How to Use nslookup and dig for DNS Troubleshooting

Quick answer

DNS (Domain Name System) maps names such as example.com to IP addresses and publishes other records used by email and network services.

Use nslookup for a quick check and dig when you need more detail. Start with nslookup example.com or dig example.com, then specify a record type or DNS server if the result is not what you expect.

These commands help you confirm A, AAAA, MX, TXT, NS, SOA, CNAME, and PTR records, compare resolvers, and separate a DNS problem from a web or mail problem.

What are nslookup and dig?

nslookup is a DNS query tool available on Windows and many Unix-like systems. It supports quick noninteractive queries and an interactive mode.

dig is the detailed DNS lookup utility included with BIND. It is common on Linux and macOS and can also be installed on Windows.

Both tools query the same DNS data. The main difference is output: nslookup is simple and widely available, while dig exposes flags, timing, response sections, and status details that are useful during troubleshooting.

How to use dig

Run dig from a terminal. On Windows, use PowerShell or Command Prompt after installing a package that provides the command.

Basic command format

dig [domain] [record type]

Replace [domain] with the name you want to check.

Use [record type] for A, AAAA, MX, TXT, NS, SOA, CNAME, or another supported record. If you omit it, dig requests an A record by default.

Example 1: query the A record for google.com:

Example 2: query the MX records:

Query a specific DNS server

dig @[DNS server address or domain name] [domain] [record type]

Example: query google.com through Cloudflare DNS at 1.1.1.1:

Run a reverse DNS lookup

Use -x to request the PTR record for an IP address:

dig -x [IP Address]

Example: check whether 172.217.17.46 has a PTR record:

Trace the DNS delegation path

Use +trace to follow the delegation path from the root servers to the authoritative server. This is useful for delegation problems; it is not the same as asking your normal recursive resolver.

dig [domain] +trace

Example: trace the delegation path for google.com:

Set a custom timeout

Use +time to set how many seconds dig waits for one query attempt.

dig [domain] +time=[seconds]

Example: set the timeout to five seconds:

Change the number of retries

Use +retry to set how many times dig retries a UDP query after the first attempt fails.

dig [domain] +retry=[number of attempts]     

Example: allow three retries while testing a nonresponsive server or network path:

Save results to a text file

Use your shell’s output redirection to save the result:

dig [domain] > [file]

Example: save a TXT-record query to a file:

dig morhafsh.com TXT > result.txt

The file contains the same output that would normally appear in the terminal:

Query several domains from a file

With one query per line, -f reads requests from a file:

dig -f [file]

Example: this file contains four domains, one per line:

Now review the combined results:

Combine dig options

You can combine options when they serve the same troubleshooting goal:

Example 1: query the file and save the output:

dig -f domains.txt > file.txt

Example 2: trace the delegation path and allow three retries:

dig [domain] +trace +retry=3

Example 3: query Google DNS and wait up to ten seconds per attempt:

dig [domain] @8.8.8.8 +time=10

How to use nslookup

Basic query

For a basic address lookup, run:

nslookup [domain]

Example: query google.com using your configured DNS server:

Query a specific DNS record

Use -type to request a specific record type:

nslookup -type=[record] [domain]

Example: request MX records for the domain:

Query a specific DNS server

Add the DNS server as the second argument to compare its answer with your default resolver:

nslookup [domain] [name server]

Example: query Google DNS at 8.8.8.8:

Frequently asked questions

Why do nslookup and dig return different answers?

They may be querying different DNS servers, using different search-suffix behavior, or showing cached data in different ways. Specify the same server in both commands before comparing the results.

What does NXDOMAIN mean?

NXDOMAIN means the resolver says the requested domain name does not exist. A valid domain can still return no records for a particular type, which is a different result.

How do I check DNS propagation?

Query more than one recursive resolver and compare the answer and TTL. DNS changes are cached until each resolver’s stored TTL expires, so different answers during that period are normal.

Practical DNS troubleshooting checklist

Start with your normal resolver, then query a public resolver such as 1.1.1.1 or 8.8.8.8. If the answers differ, check the record’s TTL and whether caches still hold an older value. If both are wrong, query the authoritative name servers and review the zone itself. A successful DNS answer only confirms DNS; it does not prove that the website, mail server, or application is working.

For quick checks across several domains, use the Bulk DNS Lookup Tool.