VMware ESXi and vSphere Cluster Management

How to Use the nslookup Command for DNS Lookups in Linux

Learn how to use nslookup in Linux for forward and reverse DNS lookups, MX, NS, SOA, TXT, CNAME, and other DNS records.

nslookup is a command-line utility for querying DNS servers. DNS, the Domain Name System, maps names such as www.example.com to information such as IP addresses, mail servers, and nameservers.

This guide covers interactive and non-interactive lookups, common DNS record types, resolver selection, output interpretation, troubleshooting, and safer alternatives such as dig and host.

What nslookup Does

A DNS lookup asks a DNS server for records associated with a hostname, domain, or IP address. A forward lookup maps a name to an address or another DNS record. A reverse lookup maps an IP address to a hostname through a PTR record.

nslookup www.example.com
nslookup 8.8.8.8

The first command performs a forward lookup. The second asks whether the owner of 8.8.8.8 has published a reverse DNS name. Results depend on the DNS server queried, its cache and policy, and the records published for the target.

Common DNS Record Types

A DNS record is a piece of data stored in a DNS zone, which is a managed portion of the DNS namespace.

Query type	Typical command form	What it returns	Common use case
A	`nslookup -type=a example.com`	IPv4 address	Check IPv4 resolution
AAAA	`nslookup -type=aaaa example.com`	IPv6 address	Check IPv6 resolution
PTR	`nslookup -type=ptr 8.8.8.8`	Reverse mapping from an IP to a name	Inspect reverse DNS
MX	`nslookup -type=mx example.com`	Mail servers and preference values	Diagnose mail delivery
NS	`nslookup -type=ns example.com`	Nameservers for a zone	Inspect delegation
SOA	`nslookup -type=soa example.com`	Zone authority and timing metadata	Compare zone versions and timing
CNAME	`nslookup -type=cname www.example.com`	Alias to a canonical name	Investigate DNS aliases
TXT	`nslookup -type=txt example.com`	Text strings	Check verification and email policy data
ANY	`nslookup -type=any example.com`	A server-selected set of available data	Occasional diagnostic testing

An A record contains an IPv4 address, while an AAAA record contains an IPv6 address. A domain can have multiple records of either type, so a lookup can return multiple addresses.

A CNAME is an alias pointing to another, canonical name. Output may show the canonical name before showing the final A or AAAA addresses.

MX records identify mail exchangers. Their preference values are ordered numerically: a lower value means higher delivery priority. NS records identify nameservers responsible for a DNS zone.

An SOA record includes the primary nameserver, a responsible-party field, a serial number, refresh interval, retry interval, expire interval, and a minimum value commonly associated with negative caching. The serial number is useful when checking whether authoritative servers have the same zone version.

TXT records carry text data and are commonly used for domain verification, SPF-related data, DKIM-related information, and other policies. An ANY query is not a reliable request for every record. Modern DNS servers often minimize or restrict ANY responses, so query each required type separately.

Interactive Mode

Run nslookup without a target to enter its interactive prompt.

$ nslookup
>

Enter a hostname to request address information:

> www.example.com

Enter an IP address to request a PTR-based reverse lookup:

> 8.8.8.8

Set a record type with either set type= or set q=:

> set type=mx
> example.com
> set q=ns
> example.com

Change the DNS server used for later queries with server:

> server 1.1.1.1
> www.example.com

Check the displayed server information before interpreting the answer. Leave the session with exit.

> exit

Non-Interactive Mode

Non-interactive mode is useful for one-off commands, scripts, and quick checks. The general form is:

nslookup [options] target [dns-server]

Perform a forward lookup from the shell:

nslookup www.example.com

Perform a reverse lookup:

nslookup 8.8.8.8

Request a particular record type with -type=:

nslookup -type=a example.com
nslookup -type=aaaa example.com
nslookup -type=mx example.com
nslookup -type=ns example.com
nslookup -type=soa example.com
nslookup -type=cname www.example.com
nslookup -type=txt example.com

Some implementations also support the equivalent -query= spelling:

nslookup -query=mx example.com

For a single command, place the DNS server after the target:

nslookup www.example.com 1.1.1.1

The final argument can identify a recursive resolver or, when appropriate, an authoritative nameserver.

Forward Lookup Examples

To resolve a hostname to address data, use:

nslookup www.example.com

Inspect the returned A and AAAA information. Multiple addresses are normal and may support redundancy, load distribution, geographic routing, or separate IPv4 and IPv6 access.

If the output includes an alias or canonical name, follow that name when diagnosing the final address. A CNAME does not itself contain an IP address; it points the resolver to another name whose address records can then be returned.

Reverse Lookup Examples

Use an IP address as the target:

nslookup 8.8.8.8

A successful reverse lookup displays a PTR name when one is published. Reverse DNS is optional, so an IP address can be valid and reachable even when it has no PTR record.

Reverse DNS is managed through the owner of the relevant reverse-DNS space, normally the organization controlling the IP allocation or the hosting provider. It is not usually controlled through the ordinary forward DNS zone for a domain.

Mail, Delegation, and Zone Authority Lookups

MX records

nslookup -type=mx example.com

Read each mail exchanger and its preference. Mail systems generally try lower preference values before higher ones, although delivery behavior also depends on the sender and mail server implementation.

NS records

nslookup -type=ns example.com

NS records show the nameservers listed for the domain's zone. They are a useful starting point when checking delegation or deciding which authoritative servers to query next.

SOA records

nslookup -type=soa example.com

Use the SOA result to inspect the primary nameserver, responsible-party field, serial number, refresh, retry, expire, and minimum or negative-caching-related value. Comparing serial numbers across authoritative nameservers can reveal incomplete zone updates.

Choosing Which DNS Server to Query

With no explicit server, nslookup normally uses the resolver configured for the Linux system. That resolver may be supplied by network configuration, a VPN, a local resolver service, or a resolver manager.

To compare the system resolver with a named resolver, run:

nslookup www.example.com
nslookup www.example.com 1.1.1.1

Answers can differ because of:

Split-horizon DNS: internal and external clients receive different answers.
Caching: resolvers may hold older data until its TTL, or time to live, expires.
Filtering: a resolver may block, redirect, or alter selected responses.
Propagation state: recent changes may not be visible through every cache or authoritative server.
Resolver policy: geographic, organizational, or security rules may affect the answer.

A public resolver is not a substitute for a private organizational resolver. Internal-only names may exist only inside a corporate, cloud, or VPN DNS environment.

Understanding nslookup Output

Typical output identifies the DNS server used and its address. It may then show a name, aliases, addresses, or record-specific values such as MX preferences and SOA fields.

A non-authoritative answer usually came from a recursive resolver, which obtained the data on behalf of the client and may have served it from cache. An authoritative answer came from a server publishing the official data for the zone. Non-authoritative does not mean incorrect; it describes the source of the response.

Output formatting varies between Linux distributions, operating systems, and nslookup implementations. Read the values rather than relying on exact wording or column layout.

Observed result	Likely meaning	Suggested next check
Address returned	The requested name has an address record visible to this resolver.	Check both A and AAAA if IPv4 and IPv6 behavior matters.
Non-authoritative answer	A recursive resolver returned the response, possibly from cache.	Check TTL or compare with an authoritative nameserver.
NXDOMAIN	The queried domain name does not exist from that DNS server's perspective.	Check spelling, the fully qualified name, and the intended DNS environment.
SERVFAIL	The server could not complete the query, often because of an upstream, DNSSEC, or configuration problem.	Try another resolver and inspect authoritative-server health.
Timeout	No response arrived before the client timeout.	Check connectivity, firewall rules, VPN state, and resolver availability.
No PTR result	No reverse-DNS name is published or visible.	Check with the IP address provider or hosting provider.
Different answers from different resolvers	Policy, caching, split-horizon DNS, geographic routing, or an update difference may exist.	Record the resolver used and compare authoritative responses.

Troubleshooting nslookup

Command not found

If the shell reports that nslookup is missing, the DNS utilities package may not be installed. Identify the package that provides DNS client tools for your distribution and install it with the system package manager. If available, dig or host can be used instead.

NXDOMAIN

Verify spelling and the intended fully qualified domain name. For a private name, query the organization's internal resolver rather than a public resolver. If you manage the domain, inspect the authoritative zone configuration.

Timeouts

Check configured resolvers, network connectivity, and whether UDP or TCP port 53 is blocked. For internal names, confirm that the VPN and internal firewall path are working. Test a different resolver only when doing so is appropriate for the name and your organization's policy.

Missing PTR data

A missing PTR record is a DNS configuration condition, not proof that the IP address is invalid. Contact the address provider or use its reverse-DNS control panel if you are authorized to make the change.

Inconsistent answers

Document the resolver used for every test. Compare internal and external resolvers, query authoritative nameservers when appropriate, and review TTLs and deployment timing.

Incomplete ANY results

Do not interpret an incomplete ANY response as proof that other records are absent. Query A, AAAA, MX, NS, SOA, TXT, and other required types individually.

Limitations and Modern Alternatives

nslookup remains common in tutorials, enterprise environments, and cross-platform troubleshooting, but it is a legacy-oriented utility. It may not be installed by default, and options and output can differ between implementations.

dig example.com provides detailed DNS diagnostics, explicit server selection, response flags, TTLs, and machine-friendly controls.
host example.com provides concise output for common forward and reverse queries.

Use nslookup when you need a familiar, widely available interface; choose dig when precise DNS troubleshooting or scripting control is important.

Security and Privacy Considerations

A DNS lookup discloses the queried name to the resolver handling the request. Public DNS services should not be treated as equivalent to private internal resolvers.

Avoid sending internal-only hostnames, service names, customer names, or sensitive investigation targets to external resolvers.
Use the approved organizational or VPN resolver for private infrastructure.
Record which resolver was used when collecting diagnostic evidence.
Remember that a public answer may describe public DNS and not the address visible inside a private network.

Interactive and Non-Interactive Modes

Mode	How to start it	Best use	Example	Key limitations
Interactive mode	`nslookup`	Several related queries with one server and session	`set type=mx`, then `example.com`	Easy to make state mistakes; output and commands vary by implementation
Non-interactive mode	`nslookup target`	One-off checks and simple command use	`nslookup -type=soa example.com`	Less convenient for many record types in one session

Practical Command Checklist

Start with nslookup hostname for a normal forward lookup.
Check -type=a and -type=aaaa when address-family behavior matters.
Use an IP address as the target to test reverse DNS.
Use -type=mx, -type=ns, or -type=soa for mail, delegation, and zone-authority checks.
Use -type=txt for verification and policy data.
Repeat the lookup against a named resolver when comparing DNS views.
Use dig for detailed diagnostics and host for concise output.