nslookup
Displays information that you can use to diagnose Domain Name System (DNS) infrastructure. Windows commands reference
On Windows 7 Sigma rules name it 9 sub-commands File nslookup.exe
Windows
Displays information that you can use to diagnose Domain Name System (DNS) infrastructure. Before using this tool, you should be familiar with how DNS works. The nslookup command-line tool is available only if you have installed the TCP/IP protocol.
nslookup [exit | finger | help | ls | lserver | root | server | set | view] [options]The following example looks up the IP addresses for the domain name mydomain.com on the DNS name server at 1.1.1.1
nslookup mydomain.com 1.1.1.1IdentifyThe following example looks up the domain name for the IP address 4.4.4.4 on the default DNS name server
nslookup 4.4.4.4IdentifyTo specify options, you can use nslookup -<option>. For example, the following command turns on the nslookup debug option to get more information about packets sent.
nslookup -debug mydomain.comIdentifyTo return certain types of records or information, use the -type=<resourcerecordtype> option. For example, the following command returns only IPv6 record types
nslookup -type=AAAA mydomain.comIdentifyYou can combine options and resource record type queries in command lines. The following example enables debug output, retrieves both IPv6 and IPv4 addresses, doesn't attempt to use the search domain, uses recursive lookup, and uses the 1.1.1.1 DNS lookup server
nslookup -debug -type=A+AAAA -nosearch -recurse mydomain.com 1.1.1.1IdentifyThe following command places nslookup in interactive mode and sets 1.1.1.1 as the default DNS lookup server
nslookup - 1.1.1.1IdentifyThe following command at the interactive prompt returns nslookup option and parameter settings for the current server
set allIdentifyThe following command at the interactive prompt returns the IP addresses for mydomain.com
mydomain.comThe following command at the interactive prompt changes the default DNS name server to 4.4.4.4
server 4.4.4.4The following command at the interactive prompt sets the query resource record type to HINFO
set type=HINFOIdentifyThe following command at the interactive prompt exits interactive mode and returns to the Windows command prompt
exitIdentifyShow 24 options
nslookup exitExits the nslookup command-line tool.nslookup fingerConnects with the finger server on the current computer.nslookup helpDisplays a short summary of subcommands.nslookup lsLists information for a DNS domain.nslookup lserverChanges the default server to the specified DNS domain.nslookup rootChanges the default server to the server for the root of the DNS domain name space.nslookup serverChanges the default server to the specified DNS domain.nslookup setChanges configuration settings that affect how lookups function.nslookup set allPrints the current values of the configuration settings.nslookup set classChanges the query class. The class specifies the protocol group of the information.nslookup set d2Turns exhaustive Debugging mode on or off. All fields of every packet are printed.nslookup set debugTurns Debugging mode on or off.nslookup set domainChanges the default DNS domain name to the name specified.nslookup set portChanges the default TCP/UDP DNS name server port to the value specified.nslookup set querytypeChanges the resource record type for the query.nslookup set recurseTells the DNS name server to query other servers if it doesn't have the information.nslookup set retrySets the number of retries.nslookup set rootChanges the name of the root server used for queries.nslookup set searchAppends the DNS domain names in the DNS domain search list to the request until an answer is received. This applies when the set and the lookup request contain at least one period, but do not end with a trailing period.nslookup set srchlistChanges the default DNS domain name and search list.nslookup set timeoutChanges the initial number of seconds to wait for a reply to a request.nslookup set typeChanges the resource record type for the query.nslookup set vcSpecifies to use or not use a virtual circuit when sending requests to the server.nslookup viewSorts and lists the output of the previous ls subcommand or commands.Several platforms
Query name servers for various domain records.
Query your system's default name server for an IP address (A record) of the domain
nslookup example.comIdentifyQuery a given name server for an NS record of the domain
nslookup -type=NS example.com 8.8.8.8IdentifyQuery for a reverse lookup (PTR record) of an IP address
nslookup -type=PTR 54.240.162.118IdentifyQuery for ANY available records using TCP protocol
nslookup -vc -type=ANY example.comIdentifyQuery a given name server for the whole zone file (zone transfer) of the domain using TCP protocol
nslookup -vc -type=AXFR example.com name_serverIdentifyQuery for a mail server (MX record) of the domain, showing details of the transaction
nslookup -type=MX -debug example.comIdentifyQuery a given name server on a specific port number for a TXT record of the domain
nslookup -port=port_number -type=TXT example.com name_serverIdentify