12.5. Common TasksThere are little chores you'll come to use nslookup for almost every day: finding the IP address or MX records for a given domain name, or querying a particular name server for data. We'll cover these first, before moving on to the more occasional stuff.
12.5.1. Looking Up Different Record TypesBy default, nslookup looks up the address for a domain name, or the domain name for an address. You can look up any record type by changing the querytype, as we show in this example:
These are only a few of the valid DNS record types, of course. For a more complete list, see Appendix A, "DNS Message Format and Resource Records".% nslookup Default Server: terminator.movie.edu Address: 0.0.0.0 > misery -- Look up address Server: terminator.movie.edu Address: 0.0.0.0 Name: misery.movie.edu Address: 126.96.36.199 > 188.8.131.52 -- Look up domain name Server: terminator.movie.edu Address: 0.0.0.0 Name: misery.movie.edu Address: 184.108.40.206 > set q=mx -- Look up MX records > wormhole Server: terminator.movie.edu Address: 0.0.0.0 wormhole.movie.edu preference = 10, mail exchanger = wormhole.movie.edu wormhole.movie.edu internet address = 220.127.116.11 wormhole.movie.edu internet address = 18.104.22.168 > set q=any -- Look up records of any type > diehard Server: terminator.movie.edu Address: 0.0.0.0 diehard.movie.edu internet address = 22.214.171.124 diehard.movie.edu preference = 10, mail exchanger = diehard.movie.edu diehard.movie.edu internet address = 126.96.36.199
12.5.2. Authoritative Versus Nonauthoritative AnswersIf you've used nslookup before, you might have noticed something peculiar -- the first time you look up a remote domain name, the answer is authoritative, but the second time you look up the same name it is nonauthoritative. Here's an example:
While this looks odd, it really isn't. What's happening here is that the first time the local name server looks up slate.mines.colorado.edu, it contacts the name server for mines.colorado.edu, and the mines.colorado.edu server then responds with an authoritative answer. The local name server, in effect, passes the authoritative response directly back to nslookup. It also caches the response. The second time you look up slate.mines.colorado.edu, the name server answers out of its cache, which results in the answer "non-authoritative." % nslookup Default Server: relay.hp.com Address: 188.8.131.52 > slate.mines.colorado.edu. Server: relay.hp.com Address: 184.108.40.206 Name: slate.mines.colorado.edu Address: 220.127.116.11 > slate.mines.colorado.edu. Server: relay.hp.com Address: 18.104.22.168 Non-authoritative answer: Name: slate.mines.colorado.edu Address: 22.214.171.124
12.5.3. Switching Name ServersSometimes you want to query another name server directly -- you may think it is misbehaving, for example. You can switch servers with nslookup by using the server or lserver command. The difference between server and lserver is that lserver queries your "local" name server -- the one you started out with -- to get the address of the server you want to switch to; server uses the default name server instead of the local server. This difference is important because the server you just switched to may not be responding, as we'll show in this example:
When we start up, our first name server, relay.hp.com, becomes our lserver. This will matter later on in this session.% nslookup Default Server: relay.hp.com Address: 126.96.36.199
At this point, we try to switch back to our original name server. But there is no name server running on galt.cs.purdue.edu to look up relay.hp.com's address:> server galt.cs.purdue.edu. Default Server: galt.cs.purdue.edu Address: 188.8.131.52 > cs.purdue.edu. Server: galt.cs.purdue.edu Address: 184.108.40.206 *** galt.cs.purdue.edu can't find cs.purdue.edu.: No response from server
Instead of being stuck, though, we use the lserver command to have our local name server look up relay.hp.com's address:> server relay.hp.com. *** Can't find address for server relay.hp.com.: No response from server
Since the name server on galt.cs.purdue.edu did not respond -- that host isn't even running a name server -- it wasn't possible to look up the address of relay.hp.com to switch back to using relay 's name server. Here's where lserver comes to the rescue: the local name server, relay, was still responding, so we used it. Instead of using lserver, we also could have recovered by using relay's IP address directly -- server 220.127.116.11.> lserver relay.hp.com. Default Server: relay.hp.com Address: 18.104.22.168 > ^D
You can even change servers on a per-query basis. To specify that you'd like nslookup to query a particular name server for information about a given domain name, you can specify the server as the second argument on the line, after the domain name to look up, like so:
And, of course, you can change servers from the command line. You can specify the server to query as the argument after the domain name to look up, like this:% nslookup Default Server: relay.hp.com Address: 22.214.171.124 > saturn.sun.com. ns.sun.com. Name Server: ns.sun.com Address: 126.96.36.199 Name: saturn.sun.com Addresses: 188.8.131.52 > ^D
This instructs nslookup to query terminator.movie.edu for MX records for fisherking.movie.edu.% nslookup -type=mx fisherking.movie.edu. terminator.movie.edu.
Finally, to specify an alternate default name server and enter interactive mode, you can use a hyphen in place of the domain name to look up:
% nslookup - terminator.movie.edu.
Copyright © 2002 O'Reilly & Associates. All rights reserved.