DNS Lookups with nslookup and dig

When inspecting DNS, record which server received which record-type query, not just the returned address. Different resolvers can have different cached answers or network policies. These examples use a demonstration domain; actual answer addresses can change.

Request a specific record type with nslookup

On Windows, start in a command prompt. The same basic syntax is useful on macOS or Linux when the tool is installed:

nslookup -type=A example.com
nslookup -type=AAAA example.com
nslookup -type=MX example.com
nslookup -type=NS example.com

The server address near the beginning identifies the answering resolver, not the website. “Non-authoritative answer” is not inherently an error: a resolver may be returning the answer instead of the domain's authoritative server.

Read the status, not only dig's answer section

dig example.com A
dig example.com AAAA
dig example.com MX
dig example.com NS

If dig is unavailable, use the appropriate DNS utility package for your operating system; package names differ. Keep the full output during initial diagnosis so the status, answer section, TTL, elapsed query time, and answering server remain visible.

+short is convenient for a compact list, but hides diagnostic headers. An empty short answer does not establish that the domain is absent. The requested record type may be missing, or the query may have failed for another reason.

Distinguish negative answers from failed queries

• NXDOMAIN: the queried name was reported as nonexistent. Check spelling and whether you queried the correct DNS view.
• NOERROR with no answer: this can occur when the name exists but the requested type does not. Inspect aliases and authority information too.
• SERVFAIL: resolution could not be completed. Possible causes include DNSSEC validation, delegation, and authoritative-server reachability.
• Timeout: no reply arrived within the allowed time. Investigate routing, filtering, and server availability.

Compare cached and authoritative answers

For a domain you manage, identify its authoritative servers through NS information. Replace the placeholders below with the actual server and domain. The example hostname is not a promise of an available DNS service.

dig @ns1.example.net your-domain.example A +norecurse
dig @ns1.example.net your-domain.example AAAA +norecurse

Confirm that the server is authoritative for the zone and inspect the AA flag. If authoritative data is correct but the resolver still returns old data, investigate caching. With corporate split DNS, different internal and external answers may be intentional. Do not send internal names to an external lookup service without authorization.

Make the next diagnostic step specific

Include the exact name, record type, query time, server, and status in a support report. If DNS returns the intended address but the page still fails, move to TLS, destination-port, and application checks. WHOIS or RDAP registration information answers a different question and cannot replace an A/AAAA lookup.

References: Microsoft nslookup and BIND dig.