nslookup is a command-line utility used to query Domain Name System (DNS) servers to diagnose and troubleshoot domain name resolution problems. It translates human-readable domain names like google.com into machine-readable IP addresses and verifies DNS server configurations.
When a user types a website address into a browser, the system must convert that name into an IP address. nslookup performs this conversion manually and displays detailed results, including the DNS server being queried, response time, and record types such as A, AAAA, MX, and TXT records.
It's commonly used by network administrators, developers, and IT support staff to verify DNS settings, test connectivity, or confirm whether a domain is properly configured. The tool runs on Windows, macOS, and Linux systems and requires no installation on most platforms.
nslookup sends queries to DNS servers using UDP or TCP protocols. By default, it uses the system's configured DNS resolver, but users can specify a custom server by providing its IP address or hostname.
For example, running nslookup google.com 8.8.8.8 forces the query to go through Google's public DNS server instead of the local resolver. This helps isolate whether a problem lies with the local network or the domain's DNS setup.
The tool returns multiple data points: the resolved IP address, the DNS server that responded, the query time, and the record type. If a domain doesn't resolve, nslookup shows error codes like "Non-existent domain" or "Server failed to respond."
nslookup returns various DNS record types depending on the query. The most common are:
| Record Type | Purpose | Example Output |
|---|---|---|
| A | Maps a domain to an IPv4 address | google.com has address 142.250.180.46 |
| AAAA | Maps a domain to an IPv6 address | google.com has IPv6 address 2a00:1450:4001:805::2004 |
| MX | Specifies mail servers for a domain | google.com mail is handled by 10 alt1.aspmx.l.google.com |
| TXT | Stores text-based data, often used for email authentication | google.com descriptive text: "v=spf1 include:_spf.google.com ~all" |
Running nslookup -type=mx google.com retrieves only MX records, which is useful for verifying email routing. Similarly, nslookup -type=txt google.com shows SPF and DKIM records critical for email security.
Some versions of nslookup also support reverse lookups via nslookup 142.250.180.46, which returns the domain associated with an IP address. This helps identify the owner of a given IP or detect misconfigured servers.
Network engineers use nslookup to validate DNS propagation after updating records. After changing a domain's A record to point to a new web server, they run nslookup yourdomain.com to confirm the new IP appears within minutes.
During troubleshooting, if a website fails to load, a user might run nslookup example.com and see that the domain resolves to 93.184.216.34. If the result is blank or shows "server failed," the issue likely lies with DNS configuration or network access.
As a practical example: I once diagnosed a site outage for a client whose domain pointed to a dead server. Running nslookup client-site.com returned "No answer" from the primary DNS server. Switching to nslookup client-site.com 1.1.1.1 (Cloudflare's DNS) returned the correct IP. The fix was updating the domain's nameserver records to point to a working provider.
nslookup is not a diagnostic tool for network connectivity beyond DNS. It cannot test whether a port is open or whether a service is reachable. Tools like ping, traceroute, or curl are better suited for testing actual network reachability.
It also differs from dig, another DNS query tool. While both perform similar functions, dig offers more advanced options-such as specifying query flags, parsing raw packet data, or querying multiple record types in one command. nslookup is simpler and more accessible for beginners.
A common misunderstanding is that nslookup can detect malware or phishing sites. It cannot. It only reports what DNS servers return. A malicious domain may resolve correctly if its DNS is properly configured, so relying solely on nslookup for security is ineffective.
Always test with multiple DNS servers. If nslookup google.com fails but nslookup google.com 8.8.8.8 succeeds, the issue is with the local DNS resolver, not the domain itself.
Use the -debug flag to see internal query details. This mode shows the full request and response process, including which DNS server was contacted and how long it took. It's invaluable for diagnosing slow or inconsistent DNS behavior.
nslookup does not cache results. Each query hits the DNS server directly. This ensures accuracy but can lead to slower performance if multiple queries are needed. For bulk operations, scripts using dig or Python's dnspython library are more efficient.
One non-obvious fact: nslookup defaults to recursive queries, meaning it follows referrals from root servers to TLD servers to authoritative servers. But if a DNS server is misconfigured to ignore recursion, nslookup may fail even if the domain exists. This is rare but can cause confusion during troubleshooting.
nslookup is used to query DNS servers and verify domain name resolution. It helps identify issues with DNS configuration, test server responses, and inspect specific DNS record types. It's essential for diagnosing connectivity problems related to domain resolution.
Understanding what nslookup is used for enables faster troubleshooting of internet access issues. It's a foundational tool in network diagnostics, especially when combined with other utilities like ping and dig.