How to use the nslookup command

Make one explicit query

On Windows, open a terminal and use the built-in nslookup command. On Linux, availability depends on the distribution; it is commonly included in DNS utility packages. Follow your distribution’s normal package guidance rather than running an unfamiliar installer.

A name-only lookup commonly asks for address information using the system’s configured resolver. A public web lookup may use a different recursive resolver, so differing results are not automatically a bug.

nslookup example.com
nslookup example.com 8.8.8.8

Choose the record type

Use the type option to request mail exchanges, text, nameservers or IPv6 addresses. The owner name matters: _dmarc.example.com is a different question from example.com.

Do not rely on ANY as a complete inventory. Recursive servers can provide minimal ANY responses or refuse them. Ask for the individual types you need, and keep their statuses separate.

nslookup -type=MX example.com
nslookup -type=TXT _dmarc.example.com
nslookup -type=AAAA example.com
nslookup -type=NS example.com

Run a reverse lookup

An IP input asks for its PTR mapping. IPv4 uses a reversed-octet owner below in-addr.arpa; IPv6 uses reversed hexadecimal nibbles below ip6.arpa. The returned hostname is not a list of every website served by the IP.

A missing PTR does not prove a host is offline. Reverse and forward records can be managed by different parties and do not update each other automatically.

nslookup 1.1.1.1
nslookup -type=PTR 1.1.1.1.in-addr.arpa

Use interactive mode deliberately

Start nslookup without a name to enter its prompt. You can change the type and the resolver for the next query. Exit the prompt when done; these commands query DNS rather than modifying records.

A non-authoritative answer normally means a recursive resolver supplied the response, possibly from cache. It is not an automatic warning that the data is untrustworthy.

nslookup
> server 1.1.1.1
> set type=TXT
> example.com
> exit

Keep DNS and transport errors separate

NXDOMAIN means the queried name was reported absent; NOERROR with no requested data means something different. SERVFAIL can involve validation, upstream failures or other conditions. A timeout means the request did not complete.

When comparing a command and this website, match the name, type, resolver and query time. This website uses HTTPS; your terminal may use UDP or TCP. The measured durations are not directly comparable.

Record what you actually observed

Keep the owner name, type, answer, TTL, resolver and time together. Copying only an IP address can hide that it came from a different hostname or an older cached response.

For a production issue, retain a known-good configuration and use the provider’s authoritative tools where appropriate. Neither a web lookup nor nslookup changes DNS records for you.