dig vs nslookup
What dig and nslookup Are For
When people compare dig vs nslookup, they are choosing between two command-line tools that send DNS queries and display the answers. Both let you ask a specific server for a specific record type, which helps when a website does not behave as expected. Neither is a service; both are programs that run on your own computer.
dig comes from the BIND project, a widely used DNS software suite. nslookup is included with Windows and many Unix-like systems. Because both are standard tools, the choice depends mostly on which output format you prefer and which platform you work on. For a broader view of response codes, see DNS error codes.
How Their Output Differs
nslookup prints a short summary: the server it asked, then the name and address it found. If the answer came from a server that is not authoritative for the zone, it adds the line Non-authoritative answer. That wording confuses many people, because a cached answer from a resolver is still a valid answer. It simply does not come from the zone’s own server.
dig prints the full DNS message in labeled sections. The header shows the status, such as NOERROR or NXDOMAIN, plus a set of flags. The answer section lists the records with their TTL, which counts down when the answer comes from cache. Further sections show authority and additional information, and the footer reports which server answered and how long the query took. For the full lookup sequence behind these answers, see how DNS works.
Key Fields in a dig Answer
Four parts of a dig answer matter most when reading results:
- Status: the response code, such as NOERROR or NXDOMAIN.
- Flags:
aameans the answer came from an authoritative server,rameans the server offers recursive lookups, andadmeans a validating resolver checked the answer with DNSSEC. - ANSWER section: the records returned, each with its remaining TTL.
- SERVER line: which resolver replied, which is useful when comparing networks.
Reading these fields together tells you more than the record alone. An answer with aa set came from the zone itself, while one without it came through a resolver, either from its cache or from a fresh lookup.
Example: Comparing Two Resolvers
Suppose a site loads for a colleague but not for you. You can ask your default resolver and a public DNS server in turn, naming the server directly. For instance, dig @8.8.8.8 example.com A asks one public resolver for the IPv4 address of a name. Compare the ANSWER sections from each server. If the addresses match but the TTL values differ, the difference is most likely caching. If the addresses differ, the two networks may be receiving different answers, for example through location-based DNS.
Frequently asked questions
Is dig or nslookup better on Windows?
Neither is better in general. nslookup is already installed on Windows and gives a quick answer. dig is not included by default, so it must be installed separately, but it shows more detail. PowerShell’s Resolve-DnsName cmdlet is another built-in option with structured output. Choose whichever tool you can run and read comfortably.
Why does nslookup show a different answer than dig?
The most common reason is that the two tools asked different servers, or that one answer came from cache. Check which server each tool used before comparing results. If the server is the same, compare the TTL values and the flags to see whether one answer is cached or authoritative.