Guides · DNS · Updated

DNS lookup from the command line: nslookup, dig and PowerShell

Windows has nslookup and PowerShell's Resolve-DnsName. Linux and macOS have dig, host and nslookup. All of them send the same DNS question; they differ in how much of the answer they show.

Prefer a browser?

Query public resolvers around the world and compare their answers:

Look up an address (A and AAAA)

# Any system
nslookup example.com

# Linux and macOS
dig example.com A
dig example.com AAAA +short
host example.com

# Windows PowerShell
Resolve-DnsName example.com

+short prints only the answer. Without it, dig shows the full response, including the TTL.

Look up a record type

nslookup -type=MX example.com
dig example.com MX +short
dig example.com TXT +short
Resolve-DnsName example.com -Type TXT

The types are explained in DNS record types. For reverse lookups of an address, see reverse DNS lookup.

Ask a specific DNS server

By default you query the resolver your computer is configured to use. Name another server to bypass it:

nslookup example.com 1.1.1.1
dig @1.1.1.1 example.com
Resolve-DnsName example.com -Server 1.1.1.1

To ask a domain's own nameserver and skip every cache, first find it with the NS lookup, then query it directly: dig @ns1.example.net example.com A. This is how you confirm a change was saved, as described in how long DNS propagation takes.

Reading dig output

$ dig example.com A

;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 4242
;; ANSWER SECTION:
example.com.    3600    IN    A    203.0.113.10
  • status: NOERROR: the query worked. An empty answer section then means the name exists but has no record of that type.
  • status: NXDOMAIN: the name doesn't exist.
  • status: SERVFAIL: the server could not get an answer, often a broken or unreachable nameserver.
  • In the answer line the columns are name, TTL in seconds, class, type and value.

Trace a lookup from the root

dig example.com +trace

This walks the chain itself: root servers, the top-level domain, then the domain's nameservers. It shows exactly where a delegation goes wrong. The idea is explained in what is DNS.

If the result looks stale

Your computer may be answering from its own cache. Flush the DNS cache, or query another server as shown above.

Frequently asked questions

What is the DNS lookup command in Windows?

nslookup, for example nslookup example.com. In PowerShell, Resolve-DnsName example.com does the same and returns objects you can filter. dig is not installed by default on Windows.

How do I look up a specific record type?

With nslookup use -type=, as in nslookup -type=MX example.com. With dig put the type after the name: dig example.com MX. With PowerShell use -Type MX.

How do I ask a particular DNS server?

Add its address: nslookup example.com 1.1.1.1, dig @1.1.1.1 example.com, or Resolve-DnsName example.com -Server 1.1.1.1. This bypasses the resolver your computer normally uses.

What does NXDOMAIN mean?

The name does not exist at all. It is different from NOERROR with an empty answer, which means the name exists but has no record of the type you asked for.