nslookup — DNS Queries from the Command Line

nslookup is a cross-platform DNS query tool that ships with Windows, macOS and Linux – no extra installation needed. A single command resolves domain names, checks mail records or traces nameserver delegations. On Unix systems dig offers more power and better scriptability; nslookup wins on availability, especially in Windows environments or when you need a quick ad-hoc check on an unfamiliar server.

Non-Interactive Queries

nslookup DOMAIN — Look up the A record of a domain using the default DNS server.

nslookup example.com

nslookup DOMAIN SERVER — Look up a domain using a specific DNS server.

nslookup example.com 8.8.8.8

nslookup IP — Reverse DNS lookup — find the hostname for an IP.

nslookup 8.8.8.8

nslookup -type=TYPE DOMAIN — Query a specific record type.

nslookup -type=MX example.com

nslookup -query=TYPE DOMAIN — Alternative syntax for record type queries.

nslookup -query=TXT example.com

Record Type Queries

nslookup -type=A DOMAIN — Query IPv4 address records.

nslookup -type=A example.com

nslookup -type=AAAA DOMAIN — Query IPv6 address records.

nslookup -type=AAAA example.com

nslookup -type=MX DOMAIN — Query mail exchange records.

nslookup -type=MX example.com

nslookup -type=NS DOMAIN — Query nameserver records.

nslookup -type=NS example.com

nslookup -type=TXT DOMAIN — Query text records (SPF, DKIM, DMARC).

nslookup -type=TXT example.com

nslookup -type=SOA DOMAIN — Query Start of Authority record.

nslookup -type=SOA example.com

nslookup -type=CNAME DOMAIN — Query canonical name (alias) records.

nslookup -type=CNAME www.example.com

nslookup -type=SRV SERVICE DOMAIN — Query service records.

nslookup -type=SRV _sip._tcp.example.com

nslookup -type=PTR IP.in-addr.arpa — Explicit PTR record lookup for reverse DNS — write the octets in reverse order.

nslookup -type=PTR 8.8.8.8.in-addr.arpa

nslookup -type=ANY DOMAIN — Query all record types. Many servers restrict this.

nslookup -type=ANY example.com

Options

nslookup -debug DOMAIN — Show detailed query and response information.

nslookup -debug example.com

nslookup -timeout=SECONDS DOMAIN — Set the query timeout.

nslookup -timeout=10 example.com

nslookup -retry=N DOMAIN — Set the number of retries.

nslookup -retry=3 example.com

nslookup -port=PORT DOMAIN SERVER — Use a non-standard DNS port.

nslookup -port=5353 example.com 127.0.0.1

Interactive Mode

nslookup — Enter interactive mode. Type domain names to look them up.

nslookup
> example.com
> google.com

> server SERVER — In interactive mode: switch to a different DNS server.

> server 8.8.8.8

> set type=TYPE — In interactive mode: set the default query type.

> set type=MX

> set debug — In interactive mode: enable debug output.

> set debug

> set nodebug — In interactive mode: disable debug output.

> set nodebug

> set all — In interactive mode: show current settings.

> set all

> exit — In interactive mode: exit nslookup.

> exit

Common Patterns

nslookup -type=TXT _dmarc.DOMAIN — Check DMARC policy for a domain.

nslookup -type=TXT _dmarc.example.com

nslookup -type=TXT DOMAIN | grep 'v=spf' — Check SPF record for a domain.

nslookup -type=TXT example.com | grep 'v=spf'

nslookup DOMAIN 8.8.8.8 — Quick check using Google's public DNS.

nslookup example.com 8.8.8.8

nslookup DOMAIN 1.1.1.1 — Quick check using Cloudflare's public DNS.

nslookup example.com 1.1.1.1

Conclusion

nslookup handles DNS queries quickly on any operating system, with no setup required. For regular DNS debugging on Unix, dig or host are more capable; nslookup remains the universal fallback that works everywhere. A quick MX check or reverse lookup is done in seconds.