nslookup: Here’s how the useful DNS check works

As the central directory service for network addresses, the domain name system (DNS) plays an important role in the success of the Internet and World Wide Web. The web of globally dis­trib­uted DNS servicers (also called name servers) does the important work of ensuring that the names of the different network par­ti­cipants and ap­plic­a­tions, such as example.org, are converted into numeric and machine-readable IP addresses (and vice versa). In this way, it guar­an­tees that the correct computer or desired website is always reached via the cor­res­pond­ing IP, even if you are unaware of it.

In some situ­ations (when there are issues with the name res­ol­u­tion, for example), it is helpful to look behind the scenes and research the IP address linked to a domain name, or the domain name linked to an IP address. A useful tool for this is the program nslookup, which Windows, macOS, and Linux all feature as a standard in­stall­a­tion.

nslookup is a simple but very practical command-line tool, which is prin­cip­ally used to find the IP address that cor­res­ponds to a host, or the domain name that cor­res­ponds to an IP address (a process called “Reverse DNS Lookup”). nslookup allows itself to be used in the command-line of the operating system in question; Windows users start the service via the command prompt, and Unix users via the terminal window. Ad­di­tion­ally, there are now a number of services that make it possible to use nslookup online.

nslookup retrieves the relevant address in­form­a­tion directly from the DNS cache of name servers, a process which can be achieved through two different modes that the user can choose from. In the non­in­ter­act­ive mode, the tool inspects the resource records (which is what the address entries in the DNS cache are called) that are stored in the local name server, in a standard way. This mode is es­pe­cially well suited for simple queries, for which a single domain entry needs to be looked up. When you want to use a different DNS server for the research and complete more complex search processes, you need the in­ter­act­ive mode, in which the command-line program needs to be started sep­ar­ately at first.

There are different scenarios in which the use of nslookup is ap­pro­pri­ate. In this way, the command-line program is an es­pe­cially crucial tool when resolving DNS issues. First and foremost, a data query helps find the cause of the problem at hand. For example, those who use Windows and ex­per­i­ence an issue with the active directory can use nslookup to quickly and easily check whether all involved servers are converted in the domain name system as planned. Generally, this program shows its strengths when various sub­do­mains are involved – not only when it is simply a matter of checking them, but also when there are con­nec­tion problems.

Another typical scenario is the search for optimal mail servers SMTP, POP, IMAP) for a desired domain. In this case, nslookup de­term­ines the servers in question on the basis of the MX-Records (mail exchanger) that belong to the domain of the e-mail provider. These entries contain the IP addresses and names of the provider servers, which sub­sequently only need to be specified during the con­fig­ur­a­tion of the mail clients to perfect the routing of the elec­tron­ic mail service.

To close nslookup after the query, simply give the “exit” command, or close the command-line. Al­tern­at­ively, the [CTRL] + [C] key com­bin­a­tion does the trick.

In this case, a “non-au­thor­it­at­ive answer” no­ti­fic­a­tion is given, as the local DNS server was unable to answer the query itself, and instead had to contact one or more other name servers. The content of the nslookup results are the IPv4 (four-figure) and IPv6 addresses (longer, divided with colons) of the example domain.

For in­di­vidu­ally con­figured nslookup queries in the in­ter­act­ive mode, see the following two examples.

nslookup is fun­da­ment­ally set up for the query of IPv4 and IPv6 addresses. However, as pre­vi­ously mentioned, the command-line tool can retrieve other address types of a domain through its method of accessing the DNS entries. To this end, the user must next set the desired type, before they can enter the domain name into the command-line. The syntax of the cor­res­pond­ing nslookup commands looks like this:

The “resource record type” cor­res­ponds to the desired type of query, some of the options for which are included in the following chart:

It is standard procedure for nslookup to contact the local DNS server, which is usually pre­de­ter­mined by the router, or rather the Internet provider. But using it for the query can oc­ca­sion­ally result in in­ac­cur­ate results, for example, because the server being searched for is not listed in the cache of the local name server. Luckily, the command-line tool provides the option to choose the DNS server you want to use for the query yourself. If you choose the server that is connected to the cor­res­pond­ing domain, you even receive au­thor­it­at­ive answers. This firstly involves finding the name server or name servers in question, by setting the “NS” query type and then entering the domain name to be shown the DNS entry:

One of the two presented name servers must next be des­ig­nated as the standard server, so that future queries are completed through it. The cor­res­pond­ing command is composed of the “server” parameter and the name of the desired server. Ac­cord­ingly, these two commands are possible for the nslookup example in question:

The au­thor­it­at­ive and accurate answer received this time around shows, among other things, the pre­vi­ously mentioned name servers and the primary name server, from which the DNS data was retrieved.