nslookup Command Cheat Sheet

nslookup (name server lookup) is a network administration tool for querying the Domain Name System (DNS) to obtain domain name or IP address mapping.

Synopsis

nslookup [option] [name | -] [server]

Basic Queries

Get IP of Domain (A Record)

nslookup google.com

Get Domain of IP (Reverse Lookup)

nslookup 8.8.8.8

Query Specific Records

MX Records (Mail)

Find the mail servers responsible for a domain.

nslookup -type=MX google.com

NS Records (Name Servers)

Find who authorizes DNS for the domain.

nslookup -type=NS google.com

TXT Records

Often used for SPF (email security) or domain verification.

nslookup -type=TXT google.com

ALL Records (Any)

nslookup -type=ANY google.com

Debugging Propagation

Query Specific Nameserver

By default, nslookup asks your system's DNS (e.g., ISP router). To check if Google's DNS or Cloudflare sees the new IP yet:

nslookup google.com 8.8.8.8

(Asks 8.8.8.8 directly).

Interactive Mode

Type nslookup without arguments to enter interactive mode.

nslookup
> server 1.1.1.1
Default server: 1.1.1.1
Address: 1.1.1.1#53

> set type=MX
> twitter.com
... output ...
> exit

Troubleshooting

"Non-authoritative answer"

This means the result came from a cache (like your ISP), not the official source. Use server <authoritative_ns> to get an authoritative answer.

"NXDOMAIN"

The domain does not exist.

Notes

Deprecated? Like netstat, nslookup is old. The modern replacement is dig (Domain Information Groper), which provides more raw detail. But nslookup is installed everywhere (even Windows).
Time to Live (TTL): Interactive mode set debug or dig is needed to see TTL values.