nslookup: Resolve Names and Test Resolvers in CI
nslookup queries DNS for a name and prints the resolved records along with the server that answered.
nslookup is the DNS tool that ships almost everywhere, so it is often what you have when dig is missing. It resolves names and lets you aim the query at a specific resolver to isolate a broken default.
What it does
nslookup sends a DNS query and prints the answer plus the address of the server that responded, labeled authoritative or non-authoritative. You can set the record type and target a specific resolver by passing it as the second argument.
Common usage
nslookup api.example.com
# query a specific resolver as the second argument
nslookup api.example.com 8.8.8.8
# request a specific record type
nslookup -type=MX example.com
nslookup -type=AAAA api.example.comOptions
| Argument | What it does |
|---|---|
| -type=<t> | Record type: A, AAAA, MX, TXT, CNAME, NS, PTR |
| <name> <server> | Resolve name using server as the resolver |
| -debug | Print the full response detail |
| -port=<n> | Query DNS on a non-standard port |
In CI
The "Non-authoritative answer" label is normal and not an error: it just means the answer came from a cache, not the authoritative server. To tell a resolver problem from a record problem, run nslookup name 8.8.8.8; if the public resolver works and the default does not, fix the container DNS.
Common errors in CI
"server can't find <name>: NXDOMAIN" means the record does not exist. ";; connection timed out; no servers could be reached" or ";; communications error ... timed out" means /etc/resolv.conf points at an unreachable resolver. "server can't find <name>: SERVFAIL" means the resolver failed upstream. On busybox, nslookup is a slimmer applet that ignores some of these flags.