What is Nslookup?

Nslookup is a command that is short for “name server lookup.” It uses domain name service, or DNS, entries to resolve device names to IP addresses and vice versa. Nslookup will query local DNS records first, and then it will query the DNS server set for the device if it cannot find the results locally. Nslookup is a valuable tool for troubleshooting DNS and networking issues.

How Does Nslookup Work?
Nslookup is an old technology, but it is still actively used by modern operating systems. It is used through the command line by entering the command “nslookup.” Once the command is entered, an IP address or device name can then be entered. It will then query either local DNS records or the device’s DNS server and resolve the IP address to a name or vice versa.

The typical output from the nslookup command will look like this:

>10.99.1.122
Server: dns1.mynetwork.local
Address: 10.99.1.12

Name: pc1.mynetwork.local
Address: 10.99.1.122
>

The first line is the IP address that was entered to be looked up. The second line shows the fully qualified domain name of the DNS server that was used to resolve the IP address. The third line is the address of the DNS server used. The fourth entry is the name of the device being looked up, and the final line is the IP address of the device being looked up.

Nslookup returns results for both device names and IP addresses in the same manner, and the output looks the same for both types of queries.

Nslookup can also be used to resolve Internet domain names. The output from an Internet domain name query will look like this:

> google.com
Server: dns1.mynetwork.local
Address: 10.99.1.12
Non-authoritative answer:
Name: google.com
Addresses: 74.125.65.106, 74.125.65.105, 74.125.65.104, 74.125.65.99

When querying Internet domain sites outside of your domain, the results received will typically be marked as non-authoritative. This means that the DNS server that performed the query does not have authority over the domain name that it queried. This is a normal response for Internet domain name look ups.

For domain names outside the local domain, nslookup will often list several IP addresses. These are different IP addresses that can be used to reach the same destination.

NSlookup Troubleshooting Usage

Nslookup can be a very valuable tool for troubleshooting DNS issues. By using nslookup, it can be determined if the DNS server can locate a designated device, and it can be determined if the DNS server is returning the correct DNS information for that device. This tool can also be used to ensure that DNS caching is operating correctly.

If an nslookup command entry returns a blank result, it can be assumed that the device is not communicating with the DNS server properly. If it returns incorrect results, then it can often be assumed that there is an issue with the DNS cache on that device. This type of issue is usually corrected by flushing the local DNS cache. If the cache is flushed and the device returns faulty information again, it can then be assumed the issue is with the DNS server itself.