Nslookup – Complete Guide to DNS Record Lookups

"The website moved but half the office still lands on the old server." "We added the SPF record yesterday, why does the mail provider say it's missing?" Both questions start with the same step: ask DNS directly what it returns for a name, and compare that with what you expect.

The Nslookup tool on NetTools.tech does that from the outside. It queries a domain through public recursive resolvers and shows each record with its value and, for address records, its TTL. Use it when you have changed a record, when a service cannot be reached by name, or when you need to see a domain's mail servers, name servers or verification TXT records without opening a terminal.

What is Nslookup?

In simple terms

DNS is the internet's address book. Computers connect to IP addresses, people type names. A DNS lookup asks "what does the name example.com map to?" and gets back records: an IPv4 address (A), an IPv6 address (AAAA), the mail servers (MX), the authoritative name servers (NS), free-form text (TXT) and a few more. nslookup is the classic command-line program for asking those questions; this tool gives you the same answers in a browser.

Technical background

DNS is defined in RFC 1034 and RFC 1035. A lookup normally goes to a recursive resolver. If the resolver has no cached answer, it walks the hierarchy (root servers, the TLD servers, then the domain's authoritative name servers), returns the answer to the client and caches it for the record's TTL (time to live, in seconds).

The record types the tool supports:

Two negative answers matter as much as positive ones. NXDOMAIN (response code 3) says the name does not exist at all. NODATA is a NOERROR response with an empty answer section: the name exists but has no records of the requested type. Both are cached too, for the negative TTL taken from the zone's SOA record (RFC 2308).

Why use Nslookup?

• Verify a change. After editing a record at your DNS provider, confirm that public resolvers return the new value and not the old one.
• Diagnose "site not found". NXDOMAIN, an empty answer or an unexpected IP tells you whether the problem is DNS or something further down the line.
• Check email setup. MX shows where mail is delivered; TXT shows SPF, DMARC (at _dmarc.example.com) and DKIM selectors (at selector._domainkey.example.com).
• Check delegation. NS and SOA show which name servers are authoritative and which zone serial the resolvers see.
• Check certificate policy. CAA tells you whether your certificate authority is allowed to issue for the domain before a renewal fails.
• Get an outside view. Your workstation may use an internal resolver with split-horizon zones; this tool shows what the public internet sees.

Who should use it?

• System administrators and DevOps engineers changing DNS, migrating hosting or debugging service discovery.
• Email administrators checking MX, SPF, DKIM and DMARC records.
• Network engineers confirming delegation and name server changes.
• Web developers and site owners who need to confirm where a domain points.
• Support staff who need to check a customer's DNS without terminal access.

How Nslookup works

A DNS query is a small UDP packet carrying the name, the record type and the class (IN). The resolver answers with the matching records, each with a TTL, or with a response code such as NXDOMAIN or SERVFAIL.

On NetTools.tech the query does not run in your browser. Your browser sends the domain and record type to the NetTools.tech server in Latvia, which validates them and then asks the public resolvers Cloudflare 1.1.1.1 and Google 8.8.8.8. The server's resolver client uses 1.1.1.1 first and falls back to 8.8.8.8 if it does not answer; each attempt waits up to 3 seconds and is tried twice. The output names both resolvers, not which one answered.

Details of the implementation:

• Validation first. Only fully qualified public domain names are accepted. Internationalized names are converted to punycode; internal and reserved TLDs such as .local, .internal, .lan, .home, .corp, .test, .example and .arpa are rejected; an IP address is refused (use Reverse DNS for that).
• One type or ALL. A single type sends one query. ALL sends separate queries for A, AAAA, CNAME, MX, NS, TXT, SOA and CAA in parallel and merges the answers. The DNS ANY query type is never used.
• Result status. If any record came back the status is NOERROR. If every query failed with "name not found" the tool reports NXDOMAIN; otherwise an empty result is reported as "no records".
• Hard errors. A timeout, SERVFAIL or REFUSED is reported as an error only when no records were returned at all.
• Formatting. MX records are sorted by priority. A null MX (0 ., RFC 7505) is labeled as "domain accepts no email". TXT strings split into 255-byte chunks are joined back into one value. SOA is shown as one line with serial, refresh, retry, expire and minimum values.
• Limits. At most 100 records are returned, and a single value longer than 1,024 characters (a long TXT record, for example) is cut with an ellipsis. The whole request has a 12-second server time limit and normal per-visitor rate limits.

How to use the NetTools.tech Nslookup

1. Open Nslookup.
2. Enter the name in the Domain field, for example example.com, www.example.com or _dmarc.example.com. A full URL is not needed; just the hostname.
3. Choose a Record type: A (default), AAAA, CNAME, MX, NS, TXT, SOA, CAA, SRV or ALL. For SRV, enter the full service name such as _sip._tcp.example.com.
4. Press Run Nslookup. The example chips under the form (A records, MX, ALL) fill in a ready-made query.
5. Use Copy to copy the output as text, or Open in terminal to run the same lookup in the NetTools terminal, where /nslookup example.com MX and the alias /dig work the same way.

Understanding the results

How to read the value of each type:

• MX: 10 mail.example.com is priority 10, server mail.example.com. Lower numbers are tried first.
• SOA: ns1.example.net hostmaster.example.com serial=2026101102 refresh=3600 retry=900 expire=1209600 min=300. The serial changes when the zone is edited; min is the negative caching TTL.
• CAA: 0 issue "letsencrypt.org" is flags, tag and value. issue allows a CA to issue certificates, issuewild covers wildcards, iodef gives a reporting address.
• SRV: 10 5 5060 sip.example.com is priority, weight, port and target.
• TXT: the full string, already joined from its chunks.

Example: checking a migrated website and its mail records

A team moved example.com to a new host at 192.0.2.10 and wants to confirm the public view.

Query example.com, type A:

1 record for example.com
Type  Value        TTL
A     192.0.2.10   287
Resolver 1.1.1.1, 8.8.8.8 · 21 ms

The new address is live, and the cached copy expires in 287 seconds. Now type ALL:

7 records for example.com
Type  Value                                                    TTL
A     192.0.2.10                                               287
AAAA  2001:db8::10                                             287
MX    10 mail.example.com                                      —
NS    ns1.example.net                                          —
NS    ns2.example.net                                          —
TXT   v=spf1 ip4:192.0.2.25 -all                               —
SOA   ns1.example.net hostmaster.example.com serial=2026101102 refresh=3600 retry=900 expire=1209600 min=300   —
Resolver 1.1.1.1, 8.8.8.8 · 48 ms

There is no CAA row, so any public CA may issue certificates, and no CNAME at the apex, which is expected. If the A record still showed the old address, the next step would be the DNS Propagation Checker to see how many resolvers still hold the old answer.

Common use cases

• Confirming an A or AAAA record after a server or hosting move.
• Checking www for a CNAME to a CDN or platform hostname.
• Reading MX records before changing mail providers, or after, to confirm the switch.
• Looking up SPF, DMARC and DKIM TXT records, and domain verification tokens for SaaS services.
• Verifying NS records after changing DNS provider, and the SOA serial after an edit.
• Checking CAA before ordering or renewing a certificate.
• Finding SRV records for SIP, XMPP or autodiscovery.

Troubleshooting

NXDOMAIN for a domain that should exist

Check the spelling and the exact name: www.example.com and example.com are separate names. Then check registration and delegation with Whois: an expired domain or one whose name servers were removed returns NXDOMAIN. A brand-new record may also be hidden by a cached NXDOMAIN until the zone's negative TTL (the SOA min value) runs out.

The old value is still returned

The resolver cached the previous answer. The TTL on A and AAAA rows tells you how long it will be kept. Compare more resolvers with the DNS Propagation Checker; if every resolver shows the old value long after the TTL, confirm the change was actually saved in the right zone at the provider that is authoritative (check NS).

"No TXT records" although the provider shows the record

The record is often published under the wrong name. Many DNS panels append the zone name automatically, so entering _dmarc.example.com in the name field creates _dmarc.example.com.example.com. Query the doubled name to confirm, then fix the entry.

SERVFAIL

The resolver tried and failed. Common causes are DNSSEC validation failures (an outdated DS record at the registrar after changing provider) and authoritative servers that do not answer. Check NS and SOA, and whether the listed name servers are reachable.

A CNAME lookup on the bare domain returns nothing

A CNAME cannot coexist with other records, so the apex of a zone normally has none. Some providers offer "ALIAS" or "flattened CNAME" features that publish A/AAAA records at the apex instead; query A and AAAA to see their result.

A lookup times out

The authoritative servers may be slow or unreachable from the resolvers. Run the query again; if it keeps timing out, test the name servers themselves from a terminal (dig @ns1.example.net example.com SOA).

Common mistakes

• Querying a URL path or https:// prefix instead of a hostname. Enter only the name.
• Expecting your internal, split-horizon or VPN-only names to resolve. Public resolvers never see them.
• Reading "no AAAA records" as an error. It only matters if you intended to publish IPv6.
• Looking for DKIM at the bare domain. DKIM keys live at selector._domainkey.example.com.
• Using ALL to find SRV records. SRV is not part of ALL; pick SRV and enter the service name.
• Treating an answer from 1.1.1.1 as proof that every resolver has the new value.

Limitations

• Two public resolvers, one location. Answers come from Cloudflare or Google as reached from the NetTools.tech server in Latvia. Geo-DNS and CDN answers can differ for users elsewhere, and your local resolver may still hold an older cache.
• Not an authoritative query. The tool asks recursive resolvers, not the domain's own name servers, so you see cached data. It cannot query a name server you choose.
• TTL only for A and AAAA. Other types show "—" for TTL.
• No DNSSEC details. It does not show RRSIG, DS or DNSKEY records or the AD (authenticated data) flag.
• No CNAME chain view. An A query for an alias returns the final addresses, not each step of the chain; query CNAME separately.
• Truncation. More than 100 records, or values over 1,024 characters, are cut.
• No PTR here. Reverse lookups are handled by Reverse DNS.

Security & privacy

The domain name and record type you enter are sent to the NetTools.tech server, which forwards the query to Cloudflare (1.1.1.1) and, if needed, Google (8.8.8.8). Those resolvers see a query from the NetTools.tech server, not from your IP address. Only public names are accepted, so the tool cannot be used to probe internal DNS. DNS data is public by design; do not enter anything you consider secret, such as an unreleased hostname you do not want logged by third-party resolvers. No passwords, keys or credentials are ever needed.

Related tools

• DNS Propagation Checker – compare the same record across dozens of public resolvers; guide: DNS propagation.
• Reverse DNS – PTR lookup for an IP address; guide: Reverse DNS lookup.
• Whois – registration, expiry and delegated name servers; guide: Whois lookup.
• MX Lookup – MX records with resolved addresses and reverse DNS; guide: MX lookup.
• Bulk DNS Lookup – one record type for many domains; guide: Bulk DNS lookup.
• Category overview: DNS & domain tools.

Summary

Nslookup on NetTools.tech queries A, AAAA, CNAME, MX, NS, TXT, SOA, CAA and SRV records, or all common types at once, through Cloudflare and Google public resolvers from a server in Latvia. It distinguishes non-existent names (NXDOMAIN) from names without the requested type, shows TTLs for address records and formats MX, SOA, CAA and SRV values. It shows the public, cached view of DNS; for authoritative or DNSSEC detail, use dig against the name servers directly.