Linux online course

nslookup Command in Linux: DNS Lookups and Record Queries

Learn how to use nslookup in Linux for forward and reverse DNS lookups, MX, NS, SOA, and ANY queries, interactive sessions, troubleshooting, and resolver comparisons.

nslookup means “name server lookup.” It is a command-line utility for querying the Domain Name System (DNS). You can use it to resolve hostnames to IP addresses, find reverse-DNS names, inspect mail servers, identify authoritative name servers, and examine zone authority information.

This guide assumes basic terminal usage and familiarity with hostnames, domains, and IP addresses. For general Linux command-line background, see Linux and Bourne Again Shell Bash.

What nslookup Does

DNS is a distributed naming system. It stores typed data called resource records, such as an address record for a web server or an MX record for a domain's mail servers. A DNS query asks a DNS server for one of these records.

When you run nslookup, it normally sends the query to the DNS resolver configured for your Linux system. A resolver receives queries, obtains answers from authoritative DNS servers when needed, and may return cached results.

An authoritative name server is responsible for the DNS data of a particular zone. A response obtained from a cache or recursive resolver is usually labeled Non-authoritative answer. A response supplied directly by a server authoritative for the queried zone is an authoritative answer.

• Forward lookup: maps a hostname or domain name to an IP address.
• Reverse lookup: maps an IP address to a hostname through a PTR record.
• Record query: requests a specific type of DNS data, such as MX, NS, or SOA.

nslookup is useful for quick checks and for environments where it is installed or specifically required. On many Linux systems, it is considered deprecated or discouraged for detailed DNS diagnostics. The dig and host commands are generally preferred alternatives because they expose more protocol details and provide more consistent diagnostic controls.

DNS Concepts Behind nslookup Output

Names, addresses, and servers

A domain name is a human-readable name such as example.com. A hostname is a name for a particular host, such as www.example.com. An IPv4 address identifies a device or service using 32 bits, while an IPv6 address uses 128 bits.

DNS connects these names and addresses through resource records. Your computer normally asks a configured resolver rather than contacting an authoritative server directly. The resolver may already have a cached answer or may query the authoritative servers for the domain.

Resource records

A resource record is a typed DNS data entry. Different query types return different information:

Starting nslookup

Confirm that the command is available:

nslookup

Running it without a name starts interactive mode. The prompt is commonly shown as >. Enter a hostname or IP address, then press Enter. End the session with exit or by pressing Ctrl-D on systems that support it.

$ nslookup
> example.com
> 198.51.100.25
> exit

The exact output depends on the nslookup implementation, the configured resolver, and the records published by the queried domain.

Interactive and Non-Interactive Modes

Interactive Mode

Changing the record type

Use set type= at the interactive prompt to choose the resource-record type. For example, this session looks up a domain, then asks for its mail exchangers and authoritative name servers:

$ nslookup
> set type=MX
> example.com
> set type=NS
> example.com
> set type=SOA
> example.com
> exit

Interactive mode is convenient when investigating one domain repeatedly. You set the type once and can submit several names without rewriting the complete command. Remember that the selected type remains in effect until you change it.

Interactive query examples

• Enter example.com with the default settings for an address lookup.
• Enter 198.51.100.25 to request a reverse lookup.
• Enter set type=MX, then enter example.com to inspect mail exchangers.
• Enter set type=NS, then enter example.com to list name servers.

Non-Interactive Mode

Supplying a hostname or IP address directly performs one query and prints its result. This form is easy to save in shell history, paste into incident notes, or use in a script.

nslookup example.com
nslookup 198.51.100.25

The general form is:

nslookup [option] <name-or-address> [dns-server]

Use the -query option to select a record type:

nslookup -query=mx example.com
nslookup -query=ns example.com
nslookup -query=soa example.com

Record-type names are commonly accepted in either uppercase or lowercase, but using conventional uppercase names such as MX and SOA makes commands easier to read.

Forward DNS Lookups

A forward lookup asks DNS to resolve a hostname to an address. A basic query may return one or more IPv4 addresses:

$ nslookup example.com

An address result usually represents an A record. A hostname can have multiple A records for redundancy, load distribution, or geographic service placement. To request IPv6 addresses specifically, query AAAA records:

nslookup -query=AAAA example.com

A domain can have A records, AAAA records, both, or neither. Therefore, an empty IPv4 result does not necessarily mean that the name has no IPv6 address.

Reverse DNS Lookups

A reverse lookup asks for the PTR record associated with an IP address:

nslookup 198.51.100.25

For IPv4, DNS represents the address in the reverse in-addr.arpa namespace. For IPv6, it uses the ip6.arpa namespace. nslookup normally constructs the reverse query when you provide an address.

Reverse DNS is independently configured from forward DNS. The address owner may publish no PTR record, or the PTR name may describe an infrastructure host rather than a website. A missing reverse result is therefore not necessarily a connectivity failure and does not prove that the service is unavailable.

Querying Major DNS Record Types

MX records: mail exchangers

An MX record identifies mail servers that receive email for a domain. Each MX result includes a preference value. Lower values have higher preference, so a sending mail system normally tries the lowest-preference server first.

nslookup -query=mx example.com

MX records contain hostnames, not normally IP addresses. The sending system must perform additional A or AAAA lookups for those mail-server names.

NS records: authoritative name servers

An NS record names the authoritative DNS servers for a zone:

nslookup -query=ns example.com

These names identify where authoritative data can be obtained. They do not necessarily identify the resolver your Linux machine used for the query.

SOA records: zone authority

A Start of Authority (SOA) record describes administrative and timing information for a DNS zone:

nslookup -query=soa example.com

Common SOA fields include:

• Primary name server: the server designated as the zone's primary source.
• Responsible party: an email-like contact representation for the zone administrator.
• Serial number: a version number used when comparing zone data.
• Refresh: how often secondary servers should check for changes.
• Retry: how long a secondary server waits before retrying a failed refresh.
• Expire: how long secondary data may remain usable when the primary cannot be reached.
• Minimum or negative-cache value: a value related to caching negative answers, depending on server interpretation and DNS software.

ANY queries

An ANY query requests available data for a name:

nslookup -query=any example.com

Do not treat ANY as a reliable way to list every record. Modern DNS servers may restrict, minimize, or refuse ANY responses to reduce abuse and response amplification. Query the required types individually instead, such as A, AAAA, MX, NS, SOA, or TXT.

Selecting a DNS Server

To send a query to a particular DNS server, place that server after the name or address:

nslookup example.com 1.1.1.1
nslookup -query=mx example.com 8.8.8.8

This is useful when comparing a local resolver with a public resolver or with a DNS server responsible for a zone. It can reveal caching differences, split-horizon DNS, internal-only records, or propagation delays.

The server and Address lines in nslookup output describe the resolver used by default for that invocation. When you explicitly provide a DNS server, those lines should identify the selected server instead. The server shown is the query target; it is not automatically the authoritative server for the domain.

Reading nslookup Output

A basic response often resembles this structure, although labels and formatting vary:

Server:         resolver.example.net
Address:        192.0.2.53

Non-authoritative answer:
Name:           example.com
Addresses:      192.0.2.10
                2001:db8::10

• Server: the DNS resolver that received the query.
• Address: the resolver's IP address, sometimes with a port indicator in certain implementations.
• Non-authoritative answer: the response came from a recursive resolver or cache rather than directly from the zone's authoritative source.
• Name: the queried name or a returned record name.
• Address or Addresses: one or more A or AAAA values.
• Aliases: alternate names, commonly shown when a CNAME relationship is involved.
• MX preference: the priority number associated with each mail exchanger.
• NS hostnames: the names of authoritative name servers.
• SOA fields: the primary server, responsible party, serial, and timing values.

Output formatting varies between nslookup implementations and DNS servers. Read the record type and values rather than relying on exact spacing or line order.

Common nslookup Commands

Troubleshooting nslookup

nslookup: command not found

The DNS utilities package may not be installed, or the executable may not be in your PATH. Install the distribution package that provides nslookup. Package names commonly follow a dnsutils-style convention on Debian-based systems or a bind-utils-style convention on Red Hat-based systems. Confirm the package name for your distribution before installing it.

NXDOMAIN

An error such as Server can't find hostname: NXDOMAIN means the queried DNS server reports that the name does not exist. Check for spelling errors, query another resolver, and confirm that the expected zone and record have actually been published. NXDOMAIN is different from a successful lookup that simply has no record of the requested type.

Timeouts or no servers reached

A timeout can indicate an unreachable configured resolver, blocked DNS traffic, routing problems, or incorrect resolver configuration. Check network connectivity, inspect the system's configured name servers, and test with a known reachable DNS server when policy permits.

No reverse name for an IP address

No returned hostname usually means that no PTR record is configured, the address owner has not published reverse DNS, or the resolver cannot obtain the reverse-zone response. Forward DNS records do not automatically create PTR records. The organization controlling the address range generally controls its reverse DNS.

Incomplete ANY response

A DNS server may return only a minimal ANY response or refuse it entirely. Query individual types instead:

nslookup -query=A example.com
nslookup -query=AAAA example.com
nslookup -query=MX example.com
nslookup -query=NS example.com
nslookup -query=SOA example.com

Different servers return different answers

Differences can result from cache and TTL timing, split-horizon DNS, internal-only records, propagation after an update, or resolver policy. Repeat the query with explicit server arguments and determine whether the local network uses an internal DNS view.

Exam- and Troubleshooting-Relevant Notes

• A lookup from a hostname to an IP address is a forward lookup; an IP address to a hostname is a reverse lookup.
• A records contain IPv4 addresses; AAAA records contain IPv6 addresses; PTR records support reverse DNS.
• MX preference values are ordered, with lower values generally preferred.
• NS records name authoritative servers, while the resolver shown at the top of output is the server that answered your query.
• Non-authoritative does not mean incorrect. It commonly means the answer came from a recursive resolver or cache.
• A missing PTR record does not by itself indicate a network or service failure.
• ANY is not a dependable record inventory command. Use type-specific queries.
• For detailed DNS diagnostics, prefer dig or host when they are available.