Support Library
nslookup vs dig
nslookup and dig side by side: equivalent commands, what each can and cannot show, and why their answers sometimes differ.
The short answer
Both tools send DNS queries and print the answers. nslookup is built into Windows and is fine for a quick "what does this name resolve to." dig shows the full reply, including the response code, header flags, TTLs and every section, so it is the better tool when you need to know why an answer is what it is. When the two disagree, the cause is almost always that they asked different servers, not the tool itself.
Side by side
| Task | nslookup | dig |
|---|---|---|
| Address lookup | nslookup example.com | dig example.com |
| Another record type | nslookup -type=MX example.com | dig example.com MX |
| Ask a specific server | nslookup example.com 1.1.1.1 | dig @1.1.1.1 example.com |
| Reverse lookup | nslookup 192.0.2.10 | dig -x 192.0.2.10 |
| Answer data only | Not available | dig +short example.com |
| No recursion | nslookup -norecurse example.com ns1.example.net | dig +norecurse @ns1.example.net example.com |
| Use TCP | nslookup -vc example.com | dig +tcp example.com |
| Show TTLs and flags | nslookup -debug example.com | Shown by default |
| Follow the delegation from the root | Not available | dig +trace example.com |
| DNSSEC records and the AD flag | Not supported | dig +dnssec example.com |
Why their answers can differ
- Different resolvers. dig reads /etc/resolv.conf. nslookup on Windows uses the first DNS server of the active network adapter and does not go through the Windows DNS Client cache, so it can disagree with what browsers see.
- Search suffixes. nslookup appends the system's DNS suffixes to names without a trailing dot, so nslookup intranet may really ask for intranet.corp.example. Add a trailing dot to stop it.
- Non-authoritative label. nslookup prints "Non-authoritative answer" for anything from a resolver's cache. It is normal, not an error.
- Hosts file and VPN rules. Neither tool reads the hosts file, and neither follows the per-domain rules some VPN clients and Windows NRPT policies apply. Use Resolve-DnsName in PowerShell to see what Windows applications get.
Which to use
Use nslookup on a Windows machine without other tools, or when following instructions written for it; the nslookup command guide covers it in detail. Use dig for anything involving DNSSEC, delegation, TTLs or response codes; see the dig command deep dive. On Windows, PowerShell's Resolve-DnsName shows TTLs and sections too and needs no install.
How DNS Panopticon helps
Domain Visualizer runs a domain's core lookups for you through a public resolver and shows the records with their TTLs, which is a quick way to compare against what nslookup or dig shows on your own network. A difference usually points at your local resolver or its cache.