nslookup and host

Same question, three tools

dig is the one to learn. host is for a quick eyeball, nslookup is for Windows boxes where nothing else is installed. Both hide the header, the flags, and the RCODE, which is exactly what you need when debugging.

host

Terse, human-phrased output. Good for a one-line answer, useless for anything subtle.

host example.com                     # A, AAAA, and MX in one go
host -t MX google.com
host -t TXT example.com
host -t NS example.com
host -t SOA example.com
host 8.8.8.8                         # reverse, no flag needed
host example.com 1.1.1.1             # server goes LAST, not first
host -a example.com                  # verbose, equivalent to -v -t ANY
host -C example.com                  # SOA from every authoritative server
host -T example.com                  # over TCP
host -W 2 -R 1 example.com           # 2s timeout, 1 retry
host -r example.com 1.1.1.1          # no recursion, cache inspection

$ host example.com
example.com has address 104.20.23.154
example.com has address 172.66.147.243
example.com has IPv6 address 2606:4700:10::6814:179a
example.com mail is handled by 0 .

$ host -t MX google.com
google.com mail is handled by 10 smtp.google.com.

$ host 8.8.8.8
8.8.8.8.in-addr.arpa domain name pointer dns.google.

host -C is the one genuinely useful flag dig makes harder, it prints the SOA from every nameserver so a lagging secondary jumps out.

host exits 1 on NXDOMAIN and 0 on success, so it drops into a shell conditional without parsing anything:

if host -t A api.example.com >/dev/null 2>&1; then echo resolves; fi

nslookup, one-shot mode

Deprecated for two decades and still on every machine. Note -type=, with an equals sign, and the server as a trailing argument.

nslookup example.com
nslookup example.com 1.1.1.1
nslookup -type=MX google.com
nslookup -type=TXT example.com
nslookup -type=NS example.com
nslookup -type=SOA example.com
nslookup -type=ANY example.com
nslookup 8.8.8.8                     # reverse, detected from the argument
nslookup -debug example.com          # dump the full packet, flags included
nslookup -timeout=2 -retry=1 example.com
nslookup -port=5353 example.com 127.0.0.1
nslookup -vc example.com             # TCP instead of UDP
nslookup -norecurse example.com 1.1.1.1

$ nslookup example.com
Server:		2001:558:feed::1
Address:	2001:558:feed::1#53

Non-authoritative answer:
Name:	example.com
Address: 104.20.23.154
Address: 172.66.147.243

"Non-authoritative answer" is normal and means nothing is wrong. It is nslookup reporting the aa flag was clear, which is true of every cached answer from every recursive resolver. It is the single most misread line in DNS troubleshooting.

nslookup, interactive mode

Run nslookup with no arguments and you get a prompt. This is the mode Windows runbooks assume.

$ nslookup
> server 1.1.1.1                 ; switch resolver
> set type=MX                    ; or set q=MX
> google.com
> set type=A
> set debug                      ; verbose packets
> set nodebug
> set timeout=2
> set retry=1
> set norecurse
> set port=5353
> set all                        ; print current settings
> example.com.                   ; trailing dot skips the search list
> exit

Windows and the ipconfig side

On Windows, nslookup is usually all you have, and the cache is separate.

nslookup api.example.com 1.1.1.1
nslookup -type=all api.example.com

ipconfig /displaydns                     :: what the OS has cached
ipconfig /flushdns                       :: clear it
ipconfig /all                            :: which resolvers are configured

Resolve-DnsName api.example.com -Type A          # PowerShell, better than nslookup
Resolve-DnsName api.example.com -Server 1.1.1.1
Resolve-DnsName api.example.com -DnsOnly         # skip the local cache
Clear-DnsClientCache

Resolve-DnsName is the modern PowerShell cmdlet and returns objects, so it beats nslookup on any Windows box from Server 2012 onward.

What these tools do not show you

- The RCODE. host and nslookup translate NXDOMAIN, NODATA, and SERVFAIL into prose that reads similarly. dig prints status: verbatim. - The flags. No aa, no tc, no ad, so you cannot tell authoritative from cached, or see that DNSSEC validated. nslookup -debug is the workaround. - The TTL. host never prints it. nslookup prints it only under -debug. This makes both useless for propagation checks. - EDNS(0) details and the OPT pseudosection, so buffer-size and DNSSEC problems are invisible.

# what you actually want, every time
dig api.example.com A +noall +answer +comments

Gotchas

- The server argument goes last for host and nslookup, first for dig. host 1.1.1.1 example.com reverse-resolves 1.1.1.1 using example.com as the server, which is not what anyone means. - nslookup needs -type=, not -t. nslookup -t MX example.com treats MX as the name to look up. - nslookup can report success while your application fails, because it ignores /etc/hosts and nsswitch.conf just like dig. getent hosts NAME is the only command that shows the real system path. - nslookup fails oddly when the configured resolver has no reverse record, printing *** Can't find server name for address ... before the real answer. That warning is cosmetic. - host -a times out against servers that refuse ANY, which is most of them now. It is not a zone listing. - On Alpine and minimal containers, none of the three exist. Install bind-tools, or use getent hosts and nc -vz.