Definition
nslookup is a DNS troubleshooting client. Given a name or address, it asks a DNS server for resource records—commonly A/AAAA forward lookups or PTR reverse lookups—and prints the response. It can run in non-interactive one-liner mode (good for scripts) or interactive mode where you change servers and query types between prompts.
What you see
Output usually includes the resolver that answered (defaults to your OS-configured DNS unless you override), the answer section, and sometimes authoritative vs non-authoritative flags. Misreading server lines causes confusion in split-tunnel VPNs where corporate resolvers differ from home ISP DNS.
Common patterns
| Goal | Example shape | Note |
|---|---|---|
| Forward A | nslookup example.com | Uses system resolver defaults |
| Pick server | nslookup example.com 1.1.1.1 | Bypasses local resolver for this query |
| MX / TXT | Interactive set type=mx | Syntax varies slightly by OS build |
| Reverse PTR | nslookup 203.0.113.4 | Depends on in-addr.arpa / ip6.arpa delegation |
nslookup vs dig
Both query DNS, but dig (BIND) output is more uniform and script-friendly (+short, +trace). nslookup historically mirrored resolver libraries differently across vendors. For automation on Linux, prefer dig or kdig; nslookup remains useful on Windows boxes and in tutorials.
Troubleshooting mindset
Always record which resolver answered, whether DNSSEC validation is in play, and whether split DNS means internal names fail on public resolvers. Follow with ping/curl only after DNS returns sensible answers.
Related: How DNS works, nslookup and dig on Linux, DNS troubleshooting commands, Windows ipconfig explained.