Using Nslookup in Windows to Query DNS Servers and Records

6.6K

The nslookup (name server lookup) command line tool allows you to query the DNS server from the CLI. Nslookup is used to diagnose and check DNS servers and records, and to detect problems with name resolution. In this article, we are going to look at some basic examples of how to use the nslookup command in Windows.

How to Use the Nslookup Command in Windows

By default, the nslookup command sends DNS queries to the preferred name server specified in your network adapter settings.

Find DNS Servers Configured on Windows

In order to view the DNS servers configured for each network interface, use PowerShell command:

Get-DnsClientServerAddress

The output shows the network interface, address family, and configured DNS server addresses.

For additional DNS client config, such as DNS suffixes and registration settings, use the command below:

Get-DnsClient

You can also use ipconfig /all in order to view DNS server addresses together with the rest of the network adapter config:

ipconfig /all

For example, to display DNS server addresses for a specific interface, use the command below:

Get-DnsClientServerAddress -InterfaceAlias "Ethernet"

The nslookup command can be used in either interactive or non-interactive mode.

The following is an example of a non-interactive nslookup command:

nslookup theitbros.com

In this example, we requested the IP address of theitbros.com domain. The nslookup command queries the DNS server specified in the Server line and returns the IP address associated with the hostname.

What Does “Non-authoritative answer” Mean?

A non-authoritative answer means that the DNS server responding to the query is not authoritative for the queried DNS zone. The answer may have been obtained through recursive resolution from an authoritative DNS server, or it may have been returned from the DNS server’s cache.

For example, when you query a public DNS resolver such as 8.8.8.8 or 1.1.1.1, the resolver may already have the requested record cached and can return it without performing a new recursive lookup. An authoritative answer is returned by a DNS server that hosts authoritative data for the queried zone.

Make query against authoritative name server

You can make a query against an authoritative name server by specifying its address directly in the parameters of the nslookup command:

nslookup theitbros.com ns1.siteground.net

• If no records were found for the specified DNS name, the nslookup will return the error: *** can’t find theitbros.com: Non-existent domain
• If your DNS server is unavailable or not responding, you will receive a DNS request timed out error.

Query a Specific DNS Server

You can use nslookup command to send the same DNS query to different DNS servers. This is useful when you are troubleshooting DNS resolution inconsistencies, cached records, or DNS replication problems.

Here is an example:

nslookup theitbros.com 1.1.1.1

nslookup theitbros.com 8.8.8.8

By comparing the results returned by different DNS servers, you can identify:

• DNS propagation delays
• stale cached records
• incorrect DNS responses
• inconsistencies between DNS servers
• differences between public DNS providers

This technique is commonly used when troubleshooting DNS changes after migrating websites, updating records, or validating DNS configs.

If you run the nslookup command without any parameters, the utility will switch to the interactive mode. Simply enter the DNS hostname to resolve a name to an IP address interactively:

You can perform reverse lookups (get DNS name by IP address). Just type the IP address in the nslookup interactive prompt and press Enter.

In the interactive mode of nslookup, a large number of additional options are available. Type a question (?) in the interactive console for a complete list of nslookup subcommands.

To close the interactive nslookup session, type exit and press Enter.

Using Nslookup to View Different DNS Records

By default, nslookup uses the A record type for hostname lookups. A records map hostnames to IPv4 addresses. To query other record types (such as AAAA, MX, NS, TXT, or SRV), you need to specify the record type explicitly. In case you need to query both IPv4 and IPv6 addresses with nslookup, you need to run separate queries for the A and AAAA record types.

You can set specific record types to lookup using the command:

-type=<record_type>

Common DNS record types that can be queried with nslookup include:

• A — maps a hostname to an IPv4 address
• AAAA — maps a hostname to an IPv6 address
• CNAME — alias that points one hostname to another
• MX — specifies mail servers for a domain
• NS — identifies authoritative DNS servers for a zone
• PTR — maps an IP address to a hostname (reverse lookup)
• SOA — contains zone authority and DNS config info
• TXT — stores arbitrary text data (SPF, DKIM, domain verification, etc.)
• SRV — locates services and their endpoints (AD, Kerberos, Exchange, Teams)
• CAA — specifies which certificate authorities may issue TLS certificates for a domain

For example, to find the authoritative name servers for a specific domain, set the record type to NS (Name Server):

nslookup
> set type=ns
> theitbros.com

List of all the mail servers that are configured for a specific domain (MX, Mail eXchange records):

nslookup -type=mx theitbros.com

In this example, this domain has 3 MX records with priorities 10, 20 and 30 (the lower the number, the higher the MX priority).

While nslookup remains available in Windows, note that PowerShell Resolve-DnsName provides richer output and is generally a better choice for scripting and automation.

Another limitation of nslookup is its exit-code behavior. nslookup can report DNS errors (such as NXDOMAIN, SERVFAIL, or a timeout) in its output without providing a reliable nonzero process exit code for every DNS failure. This makes it less convenient for scripts and monitoring systems that rely on process exit codes to detect failures. Resolve-DnsName integrates with PowerShell error handling and returns structured DNS results, making it easier to handle DNS failures programmatically.

DNS over HTTPS and nslookup

Modern Windows versions also support DNS over HTTPS (DoH). Windows 11 supports DoH on the DNS client, and Windows Server 2025 can provide DoH from the DNS Server service when the required updates and config are in place. Microsoft added DoH support to the Windows Server 2025 DNS Server service with the June 2026 security update (KB5094125).

DoH encrypts DNS queries and responses inside HTTPS, so the DNS traffic is carried over HTTPS instead of traditional unencrypted DNS traffic over UDP/TCP port 53.

The nslookup utility does not provide a way to test/control Windows DNS-over-HTTPS config. Therefore, you should not interpret an nslookup test as proof that a Windows client is or is not using DoH.

For Windows DoH troubleshooting, use the Windows DNS client/server config and diagnostic tools instead of relying only on port 53 monitoring. DoH traffic cannot be inspected as traditional DNS queries by network monitoring tools because the DNS messages are encrypted inside HTTPS.

Note. Keep in mind that enabling DoH on a Windows Server DNS server does not automatically encrypt all DNS traffic. Traditional DNS remains available unless explicitly disabled, and upstream DNS communication and zone transfers remain unencrypted by default.

Query SRV Records

SRV records are commonly used to locate services (such as AD DCs, Kerberos authentication services, Microsoft Exchange, Teams, and other apps).

For example, you can query the SRV records used by AD LDAP services with the command:

nslookup -type=SRV _ldap._tcp.dc._msdcs.contoso.com

This command queries the DNS records used by AD for DC discovery. However, nslookup only queries DNS and does not perform the full DC Locator process.

For Active Directory DCs discovery and troubleshooting, you should use nltest and dcdiag in addition to DNS queries.

In order to find Kerberos service records, run the following command:

nslookup -type=srv _kerberos._tcp.contoso.com

SRV records contain additional info compared to A records, including:

• service priority
• service weight
• port number
• target host name

SRV lookups are commonly used when troubleshooting AD DC discovery and authentication problems.

For AD troubleshooting, DNS SRV records are only one part of DC discovery. To test the actual Windows DC Locator process, use the command below:

nltest /dsgetdc:contoso.com

This command checks if the client can locate a suitable DC rather than only verifying that the required DNS records exist.

Query Multiple DNS Record Types

You can use the ANY query type to request info about multiple DNS record types for a name:

nslookup -type=any theitbros.com

However, an ANY query does not reliably return all DNS records for a domain/zone. The DNS server may return only a subset of records, info available in its cache, or a minimal response. Keep in mind that many modern authoritative DNS servers limit/refuse ANY queries.

To check a specific DNS record, query its type explicitly, for example:

nslookup -type=A theitbros.com
nslookup -type=TXT theitbros.com
nslookup -type=NS theitbros.com

In case you need to retrieve the complete contents of a DNS zone, a zone transfer such as AXFR is the DNS mechanism designed for that purpose. Zone transfers are normally restricted to authorized secondary DNS servers/explicitly allowed clients.

The debug option allows you to get additional info contained in the headers of client DNS requests and server responses (lifetime, flags, record types, etc.):

set debug

You can list the currently enabled nslookup options:

> set all

The set debug and set all commands are used in interactive mode. They change the settings of the current nslookup session. For a one-time debug query, you can use the -debug option directly from the command line:

nslookup -debug theitbros.com

Check a DKIM Record

DKIM public keys are published as TXT records under a selector-specific DNS name. You need to know the DKIM selector to query the correct record. For example, if the selector is selector1 and the domain is example.com, run the command:

nslookup -type=TXT selector1._domainkey.example.com

The DNS response should contain the DKIM public key, typically in a TXT record containing a value such as v=DKIM1; and a p= public key.

If you do not know the selector, you cannot reliably query a DKIM record using only the domain name. The selector is normally provided by the mail service or you can find it in the DKIM config for the sending domain.

Most Commonly Used Nslookup Commands with Examples

Reverse DNS lookup (get the DNS record by an IP address):

nslookup 8.8.8.8

Change the default timeout interval for a reply (note that timeout value is specified in seconds):

nslookup -timeout=20 theitbros.com

Using Resolve-DnsName Instead of Nslookup

On modern Windows builds, PowerShell includes the Resolve-DnsName cmdlet. It provides more detailed DNS query results than nslookup and is often preferred in automation scripts.

In order to resolve a hostname, use the following command:

Resolve-DnsName theitbros.com

Note that nslookup and Resolve-DnsName are useful for different DNS troubleshooting cases. nslookup queries the configured DNS server directly and does not use the Windows DNS client cache. It therefore does not reproduce the exact name-resolution path used by apps.

Windows apps normally use the Windows DNS Client resolver, which can use locally cached info and the Hosts file before sending a query to a DNS server.

For a DNS-only test that avoids LLMNR and NetBIOS fallback, use the following command:

Resolve-DnsName theitbros.com -DnsOnly

The -DnsOnly parameter forces the query to use DNS and prevents LLMNR and NetBIOS queries.

Unlike nslookup, Resolve-DnsName queries both A and AAAA records by default. In order to query only one record type, you need to specify the -Type parameter. For example:

Resolve-DnsName theitbros.com -Type A

or

Resolve-DnsName theitbros.com -Type AAAA

To query MX records, use the following command:

Resolve-DnsName theitbros.com -Type MX

To query TXT records, use the command:

Resolve-DnsName theitbros.com -Type TXT

To query Active Directory SRV records, use the command below:

Resolve-DnsName _ldap._tcp.dc._msdcs.contoso.com -Type SRV

In order to query Kerberos service records, use the following command:

Resolve-DnsName _kerberos._tcp.contoso.com -Type SRV

To query a specific DNS server:

Resolve-DnsName theitbros.com -Server 8.8.8.8

Unlike nslookup, Resolve-DnsName returns structured PowerShell objects, making it easier to filter, sort, and process DNS info in your scripts.

Here is an example:

Resolve-DnsName theitbros.com -Type MX |
Where-Object Type -eq 'MX' |
Select-Object NameExchange,Preference

This makes Resolve-DnsName a better choice for PowerShell automation, reporting, and troubleshooting tasks.

Query DNSSEC Records

For DNSSEC troubleshooting, Resolve-DnsName provides options that are not available in the basic nslookup examples. You can request DNSSEC-related records and ask the DNS server to include DNSSEC info in the response. Here are the examples:

Resolve-DnsName example.com -Type DNSKEY -DnssecOk
Resolve-DnsName example.com -Type DS -DnssecOk

Common Nslookup Errors

In this section, we list common errors that the nslookup tool may return:

• Request to server timed out / timed out — the DNS server did not respond within the configured timeout and retry period. You need to check DNS service availability, network connectivity, firewall rules, and the server’s listening config.
• Non-existent domain (NXDOMAIN) — the DNS server indicates that the queried name does not exist. You need to check that the hostname/domain is spelled correctly and that the record exists in the DNS zone. In AD environments, you should also check if the client is querying the correct DNS server and DNS suffix;
• No response from the server — DNS server doesn’t respond to nslookup query;
• No answer — the DNS server does not have a resource record of the requested type for the queried name, although the name itself may be valid;
• Server failure (SERVFAIL) — the DNS server could not successfully complete the query. Possible causes include DNS server problems, unavailable or misconfigured upstream DNS servers or forwarders, DNSSEC validation failures, or other DNS processing errors;
• Query refused — the DNS server refused to service the request. This can occur because of server policy, access restrictions, or other DNS server config.
• Default Server: UnKnown — nslookup could not resolve the name of the configured DNS server through a reverse DNS lookup. This issue commonly occurs when the DNS server’s IP address does not have a corresponding PTR record/reverse lookup zone is unavailable.

Wrapping up

The nslookup utility remains a useful Windows tool for querying DNS servers, checking DNS records, performing reverse lookups, and troubleshooting name resolution. For PowerShell automation and more detailed DNS diagnostics, you should use Resolve-DnsName because it provides structured output and additional query options.

Task	Command
Basic A record lookup	nslookup domain.com
Query specific DNS server	nslookup domain.com 8.8.8.8
Query record type	nslookup -type=mx domain.com
Query AD SRV records	nslookup -type=srv _ldap._tcp.domain.com
Reverse lookup	nslookup <IP-address>
Modern alternative (PowerShell)	Resolve-DnsName domain.com -Type MX