nslookup asks a DNS server for information about a name. It is useful when a website fails, a mail record appears wrong, or two resolvers give different answers. A useful test records three things together: the exact name, the DNS record type, and the selected server. Without those details, a copied address or error message can be misleading.

The Windows version of nslookup supports a one-command mode and an interactive mode. The command examples here use Windows syntax and the reserved documentation name example.com. Replace that name with the hostname you need to test; the examples do not represent measured lookup results.

Start with a Basic Query

Open Command Prompt or PowerShell on Windows and enter the command below. Use a hostname rather than a full web address containing an HTTPS prefix or a path. With no server argument, nslookup uses its default DNS server.

nslookup example.com

The initial Server and Address fields identify the DNS server selected for the lookup. Do not confuse that address with an address returned for the queried name. A listed server address is not itself evidence that the server replied; read the answer or error that follows.

A successful answer may be labeled Non-authoritative answer. This commonly means the reply came from a recursive resolver rather than directly from the zone's authoritative server. It does not, by itself, say that the record is false or stale. A recursive resolver is the normal source of answers for most device lookups.

Choose the DNS Server Deliberately

To send a query to a specified resolver, place its address after the name. The following example uses Cloudflare's standard public resolver at 1.1.1.1. Use a public resolver only where your network permits it, and keep private company names on the organization's approved DNS service.

nslookup example.com 1.1.1.1

A public service may not know internal company names. A local resolver may intentionally filter a name or return different records inside the organization. A difference between the two services can therefore reflect the intended configuration rather than a fault.

When comparing servers, repeat the same hostname and record type at roughly the same time. Save each full command with its answer or error, and note the active network and VPN state. If a server cannot be contacted, investigate that server and the path to it before drawing conclusions about the domain's records. An explicit server argument does not change the device's permanent DNS settings.

Ask for a Specific Record Type

Use the -type= option to specify what the command should request. A records contain IPv4 addresses, while AAAA records contain IPv6 addresses. This command requests AAAA records from the chosen resolver:

nslookup -type=AAAA example.com 1.1.1.1

Replace AAAA with MX to check mail exchanger records, NS for name server records, or TXT for text records. These are different DNS questions. A name can have an A record and no AAAA record, or the reverse. A missing record of one type does not prove that the domain itself is nonexistent.

Select the type explicitly when comparing results instead of relying on an assumed default. The address family used to contact the DNS server is separate from the record type requested. For example, the AAAA command above reaches the resolver at an IPv4 address while asking for IPv6 address records.

Use Interactive Mode for Related Queries

Enter nslookup without arguments to open its interactive prompt. Then enter the following lines one at a time, using an approved resolver and the name you want to test. These lines select a server and record type, show the current settings, perform a query, and leave the session.

server 1.1.1.1
set type=MX
set all
example.com
exit

The server command changes the resolver used by subsequent lookups in that session. The type setting also remains in effect for later names, so change it before testing a different record type. Use set all to check the current choices if the output is unexpected. Interactive choices affect that nslookup session, not the DNS settings used by every application on the device.

Distinguish DNS Errors from Connection Failures

A timeout means nslookup did not receive a reply within its waiting and retry limits. Check the server address, connectivity, firewall policy, and whether the resolver is available. A timeout is not evidence that the queried domain is absent.

A DNS Refused response means a server answered but declined the request, possibly because of its access policy. A connection refusal or network-unreachable error instead concerns reaching the service. Preserve the exact message so that a transport failure is not mistaken for a DNS refusal.

Nonexistent domain reports that the requested name does not exist according to the responding resolver. No records means the name is valid but has no records of the requested type. Server failure means the DNS server could not complete the query successfully; it does not identify the underlying cause. Record the exact wording because messages can differ between platforms and versions.

Check What the Answer Proves

A non-authoritative answer does not tell you whether the resolver already held the record in its cache or fetched it for this request. A cached record can remain usable until its TTL expires, so a recent zone change may not appear immediately. If you administer the zone, compare the response with the authoritative configuration and the time of the change. Otherwise, send the conflicting results to the DNS administrator or provider.

Neither nslookup mode proves what a browser using its own secure DNS resolver will see. A successful DNS answer also does not test the web server's connection, certificate, or application. If the address records are correct but the site still fails, investigate those later stages separately.

Keep the full command, complete output, test time, and network details together when reporting a failure. State which name and record type failed and whether the same query worked through another permitted resolver. After any correction, repeat the original query under the same conditions before testing the affected application again.