nslookup - Queries Internet name servers interactively
nslookup [-option ...] [host-to-find | [-server] ]
The nslookup command is a program that is used to query Internet domain
name servers. The nslookup command has two modes: interactive and nonin-
Noninteractive mode is used to print just the name and requested infor-
mation for a host or domain. Noninteractive mode is invoked when the
name or Internet address of the host to be looked up is given as the
first argument. The optional second argument specifies the hostname or
address of a name server.
Interactive mode allows the user to query name servers for information
about various hosts and domains or to print a list of hosts in a
domain. Interactive mode is invoked when you specify nslookup without
arguments (the default name server will be used), or when the first
argument you specify is a - (dash) and the second argument is the host-
name or Internet address of a name server.
The options listed under the set command can be specified in the
.nslookuprc file in the user's home directory if they are listed one per
line. Options can also be specified on the command line if they precede the
arguments and are prefixed with a - (dash). For example, to change the
default query type to host information, and the initial time-out to 10
nslookup -query=hinfo -timeout=10
Commands may be interrupted at any time by entering <<Ctrl-c>>. To exit,
enter <<Ctrl-d>> (EOF) or type exit. The command line length must be less
than 256 characters. To treat a built-in command as a hostname, precede it
with an escape character \ (backslash). Note that an unrecognized command
will be interpreted as a hostname.
Looks up information for host using the current default server or using
server if specified. If host is an Internet address and the query type
is A or PTR, the name of the host is returned. If host is a name and
does not have a trailing period, the default domain name is appended to
the name. (This behavior depends on the state of the set options
domain, srchlist, defname, and search). To look up a host not in the
current domain, append a . (dot) to the name.
Changes the default server to domain. lserver uses the initial server
to look up information about domain, while server uses the current
default server. If an authoritative answer cannot be found, the names
of servers that might have the answer are returned.
Changes the default server to the server for the root of the domain
name space. Currently, the host ns.internic.net is used. (This command
is a synonym for lserver ns.internic.net.) The name of the root server
can be changed with the set root command.
finger [name] [>> filename]
finger [name] [>>>> filename]
Connects with the finger server on the current host. The current host
is defined when a previous lookup for a host was successful and
returned address information (see the set querytype=A command). name
is optional. The>> and >>>> (redirection symbols) can be used to redirect
output in the usual manner.
ls [option] domain [>> filename]
ls [option] domain [>>>> filename]
Lists the information available for domain, optionally creating or
appending to filename. The default output contains hostnames and their
Internet addresses. option can be one of the following:
Lists all records of the specified type (see querytype later in
this reference page).
-a Lists aliases of hosts in the domain. This option is a synonym for
-d Lists all records for the domain. This option is a synonym for -t
-h Lists CPU and operating system information for the domain. This
option is a synonym for -t HINFO.
-s Lists well-known services of hosts in the domain. This option is a
synonym for -t WKS. When output is directed to a file, # (number
signs) are printed for every 50 records received from the server.
Sorts and lists the output of previous ls command(s) with more.
? Prints a brief summary of commands.
Exits the program.
This command is used to change state information that affects the look-
ups. Valid keywords are:
all Prints the current values of the frequently used options to
set. Information about the current default server and host is
Changes the query class to one of:
IN The Internet class.
The Chaos class.
The MIT Athena Hesiod class.
ANY Wildcard (any of the above). The class specifies the pro-
tocol group of the information. (Default = IN, abbreviation
Turns debugging mode on. A lot more information is printed
about the packet sent to the server and the resulting answer.
(Default = nodebug, abbreviation = [no]deb)
[no]d2 Turns exhaustive debugging mode on. Essentially all fields of
every packet are printed. (Default = nod2)
Changes the default domain name to name. The default domain
name is appended to a lookup request depending on the state of
the defname and search options. The domain search list contains
the parents of the default domain if it has at least two com-
ponents in its name. For example, if the default domain is
CC.Berkeley.EDU, the search list is CC.Berkeley.EDU and
Berkeley.EDU. Use the set srchlist command to specify a dif-
ferent list. Use the set all command to display the list.
(Default = value from hostname, /etc/resolv.conf or LOCAL-
DOMAIN, abbreviation = do)
Changes the default domain name to name1 and the domain search
list to name1, name2, and so on. A maximum of 6 names separated
by / (slashes) can be specified: For example:
sets the domain to lcs.MIT.EDU and the search list to the three
names. This command overrides the default domain name and
search list of the set domain command. Use the set all command
to display the list. (Default = value based on hostname,
/etc/resolv.conf or LOCALDOMAIN, abbreviation = srchl)
If set, appends the default domain name to a single-component
lookup request (that is, one that does not contain a dot).
(Default = defname, abbreviation = [no]def)
If the lookup request contains at least one . (dot) but does
not end with a trailing dot, appends the domain names in the
domain search list to the request until an answer is received.
(Default = search, abbreviation = [no]sea)
Changes the default TCP/UDP name server port to value.
(Default = 53, abbreviation = po)
Changes the type of information query to one of:
A The host's IPv4 address.
The host's IPv6 address.
The canonical name for an alias.
The host CPU and operating system type.
The mailbox or mail list information.
MX The mail exchanger.
The Naming AUthority PoinTeR that contains rules for map-
ping parts of Uniform Resource Identifiers (URIs) to domain
NS The name server for the named zone.
PTR The hostname if the query is an Internet address; otherwise
the pointer to other information.
SOA The domain's start-of-authority information.
SRV The host that can provide a specific resolution service.
TXT The text information.
The user information.
WKS The supported well-known services. Other types (ANY, AXFR,
MB, MD, MF, NULL) are described in the RFC1035 document.
(Default = A, abbreviations = q, ty)
Tells the name server to query other servers if it does not
have the information. (Default = recurse, abbreviation =
Sets the number of retries to number. When a reply to a request
is not received within a certain amount of time (changed with
set time-out), the timeout period is doubled and the request is
resent. The retry value controls how many times a request is
resent before giving up. (Default = 4, abbreviation = ret)
Changes the name of the root server to host. This affects the
root command. (Default = ns.internic.net., abbreviation = ro)
Changes the initial timeout interval for waiting for a reply to
number seconds. Each retry doubles the timeout period. (Default
= 5 seconds, abbreviation = ti)
[no]vc Always use a virtual circuit when sending requests to the
server. (Default = novc, abbreviation = [no]v)
Ignore packet truncation errors. (Default = noignoretc, abbre-
viation = [no]ig)
In noninteractive mode, nslookup can return the following values:
0 A match was found.
1 No match was found, or an error occurred.
If the lookup request was not successful, an error message is printed.
Possible errors are:
The server did not respond to a request after a certain amount of time
(changed with set timeout=value) and a certain number of retries
(changed with set retry=value).
No response from server
No name server is running on the server machine.
The server does not have resource records of the current query type for
the host, although the hostname is valid. The query type is specified
with the set querytype command.
The host or domain name does not exist.
Network is unreachable
The connection to the name or finger server could not be made at the
current time. This error commonly occurs with ls and finger requests.
The name server found an internal inconsistency in its database and
could not return a valid answer.
The name server refused to service the request.
The name server found that the request packet was not in the proper
format. It may indicate an error in nslookup.
Specifies the command path
Initial domain name and name server addresses
User's initial options
Summary of commands
Specifications: RFC1034, RFC1035