Updated 10 hours ago
Every time you type a URL, your computer asks a question: "What's the IP address for this name?" A DNS server answers. This conversation happens invisibly, thousands of times a day.
Nslookup lets you ask those questions yourself—and hear the answers directly.
The Simplest Question
Output:
You asked "what IP address is example.com?" and got an answer. But there's more information here:
Server: Who answered your question (your router or ISP's DNS server)
Non-authoritative answer: The server is being honest—"I heard this from someone else, don't blame me if it's wrong." It's returning cached information, not the official source.
Address: The IP address. This is what your browser actually connects to.
Asking a Different Server
Your default DNS server might have old information. Ask someone else:
Now you're asking Google's public DNS instead of your local one. If your DNS says one thing and Google says another, your DNS has stale cache—or your ISP is doing something suspicious.
Comparing answers from multiple servers reveals whether a DNS problem is local to you or affecting everyone.
Asking Different Questions
DNS stores more than just IP addresses. You can ask for specific record types:
Where should email go?
Lower numbers = higher priority. Email tries mail1 first, mail2 as backup.
Who's the authority here?
Shows which nameservers are the official source for this domain.
What's the IPv6 address?
What verification records exist?
TXT records often contain domain verification, SPF email policies, or other machine-readable data.
Is this name an alias?
www.example.com doesn't have its own IP—it's an alias pointing to example.com, which then resolves to the actual address.
Getting the Authoritative Answer
Want to skip the middlemen and ask the official source?
First, find out who's authoritative:
Then ask them directly:
Now you're getting the answer straight from the source—no caching, no "I heard from someone else." This matters when you've just changed DNS records and want to verify they're correct before cache propagation.
Interactive Mode
For multiple questions, enter interactive mode:
You can change query types, switch DNS servers, and run multiple lookups without retyping the command.
Reading Error Messages
| Error | Meaning |
|---|---|
| NXDOMAIN | Domain doesn't exist. Misspelled, unregistered, or DNS not configured. |
| SERVFAIL | DNS server choked trying to resolve this. Usually a problem on their end. |
| REFUSED | DNS server won't answer you. May only accept queries from specific IPs. |
| Timeout | Can't reach any DNS server. Check your network connection. |
| No answer | Domain exists but doesn't have the record type you asked for. |
Troubleshooting Patterns
Website won't load:
If you get an IP, DNS is working—the problem is elsewhere (server down, firewall, routing). No answer or wrong IP means DNS is the culprit.
Did my DNS change propagate?
The authoritative server shows new records immediately. Public DNS servers catch up as their caches expire.
Email isn't being delivered:
No MX records = no email delivery to that domain.
What domain owns this IP?
Reverse DNS lookup—useful for identifying unfamiliar IPs in logs.
Why Not dig?
Nslookup is considered deprecated by DNS purists. dig provides more detail, better formatting, DNSSEC validation, and consistent cross-platform behavior.
But nslookup is everywhere. It's on every Windows machine. It answers the question you're actually asking. For "what IP is this domain?" or "does this MX record exist?", nslookup is fast and sufficient.
Use dig when you need TTL values, timing information, or you're debugging complex DNS chains. Use nslookup when you just need a quick answer.
Frequently Asked Questions About nslookup
Was this page helpful?