Verified June 2026 · nslookup, dig & Resolve-DnsName on Windows 11/10, macOS & Linux
Quick Reference: Essential Commands
# Look up a domain's IP (A / AAAA records)
nslookup example.com
# Query a specific record type
nslookup -type=MX example.com
nslookup -type=TXT example.com
# Reverse lookup (IP -> hostname)
nslookup 8.8.8.8
# Ask a specific DNS server
nslookup example.com 1.1.1.1
Which command should you use?
- Windows (built in) →
nslookup - Windows PowerShell / scripting →
Resolve-DnsName - macOS / Linux →
dig
Jump to the section you need below, or run a live lookup in the tool above.
nslookup: The Cross-Platform Classic
nslookup (name server lookup) ships with Windows, macOS, and Linux. It's the quickest way to answer "what does DNS say about this name?"
WindowsmacOSLinuxBuilt in — no install
nslookup Syntax Reference
| Command | What it does |
|---|---|
nslookup example.com | Forward lookup (A / AAAA) |
nslookup -type=MX example.com | Mail server (MX) records |
nslookup -type=TXT example.com | TXT records (SPF, DKIM, verification) |
nslookup -type=NS example.com | Authoritative name servers |
nslookup -type=SOA example.com | Start of Authority record |
nslookup -type=CNAME www.example.com | Canonical name (alias) |
nslookup 8.8.8.8 | Reverse lookup (PTR) |
nslookup example.com 1.1.1.1 | Query a specific DNS server |
Interactive Mode
Running nslookup with no arguments opens interactive mode, handy for several lookups in a row:
nslookup
> set type=MX
> example.com
> set type=A
> example.org
> server 8.8.8.8
> example.net
> exit
Tip: Add the DNS server as a second argument (
nslookup example.com 1.1.1.1) to bypass your local resolver. It's the fastest way to check whether a DNS change has propagated to a public resolver yet.
Resolve-DnsName: The PowerShell Way
On Windows, Resolve-DnsName returns structured objects you can filter, sort, and script — far nicer than parsing nslookup text.
Windows 10Windows 11Server 2012+Built in — no module
# Basic lookup
Resolve-DnsName example.com
# Specific record type
Resolve-DnsName example.com -Type MX
Resolve-DnsName example.com -Type TXT
# Reverse lookup
Resolve-DnsName 8.8.8.8
# Query a specific server and bypass the cache
Resolve-DnsName example.com -Server 1.1.1.1 -DnsOnly
# Just the IP addresses, scripting-friendly
(Resolve-DnsName example.com -Type A).IPAddress
dig: The Modern Standard on macOS & Linux
dig (Domain Information Groper) is the preferred tool on Unix-like systems — more detailed and more scriptable than nslookup.
macOSLinux⚠ Install on Windows (BIND tools)
# Clean answer only
dig example.com +short
dig example.com MX +short
# Full record with the answer section only
dig example.com ANY +noall +answer
# Reverse lookup
dig -x 8.8.8.8
# Query a specific server
dig @1.1.1.1 example.com
# Trace the full resolution path from the root servers
dig example.com +trace
Common DNS Record Types
| Type | Purpose |
|---|---|
A | Maps a name to an IPv4 address |
AAAA | Maps a name to an IPv6 address |
CNAME | Alias pointing one name at another |
MX | Mail servers and their priority |
TXT | Free-form text — SPF, DKIM, domain verification |
NS | Authoritative name servers for the zone |
SOA | Zone authority and serial/refresh timers |
PTR | Reverse mapping (IP -> hostname) |
SRV | Service location (host + port) |
CAA | Which certificate authorities may issue certs |
Troubleshooting: Common nslookup Messages
Each row is deep-linkable — share a specific message with …#dns-nxdomain, and the row highlights on arrival.
| Message | Meaning | Fix |
|---|---|---|
Non-existent domain | No record exists (NXDOMAIN) | Check spelling, confirm the domain is registered, try another record type or server |
DNS request timed out | The DNS server didn't respond | Check connectivity; try a public resolver: nslookup example.com 1.1.1.1 |
Default Server: UnKnown | Your resolver has no reverse (PTR) record | Cosmetic — ignore it, or specify a server explicitly |
No response from server | The queried server isn't answering on port 53 | Verify the server IP and that a firewall isn't blocking DNS |
Query refused | The server won't answer your query (REFUSED) | You may not be authorized to query that resolver — use your own or a public one |
Server failed | The resolver hit an error (SERVFAIL) | Often a DNSSEC or upstream issue — try another resolver or dig +trace |
Checking DNS Propagation
After changing a DNS record, query several public resolvers to see whether the change has spread:
nslookup example.com 1.1.1.1 # Cloudflare
nslookup example.com 8.8.8.8 # Google
nslookup example.com 9.9.9.9 # Quad9
If the resolvers disagree, the change is still propagating — DNS caches honor the record's TTL, so allow up to the TTL value (often 300–3600 seconds) before expecting consistency everywhere.
nslookup vs dig vs Resolve-DnsName
| Tool | Platform | Best for |
|---|---|---|
| nslookup | Windows, macOS, Linux | Quick checks anywhere; universally available |
| Resolve-DnsName | Windows | Scripting — returns objects, not text |
| dig | macOS, Linux (installable on Windows) | Detailed diagnostics, +trace, clean scripting |






