This is on Win2k3 DNS server.

In troubleshooting some dns issues this morning I started seeing some odd results from nslookup. I searched a bit and found that many believe nslookup is a flawed tool.

My experience this morning suggests this may be the case and nslookup is not giving results based on what DNS actually is.

So, my question is, what is a good replacement dns query tool for Windows? I've seen netdig recommended, but mvptools.com seems to be gone and I can't find a mirror.

  • 2
    What are the problems you are having with nslookup. Every DNS tool based on bind standards has it's own quirks. You should see what nslooup does on HPUX... – Jim B Jul 22 '09 at 16:40
  • that's what I found out today, had never had a problem, but started seeing a difference in what nslookup returned and what was showing in the mmc snapin. The snapin was correct. – jhayes Jul 22 '09 at 19:00
  • NSlookup uses whatever is in the DNS cache - flushing will usually give you the correct responce. I found this out when I tried to use DNS to do a bit of load balancing for terminal server. – Tubs Jul 24 '09 at 7:17

BIND is available for Win32 platforms, and it includes all of the usual query utilities, such as dig and host. You don't need to actually install the server, just unzip the distribution file somewhere and add the directory to your PATH.

A somewhat heavier approach is to install Cygwin and then install the bind package available for it, which comes with all of the same utilities (though not the named server).

| improve this answer | |
  • Anyone who suggests installing Cygwin gets an upvote from me! – user13846 Jul 22 '09 at 17:44
  • 2
    Eww, Cygwin. Perhaps it's improved recently, but I've avoided it for a while since it feels so full of hacks with its 'posix emulation layer' and always seemed terribly slow. I prefer to use tools compiled natively for Windows (eg using MingW32), without the emulation layer. – davr Jul 22 '09 at 17:51
  • The strength of cygwin is it allows you the full ability to hybridize between windows and unix commands. I find quite a bit in my windows shell I say to myself..."Wouldn't it be nice if I had the ability to <insert unix command here> the output of this other windows command?" Cygwin does exactly that for me. I tried a few others but found cygwin was the best of them. Never used MW though. I only used U-Win, MKS and another one I can't remember off hand. How much faster is MW32 that CW? – user13846 Jul 22 '09 at 17:59
  • BIND is not an option for me, we are using built in Windows DNS (yes, I know, nothing I can do about it). I had forgotten about cygwin though, installing now. – jhayes Jul 22 '09 at 19:05
  • 3
    You don't need to run BIND to make use of the utilities included with it. If you want to stay with native Windows binaries instead of using Cygwin, download the zip file (ftp.isc.org/isc/bind9/9.6.1/BIND9.6.1.zip) and unzip it somewhere convenient, then just make sure the directory you put the files in is in your PATH so you can run dig.exe, host.exe, etc. You just won't make use of named.exe (ignore it, delete it, whatever). – James Sneeringer Jul 22 '09 at 19:43

Dig can be found here. But NSlookup on windows seems to be pretty good so far.

| improve this answer | |

I use nslookup on Windows and dig on Linux. I do mostly Windows admin, so whenever I have to use dig \, I have to refresh my memory of how it works. I don't know what problems you've been having, but I've always found that nslookup with the right TYPE=whatever argument works fine.

| improve this answer | |

Just be aware that the problems you are seeing may have nothing to do with nslookup itself. If you are not specifying the server to use it will use whatever DNS server your network config specifies. If that server returns incorrect information, perhaps because it is cached, then so will nslookup. Try pointing it to a different DNS server, preferably one outside your network, and see if you get the same results.

| improve this answer | |

There is a windows version DIG you can try. Here is the link,http://members.shaw.ca/nicholas.fong/dig/

| improve this answer | |

I don't use Microsoft windows so can't advise directly on reliable sources for tools on that platform (I use dig and nslookup under GNU/Linux) but there are plenty of online gateways to dig and other tools, including nslookup, that may be sufficient if you are looking at Internet-based problems. A Google search will turn up lots. I just tried http://www.digdns.org/dig-dns and http://www.kloth.net/services/dig.php and both seemed to work well. Additionally, ISPs often provide these tools on their websites for customers who don't have native tools on their own computers.

| improve this answer | |

nslookup should return exactly "what DNS is". Your results may vary based on what server you point to or the type of query you do, but nslookup can only return what the DNS server offers.

Some additional details on what is different than what you expect would help answer this question.

Commands:   (identifiers are shown in uppercase, [] means optional)
NAME            - print info about the host/domain NAME using default server
NAME1 NAME2     - as above, but use NAME2 as server
help or ?       - print info on common commands
set OPTION      - set an option
    all                 - print options, current server and host
    [no]debug           - print debugging information
    [no]d2              - print exhaustive debugging information
    [no]defname         - append domain name to each query
    [no]recurse         - ask for recursive answer to query
    [no]search          - use domain search list
    [no]vc              - always use a virtual circuit
    domain=NAME         - set default domain name to NAME
    srchlist=N1[/N2/.../N6] - set domain to N1 and search list to N1,N2, etc.
    root=NAME           - set root server to NAME
    retry=X             - set number of retries to X
    timeout=X           - set initial time-out interval to X seconds
    type=X              - set query type (ex. A,ANY,CNAME,MX,NS,PTR,SOA,SRV)
    querytype=X         - same as type
    class=X             - set query class (ex. IN (Internet), ANY)
    [no]msxfr           - use MS fast zone transfer
    ixfrver=X           - current version to use in IXFR transfer request
server NAME     - set default server to NAME, using current default server
lserver NAME    - set default server to NAME, using initial server
finger [USER]   - finger the optional NAME at the current default host
root            - set current default server to the root
ls [opt] DOMAIN [> FILE] - list addresses in DOMAIN (optional: output to FILE)
    -a          -  list canonical names and aliases
    -d          -  list all records
    -t TYPE     -  list records of the given type (e.g. A,CNAME,MX,NS,PTR etc.)
view FILE           - sort an 'ls' output file and view it with pg
exit            - exit the program
| improve this answer | |
  • 2
    "nslookup should return exactly "what DNS is"." I agree that it should, unfortunetely, it doesn't. The MMC DNS snapin shows the correct A record and nslookup to both primary and secondary dns shows the wrong record. After looking around it seems that nslookup has it's own dns cache. – jhayes Jul 22 '09 at 19:07

There are a number of DNS tools you can use that are command line utilities. There are a number of GUI based DNS tools as well. However for what you ask... By far the simplest solution is to google yourself a "Web NSLOOKUP" website and run your queries from there. There are numerous sites out there, so you can just pick the one that strikes your fancy.

This is useful especially when you are trying to query a DNS server on the other side of your own firewall. This will show you what the rest of the world is seeing.

However I would like to make one commend about NSLOOKUP for windows that is relevant here.

It seems that DNS resolution can be cached locally on a workstation itself if the settings for the DNS records are incorrectly set. In some cases I have had to flush the DNS cache to get certain things to work properly. Even on a DNS server I still think it resolves DNS for itself through your local DNS server specified in your network settings by default. So it is important to untangle that detail and the DNS caching first to get a good picture of what is actually going on.

if you don't already know.... to flush the DNS resolved cache is "IPCONFIG /flushdns

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.