Nslookup

The Nslookup command allows you to displays information that you can use to diagnose Domain Name System (DNS) infrastructure. One thing you should note, before using this tool, you should be familiar with how DNS works. The Nslookup command-line tool is available only if you have installed the TCP/IP protocol.

Syntax (view syntax formatting guide):

Nslookup [<-SubCommand ...>] [{<ComputerToFind> | -<Server>}]
Nslookup /exit
Nslookup /finger [<UserName>] [{[>] <FileName>|[>>] <FileName>}]
Nslookup /{help | ?}
Nslookup /ls [<Option>] <DNSDomain> [{[>] <FileName>|[>>] <FileName>}]
Nslookup /lserver <DNSDomain>
Nslookup /root
Nslookup /server <DNSDomain>
Nslookup /set <KeyWord>[=<Value>]
Nslookup /set all
Nslookup /set class=<Class>
Nslookup /set [no]d2
Nslookup /set [no]debug
Nslookup /set [no]defname
Nslookup /set domain=<DomainName>
Nslookup /set [no]ignore
Nslookup /set port=<Port>
Nslookup /set querytype=<ResourceRecordType>
Nslookup /set [no]recurse
Nslookup /set retry=<Number>
Nslookup /set root=<RootServer>
Nslookup /set [no]search
Nslookup /set srchlist=<DomainName>[/...]
Nslookup /set timeout=<Number>
Nslookup /set type=<ResourceRecordType>
Nslookup /set [no]vc
Nslookup /view <FileName>

Syntax Explanation

  • Nslookup /exit: Exits nslookup.
  • Nslookup /finger: Connects with the finger server on the current computer.
  • Nslookup /help: Displays a short summary of nslookup subcommands.
  • Nslookup /ls: Lists information for a DNS domain.
  • Nslookup /lserver: Changes the default server to the specified DNS domain.
  • Nslookup /root: Changes the default server to the server for the root of the DNS domain name space.
  • Nslookup /server: Changes the default server to the specified DNS domain.
  • Nslookup /set: Changes configuration settings that affect how lookups function.
  • Nslookup /set all: Prints the current values of the configuration settings.
  • Nslookup /set class: Changes the query class. The class specifies the protocol group of the information.
  • Nslookup /set d2: Turns exhaustive Debugging Mode on or off. All fields of every packet are printed.
  • Nslookup /set debug: Turns Debugging Mode on or off.
  • Nslookup /set defname: Appends the default DNS domain name to a single component lookup request. A single component is a component that contains no periods.
  • Nslookup /set domain: Changes the default DNS domain name to the name specified.
  • Nslookup /set ignore: Ignores packet truncation errors.
  • Nslookup /set port: Changes the default TCP/UDP DNS name server port to the value specified.
  • Nslookup /set querytype: Changes the resource record type for the query.
  • Nslookup /set recurse: Tells the DNS name server to query other servers if it does not have the information.
  • Nslookup /set retry: Sets the number of retries.
  • Nslookup /set root: Changes the name of the root server used for queries.
  • Nslookup /set search: Appends the DNS domain names in the DNS domain search list to the request until an answer is received. This applies when the set and the lookup request contain at least one period, but do not end with a trailing period.
  • Nslookup /set srchlist: Changes the default DNS domain name and search list.
  • Nslookup /set timeout: Changes the initial number of seconds to wait for a reply to a request.
  • Nslookup /set type: Changes the resource record type for the query.
  • Nslookup /set vc: Specifies to use or not use a virtual circuit when sending requests to the server.
  • Nslookup /view: Sorts and lists the output of the previous ls subcommand or commands.

Explanation with Examples

If ComputerToFind is an IP address and the query is for an A or PTR resource record type, the name of the computer is returned. If ComputerToFind is a name and does not have a trailing period, the default DNS domain name is appended to the name. This behavior depends on the state of the following set subcommands: domain, srchlist, defname, and search.

 

If you type a hyphen (-) instead of ComputerToFind, the command prompt changes to nslookup interactive mode.

 

The command-line length must be less than 256 characters.

Nslookup has two modes: interactive and noninteractive. 
If you need to look up only a single piece of data, use noninteractive mode. For the first parameter, type the name or IP address of the computer that you want to look up. For the second parameter, type the name or IP address of a DNS name server. If you omit the second argument, nslookup uses the default DNS name server.
If you need to look up more than one piece of data, you can use interactive mode. Type a hyphen (-) for the first parameter and the name or IP address of a DNS name server for the second parameter. Or, omit both parameters and nslookup uses the default DNS name server. Following are some tips about working in interactive mode:

To interrupt interactive commands at any time, press CTRL+B.

To exit, type exit.

To treat a built-in command as a computer name, precede it with the escape character ().

An unrecognized command is interpreted as a computer name.

Examples

Each command-line option consists of a hyphen (-) followed immediately by the command name and, in some cases, an equal sign (=) and then a value.

To change the default query type to host (computer) information and the initial time-out to 10 seconds:

nslookup -querytype=hinfo -timeout=10