nslookup and dig for DNS in Linux CLI - Step-by-Step Execution

Concept Flow - nslookup and dig for DNS

Start Command

↓

Send DNS Query

↓

Receive DNS Response

↓

Parse Response

↓

Display Results

↓

End

The command sends a DNS query, waits for the response, parses it, and then shows the results.

Execution Sample

Linux CLI

nslookup example.com

dig example.com

These commands ask DNS servers for information about example.com and show the answers.

Execution Table

Step	Command	Action	Output Example	Notes
1	nslookup example.com	Send DNS query for example.com	Server: 8.8.8.8 Address: 8.8.8.8 Non-authoritative answer: Name: example.com Address: 93.184.216.34	nslookup sends query and shows IP address
2	dig example.com	Send DNS query for example.com	; <<>> DiG 9.16.1-Ubuntu <<>> example.com ;; global options: +cmd ;; Got answer: ;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 12345 ;; ANSWER SECTION: example.com. 86400 IN A 93.184.216.34 ;; Query time: 30 msec ;; SERVER: 8.8.8.8#53(8.8.8.8) ;; WHEN: Thu Jun 01 12:00:00 UTC 2023 ;; MSG SIZE rcvd: 56	dig shows detailed DNS response including header and answer
3	nslookup invalid.domain	Send DNS query for invalid.domain	Server: 8.8.8.8 Address: 8.8.8.8 ** server can't find invalid.domain: NXDOMAIN	Shows error when domain not found
4	dig invalid.domain	Send DNS query for invalid.domain	; <<>> DiG 9.16.1-Ubuntu <<>> invalid.domain ;; global options: +cmd ;; Got answer: ;; ->>HEADER<<- opcode: QUERY, status: NXDOMAIN, id: 54321 ;; Query time: 20 msec ;; SERVER: 8.8.8.8#53(8.8.8.8) ;; WHEN: Thu Jun 01 12:01:00 UTC 2023 ;; MSG SIZE rcvd: 45	dig shows NXDOMAIN status for not found domain
5	End	No more queries	Command prompt returns	Execution ends

💡 Commands finish after receiving and displaying DNS responses or errors.

Variable Tracker

Variable	Start	After nslookup example.com	After dig example.com	After nslookup invalid.domain	After dig invalid.domain	Final
DNS Query	None	example.com	example.com	invalid.domain	invalid.domain	None
DNS Response Status	None	NOERROR	NOERROR	NXDOMAIN	NXDOMAIN	None
IP Address	None	93.184.216.34	93.184.216.34	None	None	None

Key Moments - 3 Insights

Why does nslookup show 'Non-authoritative answer'?

Because the DNS server is not the original source for the domain info but has cached it. See execution_table row 1.

What does NXDOMAIN mean in the output?

It means the domain does not exist. Both nslookup and dig show this in rows 3 and 4.

Why does dig output more details than nslookup?

dig shows the full DNS response including headers and timing, while nslookup shows a simpler summary. See rows 1 and 2.

Visual Quiz - 3 Questions

Look at the execution table, what is the IP address returned by nslookup for example.com?

A 93.184.216.34

B 8.8.8.8

C NXDOMAIN

D No IP address

💡 Hint

Check execution_table row 1 under Output Example for nslookup example.com

At which step does the DNS query return a 'NXDOMAIN' status?

A Step 1

B Step 2

C Step 3

D Step 5

💡 Hint

Look at execution_table rows 3 and 4 for NXDOMAIN status

If you change the domain to a valid one, how would the 'DNS Response Status' change in variable_tracker?

A It would stay NXDOMAIN

B It would change to NOERROR

C It would become UNKNOWN

D It would be empty

💡 Hint

See variable_tracker row for DNS Response Status after valid domain queries

Concept Snapshot

nslookup and dig send DNS queries to get domain info.
nslookup shows simple answers; dig shows detailed info.
Both report errors like NXDOMAIN if domain not found.
Use these commands to check domain IPs and DNS records.
nslookup is simpler; dig is more detailed and flexible.

Full Transcript

This lesson shows how nslookup and dig commands work to query DNS servers. When you run nslookup example.com, it sends a DNS query and shows the IP address if found, or an error if not. dig example.com does the same but shows more details like headers and query time. If the domain does not exist, both commands show NXDOMAIN status. The execution table traces each command step by step, showing the query sent, the response received, and the output displayed. The variable tracker follows key values like the domain queried, response status, and IP address found. Key moments clarify common confusions such as the meaning of 'Non-authoritative answer' and NXDOMAIN. The visual quiz tests understanding by asking about IP addresses returned, when NXDOMAIN appears, and how response status changes with different domains. The quick snapshot summarizes the commands and their behavior simply. This helps beginners see exactly how DNS queries work in practice.