Post cover image

August 14, 2026

Nslookup: A Practical Guide to DNS Reconnaissance

It is mainly used for DNS troubleshooting, network analysis, and information gathering during reconnaissance.

By Om Barot

7 min read

Nslookup: A Practical Guide to DNS Reconnaissance

During cybersecurity reconnaissance, nslookup helps security professionals understand a target's DNS infrastructure, identify associated services, and verify DNS information discovered through other tools.

Basic Domain Lookup

What is it?

The basic nslookup command is used to query DNS information for a domain name.

It retrieves the IP address associated with the domain by sending a DNS query to the configured DNS resolver.

Why is it Used?

  • Find the IP address of a domain.
  • Verify DNS resolution.
  • Perform initial DNS reconnaissance.
  • Identify the server associated with a domain.

Syntax

nslookup <domain>

How it Works

  1. User provides a domain name.
  2. Nslookup sends a DNS query to the configured DNS server.
  3. The DNS server searches for the domain record.
  4. The resolver returns the corresponding IP address.
  5. Nslookup displays the DNS response.

Example

Command:

nslookup gujaratuniversity.ac.in

Output:

nslookup (Name Server Lookup) is a command-line tool used to query DNS (Domain Name System) servers and retrieve information about domain names, IP addresses, and DNS records.

Server:         fe80::1%2%2
Address:        fe80::1%2#53
Non-authoritative answer:
Name:   gujaratuniversity.ac.in
Address: 14.139.122.18

Output Explanation

Server

Shows the DNS resolver used for the query.

Server: fe80::1%2%2

Address

Shows the DNS server address and DNS port.

Address: fe80::1%2#53

Note

Non-authoritative answer means the response is received from a DNS resolver/cache instead of directly from the authoritative DNS server.

Advantages

  • Simple and fast DNS lookup.
  • Available on most operating systems.
  • Useful for basic DNS verification.
  • Helps during reconnaissance.

Disadvantages

  • Provides limited information in basic lookup.
  • Does not display all DNS records.
  • Depends on the configured DNS resolver.

1 A Record (type=A)

What is it?

The -type=A option queries the A (Address) record of a domain.

An A record maps a domain name to an IPv4 address.

Why is it Used?

  • Find the IPv4 address of a domain.
  • Verify DNS resolution.
  • Identify the IP address associated with a target domain.

Syntax

nslookup -type=A <domain>

Example

nslookup -type=A gujaratuniversity.ac.in

Output:

Server:  UnKnown
Address:  fe80::1
Non-authoritative answer:
Name:    gujaratuniversity.ac.in
Address: 14.139.122.18

Output Explanation

  • Server: DNS resolver used for the query.
  • Address: IP address of the DNS resolver.
  • Name: Queried domain.
  • Address: IPv4 address returned by the A record.

How it Works

  1. Nslookup sends an A record query for the domain.
  2. The DNS resolver looks up the A record.
  3. The resolver returns the IPv4 address.
  4. Nslookup displays the result.

Use Case

Useful during reconnaissance to identify the IPv4 address associated with a domain before further analysis with tools such as Nmap or HTTPX.

Note

Non-authoritative answer means the response was returned by a DNS resolver rather than directly from the domain's authoritative DNS server.

2 AAAA Record (type=AAAA)

What is it?

The -type=AAAA option queries the AAAA record of a domain.

An AAAA record maps a domain name to an IPv6 address.

Why is it Used?

  • Find the IPv6 address of a domain.
  • Check whether a domain supports IPv6.
  • Identify IPv6 infrastructure during reconnaissance.

Syntax

nslookup -type=AAAA <domain>

How it Works

  1. Nslookup sends an AAAA record query for the domain.
  2. The DNS resolver looks for the AAAA record.
  3. The resolver returns the IPv6 address.
  4. Nslookup displays the result.

Example

nslookup -type=AAAA google.com

Output:

Server:  UnKnown
Address:  fe80::1
Non-authoritative answer:
Name:    google.com
Address:  2404:6800:4007:81b::200e

Result

2404:6800:4007:81b::200e

This is the IPv6 address returned by the AAAA record.

Advantages

  • Identifies IPv6 addresses.
  • Helps determine whether a target supports IPv6.
  • Useful for IPv6 reconnaissance.

Disadvantages

  • Some domains do not have an AAAA record.
  • Only provides IPv6 address information.

3 MX Record (type=MX)

What is it?

The -type=MX option queries the MX (Mail Exchange) records of a domain.

MX records specify the mail servers responsible for receiving email for a domain.

Why is it Used?

  • Identify the domain's mail servers.
  • Determine which infrastructure handles email.
  • Gather information about email services during reconnaissance.

Syntax

nslookup -type=MX <domain>

How it Works

  1. Nslookup sends an MX record query for the domain.
  2. The DNS resolver looks for the domain's MX records.
  3. The resolver returns the mail exchanger and its priority.
  4. Nslookup may also resolve the mail server to its IPv4 and IPv6 addresses.

Example

nslookup -type=MX google.com

Output:

DNS request timed out.
    timeout was 2 seconds.
Server:  UnKnown
Address:  fe80::1
Non-authoritative answer:
google.com      MX preference = 10, mail exchanger = smtp.google.com
smtp.google.com internet address = 192.178.211.26
smtp.google.com internet address = 192.178.211.27
smtp.google.com AAAA IPv6 address = 2404:6800:4000:1025::1b
smtp.google.com AAAA IPv6 address = 2404:6800:4000:1025::1a

Result

MX preference = 10
mail exchanger = smtp.google.com
  • MX preference: Priority of the mail server. Lower values have higher priority.
  • Mail exchanger: Hostname of the mail server responsible for receiving email.
  • internet address: IPv4 address of the mail server.
  • AAAA IPv6 address: IPv6 address of the mail server.

Note

The DNS request timed out message indicates that one DNS request did not receive a response within the configured 2-second timeout. The resolver still returned the MX result afterward.

4 NS Record (type=NS)

What is it?

The -type=NS option queries the NS (Name Server) records of a domain.

NS records identify the DNS name servers responsible for a domain's DNS information.

Why is it Used?

  • Identify the domain's authoritative name servers.
  • Understand the DNS infrastructure of a target.
  • Gather DNS information during reconnaissance.

Syntax

nslookup -type=NS <domain>

How it Works

  1. Nslookup sends an NS record query for the domain.
  2. The DNS resolver looks for the domain's NS records.
  3. The resolver returns the configured name servers.
  4. Nslookup may also resolve the name servers to their IPv4 and IPv6 addresses.

Example

nslookup -type=NS google.com

Output:

Server:  UnKnown
Address:  fe80::1
Non-authoritative answer:
google.com      nameserver = ns2.google.com
google.com      nameserver = ns4.google.com
google.com      nameserver = ns3.google.com
google.com      nameserver = ns1.google.com
ns2.google.com  internet address = 216.239.34.10
ns2.google.com  AAAA IPv6 address = 2001:4860:4802:34::a
ns4.google.com  internet address = 216.239.38.10
ns4.google.com  AAAA IPv6 address = 2001:4860:4802:38::a
ns3.google.com  internet address = 216.239.36.10
ns3.google.com  AAAA IPv6 address = 2001:4860:4802:36::a
ns1.google.com  internet address = 216.239.32.10
ns1.google.com  AAAA IPv6 address = 2001:4860:4802:32::a

Result

The domain uses these name servers:

ns1.google.com
ns2.google.com
ns3.google.com
ns4.google.com

Nslookup also resolves each name server to its IPv4 and IPv6 addresses.

Advantages

  • Identifies DNS name servers.
  • Helps understand a domain's DNS infrastructure.
  • Useful during DNS reconnaissance.

Disadvantages

  • Only provides information about the domain's DNS name servers.
  • A DNS resolver may return a cached/non-authoritative response.

5 TXT Record (type=TXT)

What is it?

The -type=TXT option queries the TXT (Text) records of a domain.

TXT records store text-based information associated with a domain. They are commonly used for domain verification and email security policies.

Why is it Used?

  • Identify domain verification records.
  • Find SPF records used for email security.
  • Discover information about third-party services associated with a domain.
  • Gather additional information during DNS reconnaissance.

Syntax

nslookup -type=TXT <domain> <DNS-server>

How it Works

  1. Nslookup sends a TXT record query to the DNS server.
  2. The DNS server returns the TXT records configured for the domain.
  3. Nslookup displays each TXT record.

Example

nslookup -type=TXT google.com 8.8.8.8

Output:

Server:  dns.google
Address:  8.8.8.8
Non-authoritative answer:
google.com      text = "google-site-verification=..."
google.com      text = "MS=..."
google.com      text = "work-accounts-domain-verification=..."
google.com      text = "v=spf1 include:_spf.google.com ~all"
google.com      text = "apple-domain-verification=..."

Important Result

"v=spf1 include:_spf.google.com ~all"

This is an SPF record, which specifies which mail servers are authorized to send email for the domain.

Other TXT records in the output show domain verification entries for services such as Google, Microsoft, DocuSign, Cisco, Apple, and others.

Advantages

  • Can reveal domain verification information.
  • Helps identify email security configuration such as SPF.
  • Can reveal third-party services associated with a domain.
  • Useful during DNS reconnaissance.

Disadvantages

  • TXT records can contain large amounts of unrelated information.
  • Verification records do not necessarily indicate an active service.
  • Some domains may expose little or no useful TXT information.

6 SOA Record (type=SOA)

What is it?

The -type=SOA option queries the SOA (Start of Authority) record of a domain.

The SOA record provides important information about the domain's DNS zone, including its primary name server and DNS zone timing values.

Why is it Used?

  • Identify the primary name server.
  • Identify the responsible administrator.
  • Understand DNS zone configuration.
  • Gather DNS infrastructure information during reconnaissance.

Syntax

nslookup -type=SOA <domain>

How it Works

  1. Nslookup sends an SOA record query for the domain.
  2. The DNS resolver retrieves the SOA information.
  3. Nslookup displays the DNS zone details.
  4. Additional name server information may also be displayed.

Example

nslookup -type=SOA google.com

Output:

google.com
        primary name server = ns1.google.com
        responsible mail addr = dns-admin.google.com
        serial  = 962678449
        refresh = 900 (15 mins)
        retry   = 900 (15 mins)
        expire  = 1800 (30 mins)
        default TTL = 60 (1 min)

Result Explanation

  • Primary name server: ns1.google.com
  • Responsible mail address: dns-admin.google.com
  • Serial: Version number of the DNS zone.
  • Refresh: How often secondary servers check for updates.
  • Retry: How long secondary servers wait before retrying a failed zone update.
  • Expire: How long secondary servers can use the zone data if they cannot reach the primary server.
  • Default TTL: Default time DNS records can be cached.

Note

Your output also shows the domain's NS records and their IP addresses because nslookup performs additional related lookups while displaying the SOA response.

The DNS request timed out message indicates that one DNS request did not receive a response within the configured 2-second timeout. The SOA result was still successfully returned.

Advantages

  • Provides detailed DNS zone information.
  • Identifies the primary name server.
  • Shows important DNS timing and zone management values.
  • Useful for DNS reconnaissance.

Disadvantages

  • Does not directly reveal all DNS records.
  • SOA information may provide limited useful information on well-configured domains.

7 CNAME Record (type=CNAME)

What is it?

The -type=CNAME option queries the CNAME (Canonical Name) record of a hostname.

A CNAME record maps one hostname (alias) to another hostname (canonical name).

Why is it Used?

  • Identify hostname aliases.
  • Find the canonical hostname behind an alias.
  • Understand DNS relationships.
  • Identify CDN or third-party infrastructure during reconnaissance.

Syntax

nslookup -type=CNAME <hostname> <DNS-server>

How it Works

  1. Nslookup sends a CNAME query for the hostname.
  2. The DNS resolver checks for a CNAME record.
  3. If a CNAME exists, the canonical hostname is returned.

Example

nslookup -type=CNAME www.spotify.com 8.8.8.8

Output:

Server:  dns.google
Address:  8.8.8.8
Non-authoritative answer:
www.spotify.com canonical name = atc.spotify.map.fastly.net

Result

www.spotify.com
        ↓ CNAME
atc.spotify.map.fastly.net
  • www.spotify.com → Alias/queried hostname.
  • atc.spotify.map.fastly.net → Canonical hostname (CNAME target).
  • 8.8.8.8 → DNS server used for the query.

Advantages

  • Reveals the hostname behind an alias.
  • Useful for identifying CDN and cloud infrastructure.
  • Helps understand DNS relationships during reconnaissance.

Disadvantages

  • Not every hostname has a CNAME record.
  • CNAME information alone does not provide the IP address of the target.

8 PTR Record (type=PTR)

What is it?

The -type=PTR option performs a reverse DNS lookup.

A PTR record maps an IP address to a hostname, which is the opposite of an A record.

Why is it Used?

  • Find the hostname associated with an IP address.
  • Perform reverse DNS reconnaissance.
  • Identify infrastructure associated with an IP address.

Syntax

nslookup -type=PTR <IP-address>

How it Works

  1. Nslookup receives an IP address.
  2. The IP address is converted into the reverse DNS format under in-addr.arpa.
  3. A PTR query is sent to the DNS resolver.
  4. The resolver returns the hostname associated with the IP address.

Example

nslookup -type=PTR 192.178.193.100

Output:

Server:  UnKnown
Address:  fe80::1
Non-authoritative answer:
100.193.178.192.in-addr.arpa    name = ly-in-f100.1e100.net

Result

192.178.193.100
        ↓ PTR
ly-in-f100.1e100.net
  • 192.178.193.100 → IP address being queried.
  • 100.193.178.192.in-addr.arpa → Reverse DNS representation of the IPv4 address.
  • ly-in-f100.1e100.net → Hostname returned by the PTR record.

Advantages

  • Identifies hostnames associated with IP addresses.
  • Useful for reverse DNS reconnaissance.
  • Can provide additional context about an IP address.

Disadvantages

  • Not every IP address has a PTR record.
  • The returned hostname may not reveal the actual service or organization behind the IP.