nslookup

Legacy DNS lookup tool. Available on every platform without installation. Interactive mode for rapid iteration.

Why nslookup Still Matters

dig is superior for DNS debugging. But nslookup is pre-installed on Windows, available in PowerShell sessions, and the tool most network engineers reach for first. Knowing it means you can troubleshoot from any machine without installing anything.

Basic Queries

Simple A record lookup
nslookup example.com

Returns the server used for resolution and the answer. Unlike dig, nslookup shows both "Non-authoritative answer" and "Authoritative answer" labels.

Query a specific DNS server
nslookup inside.domusdigitalis.dev 10.50.1.50

Bypasses the system resolver. Directly tests whether the target server has the record.

Reverse lookup — IP to hostname
nslookup 10.50.1.20

nslookup automatically detects IP input and performs a PTR query. No -x flag needed (unlike dig).

Record Type Queries

MX records — mail server lookup
nslookup -type=MX example.com
TXT records — SPF, DKIM, DMARC
nslookup -type=TXT example.com
NS records — authoritative nameservers
nslookup -type=NS example.com
SOA record — zone authority
nslookup -type=SOA inside.domusdigitalis.dev
SRV records — AD service discovery
nslookup -type=SRV _ldap._tcp.dc._msdcs.inside.domusdigitalis.dev

The Windows domain join process uses exactly this query to find domain controllers.

ANY — all available record types
nslookup -type=ANY example.com

Some servers refuse ANY queries (RFC 8482).

Interactive Mode

Enter interactive mode — multiple queries, one session
nslookup
> server 8.8.8.8
> set type=MX
> example.com
> set type=A
> example.com
> exit

Interactive mode is useful for rapid multi-query debugging without retyping the server each time.

Set debug mode — verbose query/response details
nslookup
> set debug
> example.com

Shows the raw DNS message including header flags, question section, and all response sections. Closest nslookup gets to dig’s full output.

Windows PowerShell Equivalent

Resolve-DnsName — PowerShell’s modern replacement
Resolve-DnsName -Name example.com -Type A
Resolve-DnsName -Name example.com -Type MX -Server 8.8.8.8
Resolve-DnsName -Name 10.50.1.20 -Type PTR

PowerShell’s Resolve-DnsName returns structured objects — pipe to Select-Object, Where-Object, and Format-Table. Strictly superior to nslookup for scripting on Windows.

nslookup vs dig — When to Use Which

  • nslookup: Available everywhere. Quick check from a Windows workstation or a minimal server with no dig installed. Interactive mode for rapid iteration.

  • dig: Precise control over output format (+short, +noall +answer). DNSSEC inspection (+dnssec). Trace delegation (+trace). Scriptable with clean machine-parseable output. Always prefer dig when available.

See Also