nslookup (Name Server Lookup) is one of the earliest DNS query utilities, predating dig, and is available by default on nearly every operating system including Windows, macOS, and Linux. While it lacks the granular control and scripting-friendly output of dig, its universal availability makes it valuable in constrained environments (e.g., a compromised Windows host during a red team engagement with no additional tools installed) where you need to perform quick DNS reconnaissance using only built-in system utilities.
Installation
nslookup is pre-installed on Kali Linux as part of the dnsutils package (the same package that provides dig).
# Debian/Kali/Ubuntu
sudo apt update && sudo apt install dnsutils -y
# RHEL/CentOS/Fedora
sudo yum install bind-utils -y
Windows and macOS ship with nslookup built into the OS with no installation required.
Verify installation:
nslookup -version
Syntax
nslookup [OPTIONS] [name | -] [server]
Nslookup can run in two modes:
- Non-interactive mode: a single query is issued and the tool exits.
- Interactive mode: launched with no arguments (or with
-), presenting an>prompt for a session of multiple queries.
Command-Line Options
| Flag/Command | Description |
|---|---|
-type=TYPE | Specify the record type to query (A, MX, NS, TXT, SOA, CNAME, PTR, ANY) |
-query=TYPE | Alias of -type= |
-timeout=SEC | Set the timeout for a reply |
-retry=NUM | Number of retries before giving up |
-port=PORT | Use a non-standard DNS port |
-debug | Turn on debug output showing full packet details |
-d2 | Exhaustive debug output |
-recurse | Toggle recursive queries on/off (interactive mode) |
-vc | Force use of a virtual circuit (TCP) |
-domain=NAME | Set the default domain to append to unqualified names |
-srchlist=N1/N2/... | Set a custom domain search list |
-class=CLASS | Set query class (default IN) |
server | Optional last argument specifying which DNS server to query |
set type=TYPE | (interactive) change record type mid-session |
set all | (interactive) show all current option values |
exit | (interactive) quit the session |
Basic Usage
nslookup example.com
Expected output:
Server: 127.0.0.53
Address: 127.0.0.53#53
Non-authoritative answer:
Name: example.com
Address: 93.184.216.34
Practical Examples
Example 1 — Basic A record lookup
nslookup example.com
Server: 127.0.0.53
Address: 127.0.0.53#53
Non-authoritative answer:
Name: example.com
Address: 93.184.216.34
Example 2 — Query MX records
nslookup -type=MX example.com
example.com mail exchanger = 10 mail.example.com.
Example 3 — Query using a specific DNS server
nslookup example.com 8.8.8.8
Server: 8.8.8.8
Address: 8.8.8.8#53
Name: example.com
Address: 93.184.216.34
Example 4 — Reverse lookup
nslookup 8.8.8.8
Server: 127.0.0.53
Address: 127.0.0.53#53
8.8.8.8.in-addr.arpa name = dns.google.
Example 5 — Query TXT records
nslookup -type=TXT example.com
example.com text = "v=spf1 -all"
Example 6 — Interactive mode session
nslookup
> server 8.8.8.8
Default server: 8.8.8.8
> set type=NS
> example.com
Server: 8.8.8.8
Address: 8.8.8.8#53
example.com nameserver = a.iana-servers.net.
example.com nameserver = b.iana-servers.net.
> exit
Example 7 — Query with debug output for troubleshooting
nslookup -debug example.com
------------
QUESTIONS:
example.com, type = A, class = IN
ANSWERS:
-> example.com
internet address = 93.184.216.34
ttl = 86400
------------
Common Use Cases
- Quick DNS sanity checks on systems where
digis unavailable (common on Windows targets encountered during a red team engagement). - Verifying whether a domain resolves correctly after DNS changes.
- Performing basic reverse lookups on discovered IP addresses.
- Confirming which DNS server (internal vs. external) a compromised host is configured to use — useful for identifying internal DNS servers during internal network assessments.
Automation with Bash
Batch reverse-lookup a list of IPs:
#!/bin/bash
# reverse_lookup.sh
while IFS= read -r ip; do
echo "=== $ip ==="
nslookup "$ip" | grep "name ="
done < ip_list.txt
Query multiple record types for a domain:
#!/bin/bash
DOMAIN=$1
for TYPE in A MX NS TXT; do
echo "--- $TYPE ---"
nslookup -type=$TYPE "$DOMAIN"
echo
done
Tips and Best Practices
- Prefer
digovernslookupfor scripting and automation —nslookup‘s output format is less consistent across versions and harder to parse reliably. - Use
nslookupspecifically when working on a Windows host during an engagement, since it’s built in and won’t trigger suspicion from EDR the way installing new tools might. - Always specify
-type=ANYcautiously; many modern resolvers no longer honorANYqueries (per RFC 8482) and will return a minimal response. - When troubleshooting DNS propagation, query both the system default resolver and a public resolver (
8.8.8.8) to compare results.
Troubleshooting
| Problem | Cause | Fix |
|---|---|---|
** server can't find example.com: NXDOMAIN | Domain does not exist or typo in domain name | Verify domain spelling; check registration status with whois |
; connection timed out; no servers could be reached | Firewall blocking DNS traffic outbound | Try a different network or explicitly specify a reachable server |
| Output shows “Non-authoritative answer” | Response came from a caching resolver, not the authoritative server | Query the authoritative name server directly for a canonical answer |
-type=ANY returns minimal/empty response | RFC 8482 compliance — many resolvers no longer return full ANY responses | Query specific record types individually (A, MX, TXT, NS) instead |
References
- Microsoft nslookup documentation: https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/nslookup
man nslookupmanual page- RFC 1035 – Domain Names: https://www.rfc-editor.org/rfc/rfc1035
- RFC 8482 – Providing Minimal-Sized Responses to DNS Queries That Have QTYPE=ANY: https://www.rfc-editor.org/rfc/rfc8482