nslookup stands for “name server lookup” is a useful command for getting information from DNS server. It also very useful for troubleshooting DNS related issues. It queries to DNS (Domain Name Server) and get the dns records for any domain for ip address.
In this tutorial you will get some useful examples for nslookup command available on Linux servers. This command is also available on Windows systems as well.
1. Basic DNS Lookup
Use nslookup command followed by the domain name will return the Address records for a domain. For example, to view DNS record for domain tecadmin.net, type:
nslookup tecadmin.netOutput: ---------------------------------------- Server: dns.google Address: 8.8.8.8 Non-authoritative answer: Name: tecadmin.net Addresses: 172.67.134.5 104.28.16.96 104.28.17.96
2. Reverse DNS Lookup
A Reverse DNS (rDNS) lookup is when you have an IP address and want to find associated domain name. You will see any output only if a reverse zone is configured corresponding to that IP address. Generally, this is configured by the hosting provider or datacenters.
To view the reverse dns lookup for an IP address, type:
nslookup 216.58.219.206Output: -------------------------------------------------- Server: 8.8.8.8 Address: 8.8.8.8#53 Non-authoritative answer: 206.219.58.216.in-addr.arpa name = lga25s40-in-f14.1e100.net. 206.219.58.216.in-addr.arpa name = lga25s40-in-f14.1e100.net. 206.219.58.216.in-addr.arpa name = lga25s40-in-f206.1e100.net. 206.219.58.216.in-addr.arpa name = lga25s40-in-f206.1e100.net.
3. Query to Specific DNS Server
The default nslookup quires to DNS server configured on your system’s network interface. But you can specify the DNS server to which nslookup queried directly instead of local configured.
You need to pass additional parameter of name server IP address or domain name. For example to query to 9.9.9.9 name server use the following command.
nslookup tecadmin.net 9.9.9.9Output: ------------------------------------------- Server: dns9.quad9.net Address: 9.9.9.9 Non-authoritative answer: Name: tecadmin.net Addresses: 104.28.17.96 172.67.134.5 104.28.16.96
4. Find SOA Record for Domain
SOA is the abbreviation of Start of Authority. This is an useful DNS record for any domain contains administrative information about the zone.
To find the SOA record of any domain, you need to specify -type=soa as command line parameter. For example:
nslookup -type=soa google.comOutput: ------------------------------------------- Server: 8.8.8.8 Address: 8.8.8.8#53 Non-authoritative answer: google.com origin = ns4.google.com mail addr = dns-admin.google.com serial = 159912615 refresh = 900 retry = 900 expire = 1800 minimum = 60 Authoritative answers can be found from:
5. Query MX Record
You can also query for MX (Mail Exchange) records for any domain. These domain records are responsible for emails delivery.
nslookup -query=mx google.comOutput: ------------------------------------------- Server: 8.8.8.8 Address: 8.8.8.8#53 Non-authoritative answer: google.com mail exchanger = 10 aspmx.l.google.com. google.com mail exchanger = 30 alt2.aspmx.l.google.com. google.com mail exchanger = 50 alt4.aspmx.l.google.com. google.com mail exchanger = 40 alt3.aspmx.l.google.com. google.com mail exchanger = 20 alt1.aspmx.l.google.com. Authoritative answers can be found from:
6. Query TXT Records for Domain
TXT records are useful for multiple types of records like DKIM, SPF, etc. You can find all TXT records configured for any domain using below command.
nslookup -query=txt google.comOutput: ------------------------------------------- Server: 8.8.8.8 Address: 8.8.8.8#53 Non-authoritative answer: google.com text = "v=spf1 include:_spf.google.com ~all" Authoritative answers can be found from:
7. Find All Records of Domain
Use -query=any to list all records for a domain.
nslookup -query=any google.comOutput: ------------------------------------------- Server: 8.8.8.8 Address: 8.8.8.8#53 Non-authoritative answer: Name: google.com Address: 216.58.219.206 google.com has AAAA address 2607:f8b0:4006:80e::200e google.com mail exchanger = 20 alt1.aspmx.l.google.com. google.com mail exchanger = 40 alt3.aspmx.l.google.com. google.com nameserver = ns2.google.com. google.com nameserver = ns4.google.com. google.com nameserver = ns3.google.com. google.com rdata_257 = 0 issue "pki.goog" google.com mail exchanger = 30 alt2.aspmx.l.google.com. google.com mail exchanger = 10 aspmx.l.google.com. google.com mail exchanger = 50 alt4.aspmx.l.google.com. google.com text = "v=spf1 include:_spf.google.com ~all" google.com nameserver = ns1.google.com. google.com rdata_257 = 0 issue "symantec.com" google.com origin = ns2.google.com mail addr = dns-admin.google.com serial = 159912615 refresh = 900 retry = 900 expire = 1800 minimum = 60 Authoritative answers can be found from:
8. Using nslookup in Interactive Mode
We can also use nslookup in interactive mode. To go in interactive mode type nslookup on console and press enter. You will get nslookup prompt like > . Here you can run the same query and get the information for domain from DNS server. For your understanding, I have added comments in between commands.
nslookup
### Type domain name to get information from dns server
> google.com
Server: 8.8.8.8
Address: 8.8.8.8#53
Non-authoritative answer:
Name: google.com
Address: 172.217.10.46
### Set the another specific dns server to query.
> server 8.8.4.4
Default server: 8.8.4.4
Address: 8.8.4.4#53
### Again try to get the dns information, This time nslookup connects to specified dns server.
> google.com
Server: 8.8.4.4
Address: 8.8.4.4#53
Non-authoritative answer:
Name: google.com
Address: 172.217.10.46
### Set the query type. for example to get MX information set query=mx
> set query=mx
### Again try to get the dns information, This time nslookup will show MX information for domain
google.com
Server: 8.8.4.4
Address: 8.8.4.4#53
Non-authoritative answer:
google.com mail exchanger = 30 alt2.aspmx.l.google.com.
google.com mail exchanger = 50 alt4.aspmx.l.google.com.
google.com mail exchanger = 40 alt3.aspmx.l.google.com.
google.com mail exchanger = 10 aspmx.l.google.com.
google.com mail exchanger = 20 alt1.aspmx.l.google.com.
Authoritative answers can be found from:
Conclusion
In this tutorial, you have learned about uses of nslookup command.