as verifying that a domain name resolves to the correct IP address or checking the availability and responsiveness of DNS servers.
When to Use It
Use nslookup when troubleshooting networking issues and you need information that can help narrow down the cause.
What to Look For
Server
Indicates the IP address of the DNS server that responded to the query. This is crucial for verifying which server is providing DNS resolution.
Address
For a forward lookup, this is the IP address(es) resolved for the queried hostname. For a reverse lookup, it's the IP address being queried. This field confirms the resolved IP.
Name
The hostname that was queried or the hostname found during a reverse lookup. Ensures the correct name is being resolved or returned.
Non-authoritative answer
This message indicates that the DNS server that provided the answer is not authoritative for the domain. The answer came from a cached entry or a DNS server that forwarded the request to an authoritative server. It's usually not an error but important to note for trust and freshness of data.
Permissions
Administrator access is not normally required for this command.
Risk and impact
Using `nslookup` poses minimal to no risk. It performs read-only queries against DNS servers and does not alter system or network configurations. Repeated queries could marginally increase network traffic, but this is negligible in almost all scenarios.
Summary
The nslookup (name server lookup) command is a network administration command-line tool available for many computer operating systems for querying the Domain Name System (DNS) to obtain domain name or IP address mapping or for any other specific DNS record. It is used to troubleshoot DNS-related issues, such as verifying that a domain name resolves to the correct IP address or checking the availability and responsiveness of DNS servers.
Syntax
nslookup [options] [hostname | IP_address] [DNS_server]Examples
nslookup www.google.comResolves the hostname 'www.google.com' using the default DNS server configured on the system.
nslookup 8.8.8.8Performs a reverse DNS lookup for the IP address '8.8.8.8' using the default DNS server. This attempts to find the hostname associated with the IP.
nslookup -query=mx example.com 1.1.1.1Queries for Mail Exchanger (MX) records for 'example.com' using '1.1.1.1' (Cloudflare DNS) as the specific DNS server, rather than the system's default.
Permissions
Administrator required: No
The `nslookup` command does not require elevated administrative privileges to run. However, network access to a DNS server (typically UDP port 53) is necessary for it to function correctly.
Risk and Impact
Risk level: Low
Changes the system: No
Using `nslookup` poses minimal to no risk. It performs read-only queries against DNS servers and does not alter system or network configurations. Repeated queries could marginally increase network traffic, but this is negligible in almost all scenarios.
Supported Platforms
Important Output Fields
Server
Indicates the IP address of the DNS server that responded to the query. This is crucial for verifying which server is providing DNS resolution.
Address
For a forward lookup, this is the IP address(es) resolved for the queried hostname. For a reverse lookup, it's the IP address being queried. This field confirms the resolved IP.
Name
The hostname that was queried or the hostname found during a reverse lookup. Ensures the correct name is being resolved or returned.
Non-authoritative answer
This message indicates that the DNS server that provided the answer is not authoritative for the domain. The answer came from a cached entry or a DNS server that forwarded the request to an authoritative server. It's usually not an error but important to note for trust and freshness of data.
-querytype=X (or set type=X)
An option to specify the type of DNS record to query (e.g., A for host address, MX for mail exchange, NS for name server, CNAME for canonical name, SOA for start of authority). Essential for diagnosing specific service issues.
Common Errors
*** Can't find hostname: Non-existent domain
This error means the DNS server could not find a record for the specified hostname. This could be due to a typo in the hostname, the domain not being registered, or the DNS records not being published or propagated yet.
*** Can't find hostname: No response from server
The DNS server specified (or the default server) did not respond to the query. This could indicate that the DNS server is offline, unreachable due to network issues, or its firewall is blocking DNS requests.
DNS request timed out.
Similar to 'No response from server', this indicates that the DNS server did not reply within the default timeout period. Possible causes include network congestion, an overloaded DNS server, or a firewall blocking UDP port 53.
Server: Unknown
When nslookup cannot determine the name of the default DNS server. This often happens if the local system's DNS configuration is incorrect or corrupted, or if the DNS server itself has no reverse lookup entry for its own IP.
Related Commands
Continue troubleshooting with related diagnostic commands.
Official References
nslookup | Microsoft Learn
Microsoft Learn · Official Documentation