nslookup: Here’s how the useful DNS check works

As the central directory service for network addresses, the domain name system (DNS) plays an important role in the success of the Internet and World Wide Web. The web of globally distributed DNS servicers (also called name servers) does the important work of ensuring that the names of the different network participants and applications, such as example.org, are converted into numeric and machine-readable IP addresses (and vice versa). In this way, it guarantees that the correct computer or desired website is always reached via the corresponding IP, even if you are unaware of it.

In some situations (when there are issues with the name resolution, for example), it is helpful to look behind the scenes and research the IP address linked to a domain name, or the domain name linked to an IP address. A useful tool for this is the program nslookup, which Windows, macOS, and Linux all feature as a standard installation.

nslookup is a simple but very practical command-line tool, which is principally used to find the IP address that corresponds to a host, or the domain name that corresponds to an IP address (a process called “Reverse DNS Lookup”). nslookup allows itself to be used in the command-line of the operating system in question; Windows users start the service via the command prompt, and Unix users via the terminal window. Additionally, there are now a number of services that make it possible to use nslookup online.

nslookup retrieves the relevant address information directly from the DNS cache of name servers, a process which can be achieved through two different modes that the user can choose from. In the noninteractive mode, the tool inspects the resource records (which is what the address entries in the DNS cache are called) that are stored in the local name server, in a standard way. This mode is especially well suited for simple queries, for which a single domain entry needs to be looked up. When you want to use a different DNS server for the research and complete more complex search processes, you need the interactive mode, in which the command-line program needs to be started separately at first.

There are different scenarios in which the use of nslookup is appropriate. In this way, the command-line program is an especially crucial tool when resolving DNS issues. First and foremost, a data query helps find the cause of the problem at hand. For example, those who use Windows and experience an issue with the active directory can use nslookup to quickly and easily check whether all involved servers are converted in the domain name system as planned. Generally, this program shows its strengths when various subdomains are involved – not only when it is simply a matter of checking them, but also when there are connection problems.

Another typical scenario is the search for optimal mail servers SMTP, POP, IMAP) for a desired domain. In this case, nslookup determines the servers in question on the basis of the MX-Records (mail exchanger) that belong to the domain of the e-mail provider. These entries contain the IP addresses and names of the provider servers, which subsequently only need to be specified during the configuration of the mail clients to perfect the routing of the electronic mail service.

To close nslookup after the query, simply give the “exit” command, or close the command-line. Alternatively, the [CTRL] + [C] key combination does the trick.

In this case, a “non-authoritative answer” notification is given, as the local DNS server was unable to answer the query itself, and instead had to contact one or more other name servers. The content of the nslookup results are the IPv4 (four-figure) and IPv6 addresses (longer, divided with colons) of the example domain.

For individually configured nslookup queries in the interactive mode, see the following two examples.

nslookup is fundamentally set up for the query of IPv4 and IPv6 addresses. However, as previously mentioned, the command-line tool can retrieve other address types of a domain through its method of accessing the DNS entries. To this end, the user must next set the desired type, before they can enter the domain name into the command-line. The syntax of the corresponding nslookup commands looks like this:

The “resource record type” corresponds to the desired type of query, some of the options for which are included in the following chart:

It is standard procedure for nslookup to contact the local DNS server, which is usually predetermined by the router, or rather the Internet provider. But using it for the query can occasionally result in inaccurate results, for example, because the server being searched for is not listed in the cache of the local name server. Luckily, the command-line tool provides the option to choose the DNS server you want to use for the query yourself. If you choose the server that is connected to the corresponding domain, you even receive authoritative answers. This firstly involves finding the name server or name servers in question, by setting the “NS” query type and then entering the domain name to be shown the DNS entry:

One of the two presented name servers must next be designated as the standard server, so that future queries are completed through it. The corresponding command is composed of the “server” parameter and the name of the desired server. Accordingly, these two commands are possible for the nslookup example in question:

The authoritative and accurate answer received this time around shows, among other things, the previously mentioned name servers and the primary name server, from which the DNS data was retrieved.