Last updated:
nslookup asks a DNS server what a name resolves to. It is the quickest way to check whether a domain points where you expect, which mail servers handle a domain, or whether your Debian machine can resolve names at all. If you are troubleshooting connectivity, pair it with the ping command on Debian.
On minimal Debian installs, containers and many VPS images, nslookup is not installed, and running it gives nslookup: command not found.
Quick answer
sudo apt update
sudo apt install bind9-dnsutilsThis works on both Debian 13 and Debian 12. On Debian 13, sudo apt install dnsutils fails, because that package no longer exists there.
Which package provides nslookup?
Older guides, including the earlier version of this one, tell you to install dnsutils. That name has been retired. We checked the Debian archive directly:
| Debian release | bind9-dnsutils |
dnsutils |
What to run |
|---|---|---|---|
| Debian 13 “Trixie” | Available (BIND 9.20) | Does not exist | sudo apt install bind9-dnsutils |
| Debian 12 “Bookworm” | Available (BIND 9.18) | Empty transitional package that installs bind9-dnsutils |
sudo apt install bind9-dnsutils (or dnsutils) |
The same package also installs dig, nsupdate and delv, so one install covers all the common DNS tools.
Install nslookup
Step 1: Install bind9-dnsutils
sudo apt update
sudo apt install bind9-dnsutils
If apt reports the package is already the newest version, nslookup was already installed and you can skip ahead.
Step 2: Confirm it works
nslookup -version
Expect a 9.18.x version on Debian 12 and 9.20.x on Debian 13.
How to use nslookup
The basic syntax is:
nslookup [-option] [name | -] [server]- name is the domain or IP address to look up.
- server is optional. Without it, nslookup uses the resolver from
/etc/resolv.conf. Add one, such as1.1.1.1, to compare answers between resolvers. - Running
nslookupon its own, or with-as the name, starts interactive mode, where you type queries at a>prompt andexitto leave.
The full option list is in the manual page:
man nslookup
Common lookups at a glance
| Task | Command |
|---|---|
| IP address of a domain (A and AAAA) | nslookup example.com |
| Ask a specific DNS server | nslookup example.com 1.1.1.1 |
| Mail servers | nslookup -type=mx example.com |
| Name servers | nslookup -type=ns example.com |
| TXT records (SPF, verification) | nslookup -type=txt example.com |
| Zone authority (SOA) | nslookup -type=soa example.com |
| Reverse lookup (IP to name) | nslookup 192.0.2.10 |
| Non-standard DNS port | nslookup -port=5353 example.com 127.0.0.1 |
| Full query detail | nslookup -debug example.com |
Example 1: Basic DNS lookup
nslookup google.com
The first two lines show which DNS server answered. The Non-authoritative answer label is normal: it means the answer came from your resolver rather than directly from the domain’s own name servers. To get an authoritative answer, query one of the domain’s NS servers, for example nslookup google.com ns1.google.com.
You can request other record types with -type=. The any type used to return everything:
nslookup -type=any google.com
Many DNS providers now return a minimal or empty answer to ANY queries (it is allowed by RFC 8482). If you need a particular record, ask for it by type rather than relying on any.
Example 2: Reverse DNS lookup
Pass an IP address to find the host name registered for it (its PTR record). This is useful when checking a mail server’s reverse DNS or identifying an address in your logs. To find your own address first, see how to get your IP address on Debian.
nslookup 98.137.11.163
Example 3: Query a DNS server on another port
DNS uses port 53. A local resolver such as dnsmasq or a test server may listen elsewhere:
nslookup -port=5353 example.com 127.0.0.1A connection refused or timeout here means nothing is listening on that port, or a firewall is blocking it.
Example 4: Mail servers (MX records)
nslookup -type=mx google.com
Lower preference numbers are tried first. Save the result for later comparison with:
nslookup -type=mx google.com > mx-records.txtExample 5: Start of Authority (SOA)
nslookup -type=soa google.com
The serial value changes whenever the zone is edited. Comparing it across a domain’s name servers is a quick way to see whether a DNS change has reached all of them.
Example 6: Name servers, sorted
nslookup -type=ns google.com | sort -k 4
NS records name the servers that hold a domain’s DNS records. After moving a domain to Cloudflare or a new host, this is the record to check.
Example 7: Debug mode
nslookup -debug google.com
Debug output shows the question sent, the TTL of each answer and the authority section, which helps when a record looks stale.
Troubleshooting
| Message | Meaning | Fix |
|---|---|---|
nslookup: command not found |
The package is not installed | sudo apt install bind9-dnsutils |
E: Unable to locate package dnsutils |
You are on Debian 13, where dnsutils was removed |
Install bind9-dnsutils instead |
;; connection timed out; no servers could be reached |
No working resolver, or outbound port 53 is blocked | Check /etc/resolv.conf, then try nslookup debian.org 1.1.1.1. If that works, your configured resolver is the problem |
** server can't find example.com: NXDOMAIN |
The name does not exist | Check the spelling, or the record has not been created yet |
** server can't find example.com: SERVFAIL |
The resolver could not get a valid answer, often a broken DNSSEC or name server setup | Try another resolver; if all fail, the domain’s DNS is misconfigured |
| Different answers from different servers | A recent change has not propagated, or caching | Compare the SOA serial on each authoritative server; wait out the TTL |
nslookup vs dig vs host
All three come from the same bind9-dnsutils package (host is pulled in through bind9-host), so you can use whichever suits the task.
| Tool | Best for | Output |
|---|---|---|
nslookup |
Quick checks, interactive mode, familiar from Windows | Readable, compact |
dig |
Detailed troubleshooting, scripting, DNSSEC | Full DNS response sections; +short for answers only |
host |
One-line answers | The shortest |
The host command
Run host without arguments to see its options:
host
For example, host -t mx google.com returns just the mail servers.
The dig command
dig shows the complete DNS response and is what most administrators reach for once nslookup is not enough. See our full guide to using dig on Debian. Its options are listed with:
dig -h
Frequently asked questions
Is nslookup installed on Debian by default?
Not on minimal installs, Docker images or most cloud images. Desktop installs usually include it. If nslookup -version fails, install bind9-dnsutils.
Why does apt install dnsutils fail on Debian 13?
dnsutils was a transitional name kept on Debian 12 to ease the move to bind9-dnsutils. It was dropped in Debian 13, so apt cannot find it. If you upgraded from Debian 12, the tools were carried over through bind9-dnsutils.
How do I check which DNS server my system uses?
Run cat /etc/resolv.conf, or look at the “Server:” line at the top of any nslookup result. To change it permanently, set the DNS servers in your network configuration, as shown in the static IP guide.