Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I want to get pairs of name server - ip for some domain. For example, there is domain. I want to get:


Is it possible? I try to use the nslookup, but I have no success.

Update. I find out the command: C:\Users\Nick>nslookup -type=ns, but it is not work for me:

C:\Users\Nick>nslookup -type=ns
Server:  UnKnown

Non-authoritative answer: nameserver = nameserver = nameserver = nameserver =
share|improve this question

closed as off-topic by Jenny D, Dave M, mdpc, Falcon Momot, dawud Sep 21 '13 at 9:08

This question appears to be off-topic. The users who voted to close gave this specific reason:

  • "Questions must demonstrate a minimal understanding of the problem being solved. Try including attempted solutions, why they didn't work, and the expected results. See How can I ask better questions on Server Fault? for further guidance." – Jenny D, Dave M, mdpc, dawud
If this question can be reworded to fit the rules in the help center, please edit the question.

up vote 3 down vote accepted

To find the nameservers of a given domain, you can use nslookup to grab the SOA record. Using as an example:

C:\> nslookup
Default Server: <foo>
Address: <bar>

> set type=SOA
Server: <foo>
Address: <bar>

Non-aithoritative answer:
        primary name server =
        responsible mail addr =
        serial  = 2013072101
        refresh = 600 (10 mins)
        retry   = 600 (10 mins)
        expire  = 604800 (7 days)
        default TTL = 1440 (24 mins) nameserver = nameserver =
> exit


Then you simply run nslookup against the listed nameservers to get the corresponding IPs.

share|improve this answer

The part of the / a query you want is called "authority." The record type is called NS.

I use "dig" for this. Because Windows is lacking in tools, I install the (free, open-source) Cygwin package at it includes it.

nslookup can also do this and is available by default on Windows systems. On my older Windows system, the nslookup that comes with can give you this via (at least) via either asking for "all records" or "ns records".

Here's doing it with my XP box's cmd prompt for

> set type=NS

Non-authoritative answer:      nameserver =      nameserver =      nameserver =      nameserver =  internet address =  internet address =  internet address =  internet address =

The following is the help screen for the Windows XP Corporate Edition nslookup:

Commands:   (identifiers are shown in uppercase, [] means optional)

NAME - print info about the host/domain NAME using default server NAME1 NAME2 - as above, but use NAME2 as server help or ? - print info on common commands set OPTION - set an option all - print options, current server and host [no]debug - print debugging information [no]d2 - print exhaustive debugging information [no]defname - append domain name to each query [no]recurse - ask for recursive answer to query [no]search - use domain search list [no]vc - always use a virtual circuit domain=NAME - set default domain name to NAME srchlist=N1[/N2/.../N6] - set domain to N1 and search list to N1,N2, etc. root=NAME - set root server to NAME retry=X - set number of retries to X timeout=X - set initial time-out interval to X seconds type=X - set query type (ex. A,ANY,CNAME,MX,NS,PTR,SOA,SRV) querytype=X - same as type class=X - set query class (ex. IN (Internet), ANY) [no]msxfr - use MS fast zone transfer ixfrver=X - current version to use in IXFR transfer request server NAME - set default server to NAME, using current default server lserver NAME - set default server to NAME, using initial server finger [USER] - finger the optional NAME at the current default host root - set current default server to the root ls [opt] DOMAIN [> FILE] - list addresses in DOMAIN (optional: output to FILE) -a - list canonical names and aliases -d - list all records -t TYPE - list records of the given type (e.g. A,CNAME,MX,NS,PTR etc.) view FILE - sort an 'ls' output file and view it with pg exit - exit the program

The following is the first of the "man pages" for dig:

DIG(1)                               BIND9                              DIG(1)

NAME dig - DNS lookup utility

SYNOPSIS dig [@server] [-b address] [-c class] [-f filename] [-k filename] [-m] [-p port#] [-q name] [-t type] [-x addr] [-y [hmac:]name:key] [-4] [-6] [name] [type] [class] [queryopt...]

   dig [-h]

   dig [global-queryopt...] [query...]

DESCRIPTION dig (domain information groper) is a flexible tool for interrogating DNS name servers. It performs DNS lookups and displays the answers that are returned from the name server(s) that were queried. Most DNS administrators use dig to troubleshoot DNS problems because of its flexibility, ease of use and clarity of output. Other lookup tools tend to have less functionality than dig.

   Although dig is normally used with command-line arguments, it also has
   a batch mode of operation for reading lookup requests from a file. A
   brief summary of its command-line arguments and options is printed when
   the -h option is given. Unlike earlier versions, the BIND 9
   implementation of dig allows multiple lookups to be issued from the
   command line.

   Unless it is told to query a specific name server, dig will try each of
   the servers listed in /etc/resolv.conf.

   When no command line arguments or options are given, dig will perform
   an NS query for "." (the root).

   It is possible to set per-user defaults for dig via ${HOME}/.digrc.
   This file is read and any options in it are applied before the command
   line arguments.

   The IN and CH class names overlap with the IN and CH top level domains
   names. Either use the -t and -c options to specify the type and class,
   use the -q the specify the domain name, or use "IN." and "CH." when
   looking up these top level domains.
share|improve this answer
Sorry the formatting got a bit screwed up - I'm not sure how to fix it! ...But the data is there!... – Richard T Sep 20 '13 at 12:05
Thank you very much for the wonderful response. – Denis Sep 21 '13 at 6:44

The most concise I can think of is using dig:

$ dig +noall +additional -t ns         27791   IN      A         27791   IN      A         27791   IN      A         27791   IN      A

Note that these are actually the cached glue records, though. If you want the answer from the authoritative nameserver itself, you'll need to ask it directly. Easiest way to do that is with +trace, then just look at the last response you get.

$ dig +trace +noall +additional ns     85952   IN      A     85952   IN      AAAA    2001:dc3::35     85952   IN      A     85952   IN      AAAA    2001:503:ba3e::2:30     85952   IN      A     85952   IN      AAAA    2001:500:1::803f:235     41980   IN      A     41980   IN      AAAA    2001:500:2d::d     85952   IN      A     85952   IN      A     85952   IN      AAAA    2001:503:c27::2:30     85952   IN      A     85952   IN      A
;; Received 509 bytes from in 6 ms     172800  IN      A     172800  IN      AAAA    2001:503:a83e::2:30     172800  IN      A     172800  IN      AAAA    2001:503:231d::2:30     172800  IN      A     172800  IN      A     172800  IN      A     172800  IN      A     172800  IN      A     172800  IN      A     172800  IN      A     172800  IN      A     172800  IN      A     172800  IN      A
;; Received 500 bytes from in 148 ms         172800  IN      A         172800  IN      A         172800  IN      A         172800  IN      A
;; Received 164 bytes from in 174 ms         345600  IN      A         345600  IN      A         345600  IN      A         345600  IN      A
;; Received 164 bytes from in 12 ms

Generally these are the same, but if the domain is in the middle of switching nameservers, it could differ.

share|improve this answer
Thank you very much for the wonderful response. – Denis Sep 21 '13 at 6:46

Not the answer you're looking for? Browse other questions tagged or ask your own question.