What the NSLOOKUP Tool Can Tell You About Internet Domains

The nslookup (which stands for name server lookup) command finds name server information for domains by querying the Domain Name System.

How to Use nslookup in Windows

To use the Windows version of nslookup, open Command Prompt and type nslookup to get a result similar to this one but with entries for the DNS server and IP address that your computer is using:

C:\> nslookup
Server: resolver1.opendns.com
Address: 208.67.222.222
>

This command identifies which DNS server the computer is currently configured to use for its DNS lookups. As the example shows, this computer is using an OpenDNS DNS server.

Take note of the prompt at the bottom of the command's output. nslookup remains running in the foreground after the command executes. The prompt at the end of the output lets you enter additional parameters. When you execute nslookup without specifying a domain name, the program enters interactive mode.

Either type the domain name you want the nslookup details for or quit nslookup with the exit command (or the Ctrl+C keyboard shortcut). You could instead use nslookup by typing the command before the domain, all on the same line:

nslookup lifewire.com.

Here's an example output:

> nslookup lifewire.com
Non-authoritative answer:
Name: lifewire.com
Addresses: 151.101.193.121
 151.101.65.121
 151.101.1.121
 151.101.129.121

Nameserver Lookup

In DNS, so-called "non-authoritative answers" refer to DNS records kept on external DNS servers, which they obtained from the "authoritative" servers that provide the original source of the data.

Here's how to get that information (assuming you've already typed nslookup into Command Prompt):

>set type=ns
>lifewire.com
[...]
dns1.p08.nsone.net internet address = 198.51.44.8
dns2.p08.nsone.net internet address = 198.51.45.8
dns3.p08.nsone.net internet address = 198.51.44.72
dns4.p08.nsone.net internet address = 198.51.45.72
ns1.p30.dynect.net internet address = 208.78.70.30
ns2.p30.dynect.net internet address = 204.13.250.30
ns3.p30.dynect.net internet address = 208.78.71.30
ns4.p30.dynect.net internet address = 204.13.251.30
>

An authoritative address lookup can be performed by specifying one of the domain's registered nameservers. Nslookup then uses that server instead of the default DNS server information of the local system.

C:\>nslookup lifewire.com ns1.p30.dynect.net
Server: ns1.p30.dynect.net
Address: 208.78.70.30
Name: lifewire.com
Addresses: 151.101.65.121
 151.101.193.121
 151.101.129.121
 151.101.1.121

The output no longer mentions "non-authoritative" data because the nameserver ns1.p30.dynect is a primary nameserver for Lifewire.com, as listed in the "NS record" portion of its DNS entries.

Mail Server Lookup

To search for mail server information on a particular domain, nslookup uses the MX record feature of DNS. Some sites, like Lifewire.com, support both primary and backup servers.

Mail server queries for Lifewire.com work like this:

> set type=mx
> lifewire.com
[...]
Non-authoritative answer:
lifewire.com MX preference = 20, mail exchanger = ALT1.ASPMX.L.GOOGLE.com
lifewire.com MX preference = 10, mail exchanger = ASPMX.L.GOOGLE.com
lifewire.com MX preference = 50, mail exchanger = ALT4.ASPMX.L.GOOGLE.com
lifewire.com MX preference = 40, mail exchanger = ALT3.ASPMX.L.GOOGLE.com
lifewire.com MX preference = 30, mail exchanger = ALT2.ASPMX.L.GOOGLE.com

Other nslookup Queries

Nslookup supports querying against other less commonly used DNS records including CNAME, PTR, and SOA. Typing a question mark at the prompt prints the program's help instructions.

Some web-based variations of the utility offer a few additional features beyond the standard parameters found within the Windows tool.

How to Use Online Nslookup Tools

Online nslookup utilities, like the one from Network-Tools.com, lets you customize a lot more than what's allowed with the command from Windows.

For example, after choosing the domain, server, and port, you can pick from a drop-down list of query types like address, nameserver, canonical name, start of authority, mailbox domain, mail group member, well-known services, mail exchange, ISDN address, NSAP address, and many others.