Nslookup is a useful tool for troubleshooting DNS problems, such as host name resolution. When you start Nslookup, it shows the host name and IP address of the DNS server that is configured for the local system, and then display a command prompt for further queries. If you type a question mark ( ? ), Nslookup shows all available commands. You can exit the program by typing exit .

To look up a host's IP address using DNS, type the host name and press Enter. Nslookup defaults to using the DNS server configured for the computer on which it is running, but you can focus it on a different DNS server by typing server < name> (where < name> is the host name of the server you want to use for future lookups). Once another server is specified, anything entered after that point is interpreted as a host name.

Nslookup employs the domain name devolution method. If you type in a host name and press ENTER, Nslookup appends the domain suffix of the computer (such as cswatcp.reskit.com) to the host name before querying the DNS. If the name is not found, then the domain suffix is "devolved" by one level (in this case to reskit.com) and the query is repeated. Windows 2000 computers only devolve names to the second level domain (reskit.com in this example), so if this query fails, no further attempts are made to resolve the name. If a fully qualified domain name is typed in (as indicated by a trailing dot) then the DNS server is only queried for that name and no devolution is performed. To look up a host name that is completely outside your domain, you must type in a fully qualified domain name.

Nslookup's debug mode is a useful troubleshooting feature; you can set the local computer into this mode by typing set debug , or for even greater detail, set d2 . In debug mode, Nslookup lists the steps being taken to complete its commands, as shown in this example:


(null) testpc1.reskit.com


> set d2

> rain-city

(null) testpc1.reskit.com



SendRequest(), len 49


opcode = QUERY, id = 2, rcode = NOERROR

header flags: query, want recursion

questions = 1, answers = 0, authority records = 0, additional = 0


rain-city.reskit.com, type = A, class = IN



Got answer (108 bytes):


opcode = QUERY, id = 2, rcode = NOERROR

header flags: response, auth. answer, want recursion, recursion avail.

questions = 1, answers = 2, authority records = 0, additional = 0


rain-city.reskit.com, type = A, class = IN


-> rain-city.reskit.com

type = CNAME, class = IN, dlen = 31

canonical name = seattle.reskit.com

ttl = 86400 (1 day)

-> seattle.reskit.com

type = A, class = IN, dlen = 4

internet address =

ttl = 86400 (1 day)


(null) seattle.reskit.com


Aliases: rain-city.reskit.com

In this example, the user issued the set d2 command to set Nslookup to debug mode, then the user tried a simple address lookup for the host name "rain-city." The first two lines of output show the host name and IP address of the DNS server where the lookup was sent. As the next paragraph shows, the domain suffix of the local computer (reskit.com) was appended to the name "rain-city," and Nslookup submitted this question to the DNS server.

The next paragraph in the example indicates that Nslookup received an answer from the DNS server. The DNS server provided two answer records in response to one question. The question is repeated in the response, along with the two answer records. In this case, the first answer record indicates that the name "rain-city.reskit.com" is actually a cname , or canonical name (alias) for the host name "seattle.reskit.com." The second answer record lists the IP address for that host as

Table 3.8 summarizes all Nslookup switches. Identifiers are shown in upper case, and optional commands are shown in brackets.

Table 3.8 Nslookup Switches




Launches the nslookup program.

set debug

Launches debug mode from within nslookup.

set d2

Launches verbose debug mode from within nslookup.

host name

Returns the IP address for the specified host name.


Displays information about the host/domain NAME using default server


As above, but uses NAME2 as server

help or ?

Displays information about common commands


Sets an option


Displays options, current server and host.


Displays debugging information.


Appends domain name to each query.


Asks for recursive answer to query.


Uses domain search list.


Always uses a virtual circuit.


Sets default domain name to NAME.


Sets domain to N1 and search list to N1,N2, and so on.

root =NAME

Sets root server to NAME.


Sets number of retries to X.


Sets initial timeout interval to X seconds.


Sets query type (such as A, ANY, CNAME, MX, NS, PTR, SOA, SRV).


Same as type.


Sets query class (ex. IN (Internet), ANY).


Uses MS fast zone transfer.


Current version to use in IXFR transfer request.

Server NAME

Sets default server to NAME, using current default server.

Lserver NAME

Sets default server to NAME, using initial server.

Finger [USER

Fingers the optional NAME at the current default host.


Sets current default server to the root.

ls [opt] DOMAIN [> FILE]

Lists addresses in DOMAIN (optional: output to FILE).


Lists canonical names and aliases.


Lists all records.


Lists records of the given type (For example, A, CNAME, MX, NS, PTR and so on).


Sorts the output file from the 'ls' option described earlier and displays it page by page.


Exits Nslookup and returns to the command prompt.