Using NSLOOKUP to Query DNS Data

If you’re working with the Domain Name System (DNS) you don’t have a choice, you have to become familiar with NSLOOKUP.

NSLOOKUP is a command-line tool that can be run in your command prompt (Windows) or terminal (MacOS / Linux). It’s an amazing tool for troubleshooting DNS issues. It allows you to query the resource records (RR) for any DNS provider.

Let’s take a look at a couple of different use cases that you might find helpful.

Example 1: Find the A Record for a domain

Let’s assume we want to know the A record for the noc.org domain. We could use nslookup like this:

$ nslookup noc.org
Server: 172.23.224.1
Address: 172.23.224.1#53

Non-authoritative answer:
Name: noc.org
Address: 137.220.48.110

The output above actually tells you the DNS resolver that was used to query the data, and the second bit is the domain information. So we know that the A record for noc.org is pointing to 137.220.48.110.

Let’s take a look at a couple of different use cases that you might find helpful.

Example 2: Query Information about an IP

Now that we know that NOC.org is pointing to 137.220.48.110, let’s see what we can find out about that IP:

nslookup 137.220.48.110 110.48.220.137.in-addr.arpa name = cdn-edge-usa-central-dallas1.noc.org.

Doing an nslookup query to the IP gives us the reverse output for the IP, tells us what it is configured as. You can see that NOC.org is using the NOC CDN and the request was routed to the Dallas Data Center.

Example 3: The Domains NameServer

Now where NameServers is NOC.org using? Who is their Authoritative DNS?

nslookup -query=ns noc.org 
Server: 172.23.224.1 
Address: 172.23.224.1#53 

Non-authoritative answer: 
noc.org nameserver = ns7.dns-noc.net. 
noc.org nameserver = ns12.dns-noc.net. 
noc.org nameserver = ns12.dns-noc.org. 
noc.org nameserver = ns7.dns-noc.org.

Leveraging the -query option and setting the value to ns we can quickly see that NOC.org is using the NOC AuthDNS.

Example 4: Start of Authority (SOA) Record

Now let’s make sure everything is up to snuff with this zone file. We can do this by querying the SOA record, which then returns something like this:

nslookup -type=soa noc.org 
Server: 172.23.224.1 
Address: 172.23.224.1#53 

Non-authoritative answer: 
noc.org 
origin = ns7.dns-noc.org 
mail addr = security.noc.org 
serial = 1586927815 
refresh = 14400 
retry = 3600 
expire = 1209600 
minimum = 300

This helps us confirm that everything is kosher with this zone file and if we have any issues we can send an email to security@noc.org

Example 5: Check Email Records

A very common DNS check is your email. If you’re ever having issues, and want to confirm that your domain is using the correct mail records, you could do something like this:

nslookup -query=mx noc.org 
Server: 172.23.224.1 
Address: 172.23.224.1#53 

Non-authoritative answer: 
noc.org mail exchanger = 5 ALT1.ASPMX.L.GOOGLE.COM. 
noc.org mail exchanger = 5 ALT2.ASPMX.L.GOOGLE.COM. 
noc.org mail exchanger = 10 ALT3.ASPMX.L.GOOGLE.COM. 
noc.org mail exchanger = 10 ALT4.ASPMX.L.GOOGLE.COM. 
noc.org mail exchanger = 1 ASPMX.L.GOOGLE.COM.

That’s it, these simple queries should be an invaluable addition to your networking chest of goodies. With these you can quickly see what might be going on with your domain, maybe it’s pointing to the wrong origin, or going to the wrong CDN, or maybe the zone file is incorrect. Whatever the case, nslookup is your friend when it comes to troubleshooting issues with your domain.