nslookup command

Last Edited



Definition of nslookup command in The Network Encyclopedia.

What is nslookup command?

Nslookup is a TCP/IP utility on Microsoft Windows operating systems for diagnosing problems with name servers at the command prompt. Nslookup is installed on a computer running Windows NT or Windows 2000 when you install the TCP/IP protocol on the machine. You can use nslookup to manually display resource records in the zone files of DNS servers. The utility can operate in either an interactive or a non-interactive mode.

nslookup command
nslookup command

You enter interactive mode by typing nslookup at the command prompt. Once in the interactive running state, you can type ls -d microsoft.com to list all the resource records for the microsoft.com domain that are stored in the DNS database of the name server being queried.


 SubCommand … : Specifies one or more nslookup subcommands as a command-line option. For a list of subcommands, see Related Topics.

ComputerToFind : Looks up information for ComputerToFind using the current default DNS name server, if no other server is specified. To look up a computer not in the current DNS domain, append a period to the name.

 Server : Specifies to use this server as the DNS name server. If you omit -Server, the default DNS name server is used.

{ help | ? } : Displays a short summary of nslookup subcommands.


  • If ComputerToFind is an IP address and the query is for an A or PTR resource record type, the name of the computer is returned. If ComputerToFind is a name and does not have a trailing period, the default DNS domain name is appended to the name. This behavior depends on the state of the following set subcommands: domainsrchlistdefname, and search.
  • If you type a hyphen (-) instead of ComputerToFind, the command prompt changes to nslookup interactive mode.
  • The command-line length must be less than 256 characters.
  • Nslookup has two modes: interactive and noninteractive.If you need to look up only a single piece of data, use noninteractive mode. For the first parameter, type the name or IP address of the computer that you want to look up. For the second parameter, type the name or IP address of a DNS name server. If you omit the second argument, nslookup uses the default DNS name server.If you need to look up more than one piece of data, you can use interactive mode. Type a hyphen (-) for the first parameter and the name or IP address of a DNS name server for the second parameter. Or, omit both parameters and nslookup uses the default DNS name server. Following are some tips about working in interactive mode:
    • To interrupt interactive commands at any time, press CTRL+B.
    • To exit, type exit.
    • To treat a built-in command as a computer name, precede it with the escape character (\).
    • An unrecognized command is interpreted as a computer name.
  • If the lookup request fails, nslookup prints an error message. The following table lists possible error messages.
Error messageDescription
Timed outThe server did not respond to a request after a certain amount of time and a certain number of retries. You can set the time-out period with the set timeout subcommand. You can set the number of retries with the set retry subcommand.
No response from serverNo DNS name server is running on the server computer.
No recordsThe DNS name server does not have resource records of the current query type for the computer, although the computer name is valid. The query type is specified with the set querytype command.
Nonexistent domainThe computer or DNS domain name does not exist.
Connection refused-or-Network is unreachableThe connection to the DNS name server or finger server could not be made. This error commonly occurs with ls and finger requests.
Server failureThe DNS name server found an internal inconsistency in its database and could not return a valid answer.
RefusedThe DNS name server refused to service the request.
Format errorThe DNS name server found that the request packet was not in the proper format. It may indicate an error in nslookup.


Each command-line option consists of a hyphen (-) followed immediately by the command name and, in some cases, an equal sign (=) and then a value. For example, to change the default query type to host (computer) information and the initial time-out to 10 seconds, type:

nslookup -querytype=hinfo -timeout=10