What does nslookup do

Content on WhatAnswers is provided "as is" for informational purposes. While we strive for accuracy, we make no guarantees. Content is AI-assisted and should not be used as professional advice.

Last updated: April 4, 2026

Quick Answer: The `nslookup` command is a network administration command-line tool used to query the Domain Name System (DNS) to obtain domain name or IP address mapping, or other DNS records associated with a given host. It's essentially a way to ask DNS servers for information about internet names and addresses.

Key Facts

It translates human-readable domain names (like google.com) into machine-readable IP addresses (like 172.217.160.142).
It can also perform the reverse lookup, translating an IP address back into a domain name.
It allows users to query specific DNS record types, such as MX (Mail Exchanger) records for email servers or NS (Name Server) records.
It can be used to test the functionality of DNS servers and troubleshoot network connectivity issues.
The command is available on most Windows, macOS, and Linux operating systems.

What is nslookup?

The `nslookup` command, short for 'name server lookup', is a powerful diagnostic tool for network administrators and IT professionals. It is used to query the Domain Name System (DNS) to obtain information about domain names and IP addresses. In essence, it's your command-line interface to the internet's phonebook, allowing you to ask questions about how domain names are resolved to specific IP addresses and vice-versa.

How does nslookup work?

When you type a website address into your browser, your computer needs to know the corresponding IP address of the server hosting that website. This is where DNS comes in. Your computer sends a query to a DNS server, asking for the IP address associated with the domain name. `nslookup` automates this process and displays the results. It sends a query to a configured DNS server (usually provided by your Internet Service Provider or set manually) and waits for a response. The response typically includes the IP address of the requested domain, as well as information about the DNS server that provided the answer.

Common Uses of nslookup

nslookup is a versatile tool with several practical applications:

Domain Name to IP Address Resolution: This is the most common use. Typing `nslookup google.com` will return the IP addresses associated with Google's servers. This helps verify that a domain name is correctly pointing to its intended server.
IP Address to Domain Name Resolution (Reverse Lookup): You can also use `nslookup` to perform a reverse lookup. By entering an IP address, you can sometimes find the domain name associated with it. This is useful for identifying the owner of an IP address or for security investigations.
Checking DNS Server Functionality: If you suspect your DNS server is not working correctly, `nslookup` can help diagnose the issue. You can query different DNS servers to see which ones are responding and which are not.
Troubleshooting Network Connectivity: When you can't access a website, `nslookup` can be one of the first tools to use. If `nslookup` fails to resolve the domain name, it indicates a potential DNS issue or a problem with the domain itself, rather than a general internet outage.
Querying Specific DNS Records: Beyond basic A records (which map names to IPv4 addresses), `nslookup` can query for other types of DNS records. For example:
- set type=mx followed by a domain name will show Mail Exchanger (MX) records, indicating the mail servers responsible for receiving email for that domain.
- set type=ns will display the Name Server (NS) records, showing which servers are authoritative for the domain's DNS information.
- set type=soa will reveal the Start of Authority (SOA) record, which contains administrative information about the zone, including the primary name server and contact information.
- set type=ptr is used for reverse lookups (mapping IP to name).
Identifying DNS Propagation: When DNS records are changed, it takes time for these changes to propagate across the global DNS system. `nslookup` can be used to check if the updated records are visible from different DNS servers.

How to Use nslookup

The basic syntax for `nslookup` is simple:

nslookup [hostname] [dns_server]

hostname: The domain name or IP address you want to query.
dns_server (optional): The IP address or hostname of the DNS server you want to query. If omitted, `nslookup` uses the default DNS server configured on your system.

Examples:

To find the IP address of `example.com` using your default DNS server:
```
nslookup example.com
```
To find the IP address of `example.com` using Google's public DNS server (8.8.8.8):
```
nslookup example.com 8.8.8.8
```
To find the Mail Exchanger records for `gmail.com`:
```
nslookup -query=mx gmail.com
```
or
```
set type=mxgmail.com
```

When you run `nslookup`, you'll typically see the name of the DNS server that responded, followed by the requested information (e.g., the IP address for a hostname).

nslookup vs. Dig

While `nslookup` is widely available and easy to use, another powerful DNS lookup tool called `dig` (Domain Information Groper) is often preferred by advanced users, particularly on Linux and macOS systems. `dig` provides more detailed output and greater flexibility in crafting queries. However, for basic lookups and troubleshooting, `nslookup` remains a valuable and accessible tool.

Conclusion

The `nslookup` command is an indispensable utility for anyone needing to understand or troubleshoot how domain names and IP addresses are resolved on the internet. By allowing users to query DNS servers directly, it provides critical insights into network configurations and helps diagnose a wide range of connectivity issues.