nslookup | The Concise Guide to DNS and BIND

nslookup is Dig's older cousin, and in fact, Dig shares a lot of source code with nslookup. The general command-line syntax is as follows:

 nslookup [-option ...] [host-to-find | -[server]]

nslookup has two main modes of operation, interactive and command line:

 $ nslookup -query=any www.penguin.bv Server:  localhost Address:  127.0.0.1 www.penguin.bv  CPU = PC        OS = Tunes www.penguin.bv  preference = 10, mail exchanger = mail.penguin.bv www.penguin.bv  preference = 20, mail exchanger = mail.herring.bv www.penguin.bv  internet address = 192.168.55.3 penguin.bv      nameserver = ns.penguin.bv penguin.bv      nameserver = ns.herring.bv mail.penguin.bv internet address = 192.168.55.2 ns.penguin.bv   internet address = 192.168.55.2

The interactive mode is perhaps a bit more interesting when you explore a DNS problem, because it lends itself to the exploration of DNS. Dig is better for this, but sometimes it's not available, so you must use nslookup. Whether or not you have Dig depends on whether you have a new or old BIND installed on your machine. Windows can also be a factor nslookup is provided with it, but Dig is not. Here is how the interactive mode is used:

 $ nslookup Default Server:  [127.0.0.1] Address:  127.0.0.1 > set norecurse

The things you can set in nslookup are identical to the query options in Dig because Dig borrowed this code from nslookup. The following repeats the process of finding the address www.amazon.com:

 > www.amazon.com. Server:  [127.0.0.1] Address:  127.0.0.1 Name:    http://www.amazon.com Served by: - I.ROOT-SERVERS.NET           192.36.148.17 - E.ROOT-SERVERS.NET           192.203.230.10 - D.ROOT-SERVERS.NET           128.8.10.90 - A.ROOT-SERVERS.NET           198.41.0.4 - H.ROOT-SERVERS.NET           128.63.2.53 - C.ROOT-SERVERS.NET           192.33.4.12 - G.ROOT-SERVERS.NET           192.112.36.4 - F.ROOT-SERVERS.NET           192.5.5.241 - B.ROOT-SERVERS.NET           128.9.0.107 - J.ROOT-SERVERS.NET           198.41.0.10 > server i.root-servers.net. Default Server:  i.root-servers.net Address:  192.36.148.17

In the following, the server is changed to one of the ones listed in the answer instead. This server will be used until the next server command is issued:

 > www.amazon.com. Server:  i.root-servers.net Address:  192.36.148.17 Name:    www.amazon.com Served by: - AUTH00.NS.UU.NET           198.6.1.65           AMAZON.com - NS2.PNAP.NET           206.253.194.97           AMAZON.com - NS1.PNAP.NET           206.253.194.65           AMAZON.com - NS-1.AMAZON.com           209.191.164.20           AMAZON.com > server NS2.PNAP.NET. Default Server:  NS2.PNAP.NET Address:  206.253.194.97 > www.amazon.com. Server:  NS2.PNAP.NET Address:  206.253.194.97 Non-authoritative answer: Name:    www.amazon.com Address:  208.216.181.15 > exit

Interestingly, ns.pnap.net returns a non-authoritative answer even though it was listed as an authoritative nameserver for the zone. This is not unheard of; in fact, it happens way too often. The technical term for ns.pnap.net is lame server; it should be authoritative for amazon.com but is not. In this case, at least you got an answer sometimes the server will not be willing to provide an answer. If your resolver comes upon one of these, it will log it. In extreme cases, this will be logged:

 query(********************.in-addr.arpa) All possible A RR's lame

This means that the domain is delegated but that no (authoritative) answers can be found. I've disguised the name to protect the guilty.

nslookup also has a useful help command. Additionally, other than the server command, the most interesting command is probably the following, which changes the query type:

 set query=<query-type>

Another command available in nslookup is the lserver command. One problem with nslookup is that if you use the server command to set a server that is not responding to queries, you will be unable to use the server command again because it needs to resolve the name you give it. lserver is useful for getting out of that particular corner. It queries the initial, local nameserver to resolve the server name you provide.