CyberArunLog in

Footprinting & Reconnaissance · Module 02

nslookup

Query DNS servers to resolve names and pull records (A, MX, NS, TXT).

ModuleModule 02PhaseFootprinting & ReconnaissanceTypeDefensive / AnalysisPlatformKali Linux

Safe to try on your own machine. Spin up your Kali Linux lab and practice away — on any system you own or have permission to test. That’s exactly how the pros learn.

Definition

nslookup (Name Server Lookup) is a command-line tool used to query DNS servers and retrieve DNS records.

Primary purpose

Resolve domain names to IP addresses and retrieve DNS information.

Cybersecurity use

DNS troubleshooting, network reconnaissance, domain investigation, and security analysis.

Key features

DNS resolution

Retrieves the IP addresses behind domain names.

DNS record lookup

Queries records such as A, AAAA, MX, NS and TXT.

Mail server discovery

Identifies the mail servers for a domain (MX).

Name server identification

Retrieves a domain's authoritative name servers.

Custom DNS queries

Lets you query a specific DNS server.

Interactive mode

Supports multiple DNS queries within one session.

Important commands

nslookup example.com

Retrieve DNS information for a domain.

nslookup example.com 8.8.8.8

Query a specific DNS server.

nslookup -type=A example.com

Query IPv4 address records.

nslookup -type=MX example.com

Retrieve mail exchange (MX) records.

nslookup -type=NS example.com

Retrieve name server records.

nslookup -type=TXT example.com

Retrieve TXT records (may include SPF).

nslookup -type=PTR 8.8.8.8

Reverse DNS lookup for an IP address.

Practical examples

01Resolve a domain
command
nslookup example.com

Purpose Retrieves DNS information, usually an IP address when resolution succeeds.

02Find mail servers
command
nslookup -type=MX example.com

Purpose Displays the available MX records for the domain.

03Identify name servers
command
nslookup -type=NS example.com

Purpose Retrieves the domain's name server records.

04Query a specific DNS server
command
nslookup example.com 8.8.8.8

Purpose Queries Google's public resolver for the domain's DNS info.

Important points

  • A / AAAA record: Map a hostname to an IPv4 / IPv6 address.
  • MX record: Identifies the mail servers that receive email for a domain.
  • NS record: Identifies the name servers for a DNS zone.
  • PTR record: Supports reverse lookups from an IP back to a hostname.
  • DNS caching: Cached records may affect the results a resolver returns.
  • Limitations: A successful lookup does not prove a host is reachable or a service is running.

Common use cases

DNS troubleshooting

Investigate domain resolution failures.

Network reconnaissance

Collect the DNS records tied to a domain.

Mail server analysis

Examine MX records and email infrastructure.

Incident response

Investigate suspicious domains and how they resolve.

Defensive security

Verify DNS configuration and spot DNS-related issues.

Learn it in context

This tool is taught in Module 02

Read the full written notes, with diagrams, defense and detection.

Open Module 02
Back to all tools