nslookup

What it does

nslookup sends a question to a DNS server and shows the answer. It works on Linux, macOS and Windows, so it is good to know when you help other people.

There are two ways to use it:

One question: nslookup NAME [SERVER]. It prints the answer and stops.
Interactive: type nslookup alone. You get a > prompt and can ask many questions, change the server or the record type.

nslookup asks DNS only. It does not read /etc/hosts. To test what the system really uses (hosts file + DNS), use getent hosts NAME. For more details and clean output in scripts, dig is the better tool.

On Red Hat Enterprise Linux it is in the package bind-utils (dnf install bind-utils).

How to write it

nslookup [-option ...] [name | -] [server]
nslookup -type=TYPE name [server]
nslookup                      (interactive mode)

Options 20

Most used

Options on the command line (also with "set" in interactive mode)

-type=TYPE, -query=TYPE, -q=TYPE: The record type to ask for: A, AAAA, MX, TXT, NS, SOA, PTR, CNAME, SRV, CAA, ANY. Default: A and AAAA.
-port=n: Ask on another port than 53, for example a test DNS server.
-timeout=seconds: How long to wait for an answer before trying again.
-retry=n: How many times to try again.
-debug, -nodebug: Show the full answer with all sections and the TTL values.
-d2, -nod2: Even more debug output: what nslookup sends and gets.
-domain=name: Set the search domain for short names.
-search, -nosearch: Add the search domains to names that have no dot at the end (on by default).
-recurse, -norecurse: Ask the server to find the answer for you (on by default). -norecurse shows only what this server knows.
-vc, -novc: Use TCP instead of UDP.
-fail, -nofail: With -fail, stop when a server answers SERVFAIL. With -nofail (default), try the next server.
-ndots=n: A name with this many dots is asked as it is first, before the search domains.
-class=CLASS: The DNS class: IN (internet, default), CH, HS or ANY.
-all: In interactive mode (as set all): show the current settings.
-version: Show the version and stop.

Commands in interactive mode

name [server]: Look up a name (or an IP address for the reverse name).
server server: Use another DNS server for the next questions.
lserver server: Like server, but use the first server to find the new server's address.
set keyword[=<value>]: Change a setting, for example set type=mx or set debug.
exit: Leave interactive mode. Ctrl+D works too.

Examples 14

$ run as a normal user# run as root (or with sudo)

1Find the address of a name

$nslookup www.redhat.com
Server:         192.168.122.1
Address:        192.168.122.1#53
 
Non-authoritative answer:
www.redhat.com  canonical name = ds-www.redhat.com.edgekey.net.
...

"Server" is the DNS server that answered. "Non-authoritative" means it came from a cache, not from the owner of the domain.

2Find the name of an IP address (reverse lookup)
```
$nslookup 8.8.8.8
8.8.8.8.in-addr.arpa    name = dns.google.
```
Useful in incident response: which host is behind an IP address in your logs? Not every address has a reverse name.
3Ask one DNS server directly
```
$nslookup app.example.com 10.0.0.53
$nslookup app.example.com 1.1.1.1
```
Compare the internal and a public server. Different answers show split DNS or an old record in one cache.
4Find the mail servers of a domain
```
$nslookup -type=mx example.com
example.com     mail exchanger = 10 mx1.example.com.
```
The lowest number has the highest priority. Check this when mail does not arrive.
5Check the SPF record of a domain (mail security)
```
$nslookup -type=txt example.com
example.com     text = "v=spf1 include:_spf.example.com -all"
```
SPF lists the servers that may send mail for the domain. "-all" means: reject all others.
6Check the DMARC record
```
$nslookup -type=txt _dmarc.example.com
```
No answer means no DMARC policy: other people can more easily send fake mail in the name of the domain.
7Find the name servers of a domain
```
$nslookup -type=ns example.com
```
Shows which servers are the owner (authoritative) of the domain. Ask them directly to see the real records.
8See the SOA record and the serial number
```
$nslookup -type=soa example.com
```
After you change a zone, the serial number must go up, or other servers do not take the change.
9Check which certificate authorities may issue certificates
```
$nslookup -type=caa example.com
```
A CAA record allows only some CAs (for example Let's Encrypt) to make certificates for the domain.
10Find a service with an SRV record (like LDAP or Kerberos)
```
$nslookup -type=srv _ldap._tcp.corp.example.com
```
Linux clients that join Active Directory or IdM find the domain controllers this way.
11See the full answer with TTL values
```
$nslookup -debug app.example.com
```
The TTL shows how long servers keep the answer in cache. Lower it before you move a service to a new IP.
12Wait in a script until a new name works
```
$until nslookup -timeout=2 -retry=1 app.example.com >/dev/null 2>&1; do sleep 10; done; echo "DNS is ready"
```
Useful in a deployment pipeline: only go on when the new DNS record exists.
13Test name resolution inside a Kubernetes pod
```
$kubectl exec -it debug-pod -- nslookup my-service.default.svc.cluster.local
```
If this fails, check the cluster DNS (CoreDNS) before you look at your app.
14Ask many questions in interactive mode
```
$nslookup
> server 1.1.1.1
> set type=aaaa
> www.example.com
> exit
```
Interactive mode keeps your settings between questions. Type the words after the > prompt of nslookup.

Watch out

nslookup does not read /etc/hosts. A name can work for ping but not for nslookup, or the other way around.
The type ANY is often refused by modern DNS servers. Ask for the type you need.
In interactive mode the prompt is >. Type exit to leave.
The exit code is 1 when a question failed and 0 when it worked. Scripts can use this.

Files

/etc/resolv.conf: The DNS servers and search domains that nslookup uses by default.

Tips to remember

One name = address, one address = name.
Add a server at the end to ask that server: nslookup NAME SERVER.
-type= picks the record: mx for mail, txt for SPF and DMARC, ns for the owner, ptr for reverse.

`nslookup`

What it does

How to write it

Options 20

Options on the command line (also with "set" in interactive mode)

Commands in interactive mode

Examples 14

1Find the address of a name

2Find the name of an IP address (reverse lookup)

3Ask one DNS server directly

4Find the mail servers of a domain

5Check the SPF record of a domain (mail security)

6Check the DMARC record

7Find the name servers of a domain

8See the SOA record and the serial number

9Check which certificate authorities may issue certificates

10Find a service with an SRV record (like LDAP or Kerberos)

11See the full answer with TTL values

12Wait in a script until a new name works

13Test name resolution inside a Kubernetes pod

14Ask many questions in interactive mode

Watch out

Files

Tips to remember

Full manual

What it does

How to write it

Options 20

Options on the command line (also with "set" in interactive mode)

Commands in interactive mode

Examples 14

1Find the address of a name

2Find the name of an IP address (reverse lookup)

3Ask one DNS server directly

4Find the mail servers of a domain

5Check the SPF record of a domain (mail security)

6Check the DMARC record

7Find the name servers of a domain

8See the SOA record and the serial number

9Check which certificate authorities may issue certificates

10Find a service with an SRV record (like LDAP or Kerberos)

11See the full answer with TTL values

12Wait in a script until a new name works

13Test name resolution inside a Kubernetes pod

14Ask many questions in interactive mode

Watch out

Files

Tips to remember

Related commands

Used in these lessons

Full manual

`nslookup`