Insights
What nslookup means and how to read its results
nslookup means name server lookup. Learn how to query DNS records, select a resolver and read answers without overstating what they prove.
On this page
nslookup means name server lookupOpens in a new tab. It's a command-line tool that asks a Domain Name System (DNS) server for records, such as the Internet Protocol (IP) address linked to a domain name. You use it to check DNS answers, not to prove a website works.
In short:
- Name lookup. nslookup asks a DNS server for information about a name or IP address.
- Server selection. It uses its default DNS server unless you specify another server.
- Limited proof. A returned address confirms a DNS answer, not a working website connection.
What the command asks DNS to do
Give nslookup a domain name, such as example.com, and it asks a DNS server for information about that name. A DNS server that answers lookup requests is often called a resolver. An address record maps a name to an IP address.
Microsoft documents nslookupOpens in a new tab as a tool for diagnosing DNS infrastructure. It helps you check which server answered and what information it returned. Connecting to the website is a separate task.
Try a basic lookup
These are documentation-based examples for Windows Command Prompt. Use a device and network you're allowed to troubleshoot. These commands don't edit your device settings, so they don't need rollback.
1. Ask about a domain name.
nslookup example.com
With no server argument, nslookup uses its default DNS server. Look for the server details first, then the answer or a response message. A returned address shows that the queried server supplied an address record.
2. Ask specifically for an IPv4 address.
nslookup -type=A example.com
An A record holds an Internet Protocol version 4 (IPv4) addressOpens in a new tab. On a successful lookup, the answer contains an address of that type.
3. Ask specifically for an IPv6 address.
nslookup -type=AAAA example.com
An AAAA record holds an Internet Protocol version 6 (IPv6) address. An A result doesn't establish that the name also has an AAAA record.
4. Select a DNS server for this lookup.
nslookup -type=A example.com 1.1.1.1
The final argument selects the DNS server for this command. Check the server address line for 1.1.1.1, which identifies the selected server. If another address appears, check the command you entered before interpreting the answer.
Running nslookup alone opens an interactive prompt, which suits several queries or changes within one session. Enter exit to leave it. nslookup is also available on Linux and macOSOpens in a new tab, where you use Terminal. The core task is similar, but syntax, output and name-resolution behavior can differ by implementation.
Read the server and answer lines
The output separates the DNS server that provides the answer from the answer itselfOpens in a new tab. The server's address identifies where the query went. The address below the answer's name belongs to the returned DNS record.
This is schematic output with placeholders, not a live lookup result:
Server: <DNS server name>
Address: <DNS server IP address>
Non-authoritative answer:
Name: <returned name>
Address: <returned IP address>
Use these fields to separate the resolver from the name you looked up.
| Output field | What it means |
|---|---|
Server | Name of the DNS server used |
First Address | IP address of that DNS server |
Non-authoritative answer | Answer from a server not authoritative for the domain |
Name | Name associated with the returned answer |
Answer Address or Addresses | Returned IP address or addresses |
Alias or CNAME, if shown | An alias associated with the name |
An authoritative server is responsible for DNS data for the domain. A non-authoritative answer isn't an error or an educated guess. It's useful for checking what that resolver returns.
Other record types you may encounter include MX, NS, CNAME and PTR. A CNAME indicates an alias, while PTR is used for reverse lookups. With an IP address as input, nslookup can ask for a name linked to that address. A returned name doesn't prove ownership, legitimacy or safety.
Understand common response messages
A response message tells you what happened to that query, not everything about the domain. Check the spelling and requested record type before comparing the same query through another allowed resolver.
Read these messages narrowly before choosing your next check.
| Response message | Narrow meaning | Next check |
|---|---|---|
| Timed out | No reply within the wait and retry limits | Check the query, then compare an allowed resolver |
Nonexistent domain or NXDOMAIN | Queried server reports that the name doesn't exist | Check the exact name and spelling |
| No records | Valid name, but no records of the requested type | Check whether you requested A or AAAA |
Server failure or SERVFAILOpens in a new tab | DNS server encountered an error | Compare the same query through an allowed resolver |
| Refused | Queried server declined the request | Check whether that server permits your query |
A timeout doesn't prove the domain is nonexistent, the server is down or a firewall caused the failure. “No records” concerns the requested type, not every possible record for that name. A server failure reports an error, but it doesn't identify a database fault as the only possible cause.
Check which lookup you actually tested
Record the exact name, record type and selected server before drawing conclusions. To compare resolvers, keep the name and type unchanged. For example, compare these A queries, not an A answer with an AAAA answer:
nslookup -type=A example.com
nslookup -type=A example.com 1.1.1.1
The first query uses nslookup's default server, while the second selects 1.1.1.1. Follow your network's rules when selecting a resolver. These one-shot commands leave device settings unchanged.
Matching answers show agreement for those queries, not that every resolver has the same data. Different answers show a difference, not its cause. They don't by themselves prove propagation delay, a broken resolver or DNS hijacking.
A successful lookup doesn't prove your browser used the same resolver or lookup path. It also doesn't prove that every DNS path is encrypted, that a website's certificate is valid or that a website connection succeeds. Use nslookup to check DNS answers, then keep any browser or connection checks separate.