DNS lookup tools: nslookup, dig, host, Resolve-DnsName
When ping example.com says it cannot find the host, these tools tell you why. nslookup is on every platform; dig is the tool professionals reach for on Unix; Resolve-DnsName is the PowerShell way.
Which one
| Tool | Platforms | Best for |
|---|---|---|
nslookup | Windows (built in), macOS, Linux (bind-utils / dnsutils) | Quick checks anywhere; the only option on a bare Windows install |
dig | macOS (built in), Linux (bind-utils / dnsutils), Windows via BIND tools or WSL | Detailed output, scripting with +short, DNSSEC, tracing |
host | macOS, Linux (same package as dig) | Terse human-readable answers |
Resolve-DnsName | Windows PowerShell 3+ | Objects for scripts; honours Windows DNS settings including DoH |
resolvectl query | Linux with systemd-resolved | Resolves exactly as the system would, including split DNS and mDNS |
dscacheutil -q host | macOS | Resolves via the system resolver including hosts file, mDNS and scoped resolvers |
getent hosts | Linux | Resolves via nsswitch (hosts file, mDNS, DNS) as applications do |
nslookup
nslookup example.com # A record via the default server
nslookup example.com 1.1.1.1 # via a specific server
nslookup -type=AAAA example.com # IPv6
nslookup -type=MX example.com # mail servers
nslookup -type=TXT example.com # SPF, verification records
nslookup -type=NS example.com # authoritative name servers
nslookup -type=SOA example.com
nslookup -type=CNAME www.example.com
nslookup -type=SRV _sip._tcp.example.com
nslookup -type=ANY example.com # many servers refuse ANY now
nslookup 93.184.215.14 # reverse lookup (PTR)
nslookup -debug example.com # full packet details
nslookup -port=5353 example.com 127.0.0.1
nslookup -timeout=2 -retry=1 example.comC:\>nslookup example.com
Server: UnKnown
Address: 192.168.1.1
Non-authoritative answer:
Name: example.com
Addresses: 2606:2800:21f:cb07:6820:80da:af6b:8b2c
93.184.215.14- Server / Address
- The resolver that answered. UnKnown just means the resolver's IP has no reverse-DNS name; it is not an error. If this is not the server you expect, your DNS settings are not what you think. Verify →
- Non-authoritative answer
- The answer came from the resolver's cache rather than the domain's own name servers. Normal. It does not mean the answer is wrong.
- *** UnKnown can't find example.com: Non-existent domain
- NXDOMAIN: the name does not exist (typo, expired domain, or a blocking resolver returning NXDOMAIN).
- *** Request to UnKnown timed-out
- No reply from the resolver at all. Network problem or the resolver is down. Try another:
nslookup example.com 1.1.1.1. - *** UnKnown can't find example.com: Server failed
- SERVFAIL: the resolver tried and could not get an answer, often a DNSSEC validation failure or a broken authoritative server.
- *** UnKnown can't find example.com: Query refused
- REFUSED: the server will not answer for you, typically an authoritative server that is not a recursive resolver, or an access control list.
Interactive mode
Run nslookup alone and you get a > prompt where settings persist between queries:
> server 8.8.8.8
Default Server: dns.google
Address: 8.8.8.8
> set type=MX
> example.com
...
> set type=A
> set debug
> exitOn Windows, nslookup will first try a reverse lookup of the resolver's address and prints Default Server: UnKnown if that fails; you can ignore it. It also queries only the first configured DNS server, unlike the Windows resolver itself, so it can disagree with what applications see.
dig
dig example.com # A record, full output
dig example.com AAAA
dig example.com MX
dig example.com TXT
dig example.com NS
dig example.com SOA
dig example.com ANY # often refused or minimised
dig @1.1.1.1 example.com # ask a specific server
dig +short example.com # just the answer
dig +short example.com MX
dig -x 93.184.215.14 # reverse lookup
dig -x 2606:4700:4700::1111
dig +trace example.com # follow delegation from the root servers down
dig +dnssec example.com # request DNSSEC records; look for the 'ad' flag
dig +norecurse @a.iana-servers.net example.com # ask an authoritative server directly
dig +tcp example.com # force TCP
dig +noall +answer example.com # only the answer section
dig +noall +answer +ttlunits example.com
dig +time=2 +tries=1 example.com # fail fast
dig -p 5353 @127.0.0.1 example.com # non-standard port
dig +https @cloudflare-dns.com example.com # DNS over HTTPS (BIND 9.18+)
dig +tls @1.1.1.1 example.com # DNS over TLS (BIND 9.18+)
dig example.com A example.org A # multiple queries
dig -f names.txt # batch from a file
dig CH TXT id.server @1.1.1.1 # which resolver node you hit
dig +short myip.opendns.com @resolver1.opendns.com # your public IP; <<>> DiG 9.18.28 <<>> example.com
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 41263
;; flags: qr rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 1
;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 1232
;; QUESTION SECTION:
;example.com. IN A
;; ANSWER SECTION:
example.com. 2957 IN A 93.184.215.14
;; Query time: 11 msec
;; SERVER: 192.168.1.1#53(192.168.1.1) (UDP)
;; WHEN: Fri Sep 18 10:22:41 BST 2026
;; MSG SIZE rcvd: 56- status: NOERROR / NXDOMAIN / SERVFAIL / REFUSED
- The response code. NOERROR with an empty ANSWER section means the name exists but has no record of that type (NODATA), for example asking for AAAA on an IPv4-only host.
- flags: qr rd ra (ad) (aa)
- qr response, rd recursion desired, ra recursion available (the server is a resolver), aa authoritative answer (you asked the domain's own server), ad authenticated data (DNSSEC validated by the resolver), tc truncated (retry with +tcp).
- ANSWER SECTION: example.com. 2957 IN A 93.184.215.14
- Name, TTL remaining in seconds, class, type, value. A TTL that is much lower than the record's configured TTL tells you the answer came from cache; a fresh lookup from the authoritative server shows the full TTL. A chain of CNAMEs shows as several lines.
- Query time / SERVER
- How long it took and which server answered. Milliseconds are normal on a LAN; hundreds of milliseconds suggest a resolver that had to recurse, or a slow path.
+trace: where a name breaks
dig +trace starts at the root servers and follows the delegation: root → .com servers → example.com's servers → the answer. If a domain "does not resolve", the trace shows which step fails: no NS records at the registry (domain expired or not delegated), name servers that do not respond (hosting problem), or name servers that answer but have no record (the zone is missing the entry). It bypasses your resolver's cache entirely.
host
host example.com
host -t MX example.com
host -t AAAA example.com
host 93.184.215.14
host -a example.com # everything, dig-style output
host example.com 1.1.1.1 # specific serverexample.com has address 93.184.215.14
example.com has IPv6 address 2606:2800:21f:cb07:6820:80da:af6b:8b2c
example.com mail is handled by 0 .Resolve-DnsName (PowerShell)
Resolve-DnsName example.com
Resolve-DnsName example.com -Type AAAA
Resolve-DnsName example.com -Type MX
Resolve-DnsName example.com -Server 1.1.1.1
Resolve-DnsName 93.184.215.14 # reverse; or -Type PTR on the arpa name
Resolve-DnsName example.com -DnsOnly # skip hosts file, LLMNR, NetBIOS
Resolve-DnsName example.com -NoHostsFile
Resolve-DnsName example.com -CacheOnly # what is in the local cache
Resolve-DnsName example.com -DnssecOk | Format-List
(Resolve-DnsName example.com -Type A).IPAddress # just the value, for scripts
'example.com','example.org' | ForEach-Object { Resolve-DnsName $_ -Type A } | Format-Table Name, IPAddressUnlike nslookup, Resolve-DnsName uses the Windows DNS Client, so it follows the same server order, suffix search list, NRPT rules and DoH configuration as applications do. That makes it the right tool for "why does this machine resolve the name this way".
Record types you will meet
| Type | Holds | Typical use |
|---|---|---|
| A | IPv4 address | Where a host is |
| AAAA | IPv6 address | Same, over IPv6 |
| CNAME | Another name | Aliases; www pointing at the bare domain or a CDN |
| MX | Mail server name and priority | Where email for the domain goes |
| NS | Name server | Who is authoritative for the zone |
| SOA | Zone metadata | Serial number, refresh timers, negative-cache TTL |
| TXT | Free text | SPF, DKIM, DMARC, domain verification |
| PTR | A name, for reverse lookups | 14.215.184.93.in-addr.arpa → example.com |
| SRV | Host, port, priority, weight | SIP, XMPP, Active Directory (_ldap._tcp.dc._msdcs), Minecraft |
| CAA | Allowed certificate authorities | TLS certificate policy |
| HTTPS / SVCB | Service parameters | HTTP/3 and ECH hints; Apple and Chrome query these on every visit |
| DS, DNSKEY, RRSIG, NSEC | DNSSEC material | Signature validation; look for the ad flag rather than reading them |
Common tasks
Is DNS the problem?
nslookup example.com # your resolver
nslookup example.com 1.1.1.1 # a public one
# both fail: the name really is broken, or you have no connectivity (ping 1.1.1.1 to check)
# only the first fails: your resolver or router is the problem; change DNS or flush caches
# both work but the browser fails: browser DoH, hosts file, proxy, or an IPv6 (AAAA) path that is brokenHas my DNS change propagated?
dig +short example.com @a.iana-servers.net # the authoritative server: the new value should be here immediately
dig +short example.com @1.1.1.1 # a public resolver: old value until its cached TTL expires
dig +short example.com # your own resolver
dig example.com | grep -E '^example.com' # watch the TTL count downFind the mail servers and SPF for a domain
dig +short example.com MX
dig +short example.com TXT | grep spf
dig +short _dmarc.example.com TXT
dig +short selector1._domainkey.example.com TXTFind the name servers and who hosts them
dig +short example.com NS
whois example.com | grep -i 'name server'Check whether a resolver validates DNSSEC
dig +dnssec sigok.verteiltesysteme.net @1.1.1.1 | grep flags # should include 'ad'
dig sigfail.verteiltesysteme.net @1.1.1.1 | grep status # should be SERVFAIL on a validating resolverInstalling dig and host
sudo apt install dnsutils # Debian, Ubuntu
sudo dnf install bind-utils # Fedora, RHEL
sudo pacman -S bind # Arch (package 'bind' provides dig)
sudo apk add bind-tools # Alpine
# macOS: already installed. Windows: use nslookup or Resolve-DnsName, or install BIND tools / use WSLAlternatives with the same job: drill (ldns; drill example.com @1.1.1.1), kdig (Knot, supports DoH/DoT), doggo and q (modern Go tools with DoH/DoT/DoQ support).