The 10 most used Nslookup commands

Nslookup is probably the most widely used DNS tool in the world, if only because it ships by default on Windows, macOS and most Linux distributions. Many people only know the basic command, but it can do far more: query specific servers, check MX records, diagnose propagation issues or test a particular DNS resolver. Here are the 10 commands you will reach for most often.

1. Look up the IP address of a domain

The most basic and most frequent command. It resolves a domain name to an IP address by querying your default DNS server.

nslookup example.com

The response shows the DNS server used for resolution (the "Server" line) and the IP address tied to the domain. If the domain has multiple A records (common for high-traffic sites using load balancing), you will see several addresses.

2. Find the domain name from an IP (reverse DNS)

The reverse operation: starting from an IP address, find the domain name linked to it through its PTR record. This is called a reverse lookup.

nslookup 142.250.74.46

If a PTR record exists, you will see the corresponding domain name. Many mail servers check reverse DNS to validate sender identity. If your mail server lacks a properly configured PTR, your emails are likely to land in spam.

3. Query a specific DNS server

By default, nslookup uses the DNS server configured on your machine (your ISP's or one you set manually). But you can force the query to a particular DNS server to compare results or test a specific resolver.

nslookup example.com 8.8.8.8

Here the query goes to Google DNS (8.8.8.8) instead of your default server. This is invaluable for diagnosing propagation problems: if the result differs between your local DNS and 1.1.1.1 (Cloudflare) or 8.8.8.8 (Google), the issue is likely your resolver's cache or your ISP's.

4. Look up mail servers (MX)

MX records tell you which servers handle email for a domain. It is the first thing to check when emails are not being delivered.

nslookup -type=mx example.com

The response lists MX servers with their priority (lowest number is the primary server). For a domain on Google Workspace you will see entries like aspmx.l.google.com at various priorities. For Microsoft 365, something like example-com.mail.protection.outlook.com.

5. Look up authoritative DNS servers (NS)

NS records indicate which DNS servers are authoritative for a domain. Useful for finding out which DNS host a domain is configured with.

nslookup -type=ns example.com

If you see servers like ns1.cloudflare.com, the domain uses Cloudflare for DNS. Servers ending in .awsdns. point to Amazon Route 53. Servers like dns1.registrar-servers.com indicate Namecheap.

6. Check TXT records

TXT records serve many purposes: domain ownership verification (Google Search Console, Microsoft 365), SPF configuration for email authentication, DKIM keys, and DMARC policies.

nslookup -type=txt example.com

You will often see records starting with v=spf1 (SPF config), v=DMARC1 (DMARC policy), or Google/Microsoft verification strings. If you have email deliverability issues, this is where you verify SPF and DMARC are in place.

7. Look up a CNAME record

A CNAME is an alias pointing to another domain name. Very common for subdomains: www.example.com often points to example.com via a CNAME.

nslookup -type=cname www.example.com

If the subdomain uses a CNAME, you will see which domain it points to. CDNs like Cloudflare, Fastly and AWS CloudFront rely heavily on CNAMEs to route traffic to their edge servers.

8. Look up AAAA records (IPv6)

AAAA records are the IPv6 equivalent of A records. Use this command to check whether a domain supports IPv6.

nslookup -type=aaaa example.com

If the domain has an AAAA record, you will see an IPv6 address (for example 2606:2800:220:1:248:1893:25c8:1946). No response means the domain does not support IPv6, which is still the case for many sites in 2026.

9. Check the SOA record

The SOA (Start of Authority) record holds essential information about the DNS zone: the primary server, admin contact, serial number, and synchronisation parameters between servers.

nslookup -type=soa example.com

The most important field to check here is the serial. If you just changed a DNS record and the changes are not propagating, a serial that was not incremented is often the cause. The common format is YYYYMMDDNN (for example 2026061001 for the first change on 10 June 2026).

10. Use interactive mode

If you need to run several queries in a row, nslookup's interactive mode saves you from retyping the command each time. Just type nslookup with no arguments to enter it.

nslookup
> set type=mx
> example.com
> set type=ns
> example.com
> server 1.1.1.1
> example.com
> exit

In this mode you can switch record type with set type=, change DNS server with server, and chain queries. Much faster when diagnosing an issue that requires checking multiple record types across multiple domains.

On Linux and macOS, dig is often preferred over nslookup for its more detailed output and flexible syntax. But nslookup remains the universal tool, available everywhere including on Windows machines with nothing extra to install. For a quick diagnosis from any workstation, it is the one that will never let you down.