Vol. I · No. 46The command line sectionSat, 10 Oct 2026
Linux · names

nslookup

a quick DNS lookup

nslookup asks a DNS server for a name and prints the answer. It shows less than dig, but it works the same on Linux, macOS and Windows, which makes it the lookup command you can rely on finding.

The first test when a site will not load: does the name resolve at all?

Asks
The system resolver
or a server you name
Prints
Server, then answer
two short blocks
Record type
-type=MX
A is the default
More detail
dig
TTLs, flags, sections

At the terminal

Read the session first, then the notes: each numbered line in the output is answered by the note with the same number.

user@netflow — bashbind9-dnsutils
$ nslookup example.com
1Server: 127.0.0.53
Address: 127.0.0.53#53
 
2Non-authoritative answer:
Name: example.com
3Address: 192.0.2.80
4$ nslookup -type=MX example.com 192.0.2.53
example.com mail exchanger = 10 mail.example.com.
Illustrative session · names, sizes and dates are examples, and every address is from a documentation or private range
Reading the output

What the numbered lines are telling you

1
Who was asked

The resolver that answered. 127.0.0.53 is systemd-resolved, the local stub on many systems; #53 is the port.

2
Non-authoritative

The answer came from a cache rather than from the server responsible for the domain. That is normal.

3
The answer

The IPv4 address the name resolves to.

4
A record type and a chosen server

-type=MX asks which hosts receive mail for the domain, and the address at the end is the DNS server to ask instead of the default.

Switches

A switch changes how the command behaves. These are the ones used day to day; man nslookup lists the rest. Single-letter switches can usually be joined, so -l -a may be written -la.

-type=TYPE
Ask for a record type: A, AAAA, MX, NS, TXT.
SERVER
A DNS server given after the name is asked instead of the default.
-port=NUM
Query a DNS server on another port.
-debug
Print the full response.
-timeout=SECS
How long to wait for a reply.

Variations worth knowing

The same tool, pointed at a narrower question. These four cover most of what it is reached for day to day.

nslookup 192.0.2.80

A reverse lookup: the name for an address.

nslookup -type=NS example.com

Lists the name servers responsible for a domain.

nslookup -type=TXT example.com

Shows TXT records, where SPF and verification strings live.

dig +short example.com

The same lookup with dig, printing only the address.

In cybersecurity

What a name resolves to decides where your traffic goes.

Compare resolvers

If your resolver and a public one give different addresses for the same name, either the site uses geo-routing or something is rewriting DNS.

DNS reveals infrastructure

MX, NS and TXT records disclose mail providers, hosting and third-party services. It is the first, entirely passive, step of reconnaissance.

Plain DNS is unencrypted

Lookups are visible to everyone on the path and can be forged. DNS over TLS or HTTPS protects them in transit.

Protocols it shows

DNSUDP

Read alongside

digSends a DNS query to a resolver of your choosing and prints the whole response, section by section.hostResolves a name to its addresses, or an address to its name, printing one plain sentence per record.