Nslookup: Complete Guide to DNS Query and Domain Name Troubleshooting Using Kali Linux

nslookup (Name Server Lookup) is one of the earliest DNS query utilities, predating dig, and is available by default on nearly every operating system including Windows, macOS, and Linux. While it lacks the granular control and scripting-friendly output of dig, its universal availability makes it valuable in constrained environments (e.g., a compromised Windows host during a red team engagement with no additional tools installed) where you need to perform quick DNS reconnaissance using only built-in system utilities.

Installation

nslookup is pre-installed on Kali Linux as part of the dnsutils package (the same package that provides dig).

# Debian/Kali/Ubuntu
sudo apt update && sudo apt install dnsutils -y

# RHEL/CentOS/Fedora
sudo yum install bind-utils -y

Windows and macOS ship with nslookup built into the OS with no installation required.

Verify installation:

nslookup -version

Syntax

nslookup [OPTIONS] [name | -] [server]

Nslookup can run in two modes:

• Non-interactive mode: a single query is issued and the tool exits.
• Interactive mode: launched with no arguments (or with -), presenting an > prompt for a session of multiple queries.

Command-Line Options

Basic Usage

nslookup example.com

Expected output:

Server:         127.0.0.53
Address:        127.0.0.53#53

Non-authoritative answer:
Name:   example.com
Address: 93.184.216.34

Practical Examples

Example 1 — Basic A record lookup

nslookup example.com

Server:  127.0.0.53
Address: 127.0.0.53#53
Non-authoritative answer:
Name:    example.com
Address: 93.184.216.34

Example 2 — Query MX records

nslookup -type=MX example.com

example.com     mail exchanger = 10 mail.example.com.

Example 3 — Query using a specific DNS server

nslookup example.com 8.8.8.8

Server:  8.8.8.8
Address: 8.8.8.8#53
Name:    example.com
Address: 93.184.216.34

Example 4 — Reverse lookup

nslookup 8.8.8.8

Server:  127.0.0.53
Address: 127.0.0.53#53
8.8.8.8.in-addr.arpa   name = dns.google.

Example 5 — Query TXT records

nslookup -type=TXT example.com

example.com     text = "v=spf1 -all"

Example 6 — Interactive mode session

nslookup
> server 8.8.8.8
Default server: 8.8.8.8
> set type=NS
> example.com
Server:  8.8.8.8
Address: 8.8.8.8#53
example.com     nameserver = a.iana-servers.net.
example.com     nameserver = b.iana-servers.net.
> exit

Example 7 — Query with debug output for troubleshooting

nslookup -debug example.com

------------
    QUESTIONS:
        example.com, type = A, class = IN
    ANSWERS:
    ->  example.com
        internet address = 93.184.216.34
        ttl = 86400
------------

Common Use Cases

• Quick DNS sanity checks on systems where dig is unavailable (common on Windows targets encountered during a red team engagement).
• Verifying whether a domain resolves correctly after DNS changes.
• Performing basic reverse lookups on discovered IP addresses.
• Confirming which DNS server (internal vs. external) a compromised host is configured to use — useful for identifying internal DNS servers during internal network assessments.

Automation with Bash

Batch reverse-lookup a list of IPs:

#!/bin/bash
# reverse_lookup.sh
while IFS= read -r ip; do
    echo "=== $ip ==="
    nslookup "$ip" | grep "name ="
done < ip_list.txt

Query multiple record types for a domain:

#!/bin/bash
DOMAIN=$1
for TYPE in A MX NS TXT; do
    echo "--- $TYPE ---"
    nslookup -type=$TYPE "$DOMAIN"
    echo
done

Tips and Best Practices

• Prefer dig over nslookup for scripting and automation — nslookup‘s output format is less consistent across versions and harder to parse reliably.
• Use nslookup specifically when working on a Windows host during an engagement, since it’s built in and won’t trigger suspicion from EDR the way installing new tools might.
• Always specify -type=ANY cautiously; many modern resolvers no longer honor ANY queries (per RFC 8482) and will return a minimal response.
• When troubleshooting DNS propagation, query both the system default resolver and a public resolver (8.8.8.8) to compare results.

Troubleshooting

References

• Microsoft nslookup documentation: https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/nslookup
• man nslookup manual page
• RFC 1035 – Domain Names: https://www.rfc-editor.org/rfc/rfc1035
• RFC 8482 – Providing Minimal-Sized Responses to DNS Queries That Have QTYPE=ANY: https://www.rfc-editor.org/rfc/rfc8482