How to use nslookup on Windows, macOS and Linux?

To use nslookup, open a terminal (Command Prompt or PowerShell on Windows, Terminal on macOS or Linux) and type nslookup followed by a domain name, such as nslookup example.com. It asks your configured DNS server for the domain's addresses and prints the answer. To look up a different record type, add -type= (for example nslookup -type=mx example.com), and to ask a specific DNS server, put its address at the end (for example nslookup example.com 1.1.1.1). The same basic syntax works on all three operating systems.

nslookup has been around since the 1980s and ships with Windows and macOS out of the box, which makes it the one DNS tool you can rely on being available almost anywhere. This guide covers how to install it where it's missing, the everyday commands you'll actually use, how to read its output, interactive mode, the differences between the Windows and Unix versions, and the quirks that can make nslookup tell you something different from what your browser sees.

What nslookup Does

nslookup (name server lookup) sends a DNS query to a DNS server and shows you the response. By default it asks the first DNS server your system is configured to use, which is usually your router, your company's resolver, or a public service such as Cloudflare (1.1.1.1), Google (8.8.8.8) or Quad9 (9.9.9.9).

It's useful for answering questions such as:

• Does this domain resolve at all? And to which IP addresses?
• Which mail servers handle email for a domain?
• What does a particular DNS server return, compared with another one?
• Has my DNS change taken effect on the resolver I'm using?
• Which hostname belongs to an IP address (reverse lookup)?

nslookup is simpler than dig, and its output is less detailed. It doesn't show TTLs or response flags by default, for example. For quick checks, though, it's perfectly good, and on a locked-down Windows machine it may be the only tool you have.

Installing nslookup

Windows

nslookup is built into every version of Windows. Open Command Prompt or PowerShell and run it directly. No installation is needed.

macOS

nslookup is included with macOS. Open Terminal and run it.

Linux

Most desktop distributions include it, but minimal server images and containers often don't. It's part of the BIND utilities package:

# Debian and Ubuntu
sudo apt update
sudo apt install dnsutils

# Fedora, RHEL, Rocky Linux and AlmaLinux
sudo dnf install bind-utils

# Alpine Linux
sudo apk add bind-tools

# Arch Linux
sudo pacman -S bind

These packages also install dig and host. Check that it works with:

nslookup -version

The -version option only exists in the BIND version used on Linux and macOS. The Windows version doesn't support it.

Basic Lookups

Look Up a Domain's IP Address

The simplest use is a plain lookup:

nslookup example.com

On Linux or macOS, the output looks like this:

Server:		127.0.0.53
Address:	127.0.0.53#53

Non-authoritative answer:
Name:	example.com
Address: 192.0.2.10
Name:	example.com
Address: 2001:db8::10

On Windows, the same command produces slightly different formatting:

Server:  UnKnown
Address:  192.168.1.1

Non-authoritative answer:
Name:    example.com
Addresses:  2001:db8::10
          192.0.2.10

The output has two parts:

1. Server and Address: The DNS server that answered. On Ubuntu, 127.0.0.53 is the local systemd-resolved stub, which forwards queries to your real resolver.
2. The answer: The name you asked for and the addresses returned. Both IPv4 (A) and IPv6 (AAAA) records are shown when they exist.

What "Non-authoritative answer" Means

This line confuses a lot of people, but it's normal. It means the server that answered isn't one of the domain's own authoritative nameservers. It's a resolver that looked up the answer (or had it cached) on your behalf. You'll see it on almost every lookup. It doesn't mean the answer is wrong.

What "Server: UnKnown" Means on Windows

Windows nslookup tries to look up the hostname of the DNS server itself by doing a reverse (PTR) lookup on its IP address. Home routers rarely have a PTR record, so Windows prints UnKnown. It's cosmetic and doesn't affect the lookup.

Querying Specific Record Types

Use -type= (or its synonym -query=) to choose the record type. The type name isn't case-sensitive.

Record	Command	What it shows
A	nslookup -type=a example.com	IPv4 addresses
AAAA	nslookup -type=aaaa example.com	IPv6 addresses
MX	nslookup -type=mx example.com	Mail servers and priorities
TXT	nslookup -type=txt example.com	SPF, verification tokens and other text
NS	nslookup -type=ns example.com	Authoritative nameservers
SOA	nslookup -type=soa example.com	Zone serial, timers and primary server
CNAME	nslookup -type=cname www.example.com	Alias target
PTR	nslookup 192.0.2.10	Hostname for an IP address
SRV	nslookup -type=srv _sip._tcp.example.com	Service host, port and priority
CAA	nslookup -type=caa example.com	Certificate authorities allowed to issue

MX Records

nslookup -type=mx example.com

Non-authoritative answer:
example.com	mail exchanger = 10 mx1.example.net.
example.com	mail exchanger = 20 mx2.example.net.

The number before each hostname is the preference. Lower numbers are tried first. On Windows, the same answer appears as MX preference = 10, mail exchanger = mx1.example.net.

TXT Records

nslookup -type=txt example.com

Non-authoritative answer:
example.com	text = "v=spf1 include:_spf.google.com -all"
example.com	text = "google-site-verification=abc123exampletoken"

This is a quick way to confirm that an SPF record or a domain verification token has been published.

To check a DMARC or DKIM record, query the specific name where it lives:

nslookup -type=txt _dmarc.example.com
nslookup -type=txt selector1._domainkey.example.com

NS and SOA Records

nslookup -type=ns example.com

Non-authoritative answer:
example.com	nameserver = ns1.example.net.
example.com	nameserver = ns2.example.net.

The SOA record shows the zone's primary nameserver, the administrator's contact address and its timers:

nslookup -type=soa example.com

Non-authoritative answer:
example.com
	origin = ns1.example.net
	mail addr = hostmaster.example.com
	serial = 2026101701
	refresh = 7200
	retry = 3600
	expire = 1209600
	minimum = 3600

The serial is particularly handy. If you edit a zone and the serial on a nameserver hasn't changed, that server hasn't received your update yet.

Reverse Lookups

To find the hostname for an IP address, pass the address instead of a name. nslookup builds the in-addr.arpa (IPv4) or ip6.arpa (IPv6) query for you:

nslookup 192.0.2.10

10.2.0.192.in-addr.arpa	name = www.example.com.

If there's no PTR record, you'll see an NXDOMAIN error instead. That's common for home and cloud IP addresses unless someone has set reverse DNS deliberately.

Choosing Which DNS Server to Ask

By default nslookup asks your system's resolver. To ask a different server, add its IP address or hostname as the last argument:

# Ask Cloudflare's public resolver
nslookup example.com 1.1.1.1

# Ask Google Public DNS for MX records
nslookup -type=mx example.com 8.8.8.8

# Ask an authoritative nameserver directly
nslookup -type=a example.com ns1.example.net

This is one of the most useful things nslookup can do. Comparing answers tells you where a problem lives:

• Authoritative server has the new value, public resolver has the old one: The old answer is still cached. Wait for the TTL to expire.
• Authoritative server has the old value: Your change hasn't been saved, or you edited the zone at a provider that isn't actually serving your domain.
• Your local resolver fails but 1.1.1.1 works: The problem is your network's DNS server, not the domain.

When you query an authoritative nameserver directly, the "Non-authoritative answer" line disappears, because that server is the authority for the zone.

Interactive Mode

If you run nslookup with no arguments, it starts an interactive session with a > prompt. This is handy when you want to run several lookups against the same server or with the same options.

$ nslookup
> server 1.1.1.1
Default server: 1.1.1.1
Address: 1.1.1.1#53
> set type=mx
> example.com
Server:		1.1.1.1
Address:	1.1.1.1#53

Non-authoritative answer:
example.com	mail exchanger = 10 mx1.example.net.
> set type=txt
> _dmarc.example.com
Server:		1.1.1.1
Address:	1.1.1.1#53

Non-authoritative answer:
_dmarc.example.com	text = "v=DMARC1; p=quarantine; rua=mailto:dmarc@example.com"
> exit

Useful interactive commands include:

• server <address>: Switch to a different DNS server for the rest of the session.
• set type=<type>: Change the record type (same as -type= on the command line).
• set debug: Show the full response, including TTLs and the authority and additional sections.
• set timeout=<seconds>: Change how long nslookup waits for a reply.
• set retry=<number>: Change how many times it retries.
• set norecurse: Ask the server not to perform recursion, which is useful when checking whether a server has an answer itself.
• set all: Show the current settings.
• exit: Leave interactive mode. On Windows you can also press Ctrl+C.

Every set option can also be used on the command line with a leading dash, for example nslookup -debug example.com or nslookup -timeout=10 example.com.

Seeing TTLs and More Detail with Debug Mode

Plain nslookup output hides the TTL, which is often exactly what you want to know when waiting for a change. Debug mode shows it:

nslookup -debug example.com 1.1.1.1

On Linux or macOS, the relevant part of the output looks like this:

------------
    QUESTIONS:
	example.com, type = A, class = IN
    ANSWERS:
    ->  example.com
	internet address = 192.0.2.10
	ttl = 1742
    AUTHORITY RECORDS:
    ADDITIONAL RECORDS:
------------

The ttl value from a resolver is the remaining cache time in seconds. If you query the same resolver again a minute later, it will be about 60 seconds lower. When it reaches zero, the resolver fetches a fresh copy from the authoritative servers.

Windows supports -debug as well, and also -d2, which prints even more low-level detail.

Windows vs macOS and Linux: Key Differences

The Windows nslookup is Microsoft's own implementation, while macOS and Linux use the version from BIND. They accept mostly the same commands, but a few differences catch people out.

DNS Suffixes on Windows

Windows appends your connection's DNS search suffixes to names without a trailing dot. If your PC is joined to a domain such as corp.example.com, a lookup for intranet becomes intranet.corp.example.com. Sometimes it will also try example.com.corp.example.com before the name you meant, which can produce confusing results.

To stop this, add a trailing dot to make the name fully qualified:

nslookup example.com.

Zone Listing

Windows nslookup has an ls command in interactive mode that attempts a zone transfer (ls -d example.com). It only works if the server allows transfers to your IP address, which public servers almost never do. The BIND version no longer supports ls. Use dig axfr instead when you genuinely need a transfer from a server you manage.

macOS and the System Resolver

On macOS, nslookup reads its DNS servers from /etc/resolv.conf and sends queries directly. Your browser and other apps, however, use the system resolver (mDNSResponder), which also honours VPN split-DNS rules, per-domain resolvers in /etc/resolver/, and .local multicast names.

That means nslookup on a Mac can give a different answer from Safari or Chrome, particularly on a VPN. To see what the system resolver returns, use:

dscacheutil -q host -a name example.com

name: example.com
ipv6_address: 2001:db8::10

name: example.com
ip_address: 192.0.2.10

To see which resolvers macOS is actually using for each domain, run scutil --dns.

Hosts Files Are Ignored

On every platform, nslookup talks to DNS servers directly and doesn't read the hosts file (C:\Windows\System32\drivers\etc\hosts or /etc/hosts). If you've added an override there, your browser will use it but nslookup won't show it. On Windows, ping or PowerShell's Resolve-DnsName go through the normal resolver path and do respect the hosts file.

nslookup vs Resolve-DnsName on Windows

On modern Windows, PowerShell's Resolve-DnsName is often a better choice. It uses the Windows DNS client, returns objects you can filter, and shows TTLs by default:

Resolve-DnsName -Name example.com -Type MX -Server 1.1.1.1

Name                           Type   TTL   Section    NameExchange              Preference
----                           ----   ---   -------    ------------              ----------
example.com                    MX     3600  Answer     mx1.example.net           10
example.com                    MX     3600  Answer     mx2.example.net           20

Some useful switches:

• -DnsOnly: Use DNS only, skipping LLMNR, NetBIOS and the hosts file.
• -NoHostsFile: Ignore the hosts file but otherwise use the normal resolver.
• -TcpOnly: Send the query over TCP.
• -DnssecOk: Request DNSSEC records in the response.

Because it returns objects, you can also script it easily:

"example.com", "example.net" | ForEach-Object {
    Resolve-DnsName -Name $_ -Type A -Server 8.8.8.8 |
        Where-Object Section -eq "Answer" |
        Select-Object Name, IPAddress, TTL
}

Reading nslookup Errors

When a lookup fails, the error message tells you what kind of failure it was.

Message	Meaning	What to check
NXDOMAIN / Non-existent domain	The name doesn't exist in DNS	Spelling, whether the domain is registered and not expired, whether the record was created
SERVFAIL / Server failed	The resolver couldn't get a valid answer	Broken DNSSEC, unreachable or misconfigured authoritative servers
REFUSED / Query refused	The server won't answer you	You asked a server that isn't authoritative and doesn't offer recursion to you
No answer / No ... records available	The name exists but has no record of that type	Try another type, or create the record
connection timed out; no servers could be reached / DNS request timed out	No reply from the DNS server	Network connectivity, firewall blocking port 53, wrong server address

Here's what an NXDOMAIN looks like on Linux:

$ nslookup nosuch.example.com
Server:		127.0.0.53
Address:	127.0.0.53#53

** server can't find nosuch.example.com: NXDOMAIN

And on Windows:

*** UnKnown can't find nosuch.example.com: Non-existent domain

A "no answer" result is subtly different and often misread. It means the domain exists but has no record of the type you asked for:

$ nslookup -type=aaaa example.org
Server:		127.0.0.53
Address:	127.0.0.53#53

Non-authoritative answer:
*** Can't find example.org: No answer

In that case, the domain simply has no IPv6 address. It's not an error with DNS itself.

Practical Examples

Check Whether a DNS Change Has Gone Live

Ask one of the domain's authoritative nameservers and a public resolver, then compare:

nslookup -type=ns example.com
nslookup www.example.com ns1.example.net
nslookup www.example.com 8.8.8.8

If the first answer shows the new value and the second shows the old one, the change is saved but still cached at Google. Use -debug to see how long is left on the TTL.

Confirm Your Email DNS Is Set Up

nslookup -type=mx example.com
nslookup -type=txt example.com
nslookup -type=txt _dmarc.example.com

That covers MX, SPF and DMARC in three commands.

Test Over TCP

Large responses, such as long TXT records or DNSSEC data, sometimes fail over UDP on networks with broken firewalls. On Linux and macOS, -vc forces TCP:

nslookup -vc -type=txt example.com 1.1.1.1

If TCP works when UDP doesn't, something on the path is dropping large UDP packets.

---

FAQ: nslookup

---

Conclusion

nslookup is the quickest way to ask a DNS server a question from almost any computer. Type the domain to see its addresses, add -type= for MX, TXT, NS or other records, and put a server's address at the end to compare what different resolvers return. Debug mode fills in the details plain output leaves out, such as TTLs.

Keep its limits in mind: it ignores the hosts file, it may bypass macOS's system resolver, and on Windows it appends DNS suffixes unless you add a trailing dot. With those quirks understood, nslookup is a reliable first check whenever a site, an email setup or a DNS change isn't behaving as you expect.