# nslookup output explainer > Paste real nslookup output and get a decoded, explained breakdown: the resolver it used, whether the answer is authoritative, every record (with MX / SRV / SOA field breakdowns), and any failures. Parsed entirely in your browser, nothing is resolved or sent anywhere. - Tool: https://ronutz.com/en/tools/nslookup-output-explainer - Family: Networking --- ## What it does Paste the output of an `nslookup` command and the tool decodes it into a structured, explained breakdown: which resolver answered, whether the answer was authoritative, each record with its fields spelled out, and any failure it reported. It parses the text only; nothing is resolved and nothing is sent anywhere. ## Reading nslookup's layout `nslookup` prints DNS answers in a loose, prose-like layout that is quite different from `dig`, and that layout carries meaning worth making explicit. Every answer starts with a **Server** and **Address** header naming the resolver that was queried. A line reading **Non-authoritative answer:** tells you the response came from a cache rather than from a server responsible for the zone; its absence, for a direct query, implies an authoritative answer. When a lookup fails, nslookup prints a line like `** server can't find NAME: NXDOMAIN`, and the tool surfaces that failure and what the status means. ## Records and their fields For most record types nslookup prints a simple `name = value` line, but a few pack several fields into one line or block, and those are the ones worth decoding: - **MX** records read as `mail exchanger = 10 mail.example.com`, where the number is the preference (lower is preferred) and the name is the mail host. The tool separates the two. - **SRV** records (RFC 2782) carry priority, weight, port, and target in one line; the tool breaks them apart so you can see which service host and port they point to. - **SOA** records span several lines: the zone's primary name server, the responsible party's mailbox, and the serial and the timers (refresh, retry, expire, minimum). The tool lays those fields out. ## Using it Paste an `nslookup` response and read the resolver, the authoritative status, each record with its fields, and any error. The parse is deterministic and entirely local; the tool never performs a lookup of its own, which also makes it a safe way to read output captured from somewhere else. ## Standards and references - [RFC 1035 - Domain Names (Implementation and Specification)](https://www.rfc-editor.org/rfc/rfc1035) - [RFC 2308 - Negative Caching of DNS Queries](https://www.rfc-editor.org/rfc/rfc2308) - [RFC 2782 - A DNS RR for specifying the location of services (SRV)](https://www.rfc-editor.org/rfc/rfc2782) - [RFC 8499 - DNS Terminology](https://www.rfc-editor.org/rfc/rfc8499) ## Related reading - [Authoritative vs Non-Authoritative Answers](https://ronutz.com/en/learn/authoritative-vs-non-authoritative-answers.md): The Non-authoritative answer marker in nslookup means the result came from a resolver's cache, not from a server that actually holds the zone. This explains the difference, why it is usually fine, and how to get an authoritative answer when you need one. - [How nslookup Prints Each Record Type](https://ronutz.com/en/learn/nslookup-record-types.md): Instead of dig's fixed columns, nslookup labels each record in prose: mail exchanger =, canonical name =, nameserver =, and a multi-line block for SOA. A short guide to reading each type's line. - [nslookup Errors and What They Mean](https://ronutz.com/en/learn/nslookup-errors-explained.md): When a lookup fails, nslookup prints a line like ** server can't find NAME: CODE. The code is the whole diagnosis. This covers NXDOMAIN, SERVFAIL, REFUSED, and timeouts, what each one tells you, and the first thing to check for each. - [nslookup Interactive Mode](https://ronutz.com/en/learn/nslookup-interactive-mode.md): Run nslookup with no arguments and it drops into an interactive prompt where you can switch resolvers, change the record type, turn on debug output, and look up many names in one session. This covers the handful of commands worth knowing and when interactive beats a one-shot query. - [nslookup vs dig: Which to Use](https://ronutz.com/en/learn/nslookup-vs-dig.md): nslookup and dig both query DNS, but nslookup is terser and hides the header flags and TTLs that dig shows in full. This maps one output onto the other and gives a simple rule for which to reach for. - [Reading nslookup Output](https://ronutz.com/en/learn/reading-nslookup-output.md): nslookup prints a Server / Address header for the resolver it used, an optional Non-authoritative answer marker, and then the answer in a per-type prose format. Knowing that shape lets you read any result quickly and see at a glance whether it succeeded, where it came from, and what it means. - [Reverse DNS Lookups with nslookup](https://ronutz.com/en/learn/reverse-dns-lookups-with-nslookup.md): Reverse DNS maps an IP address back to a name through PTR records that live under in-addr.arpa for IPv4 and ip6.arpa for IPv6. nslookup does this automatically when you hand it an address. This covers how the special reverse name is built, why mail servers care, and why the forward and reverse can legitimately disagree.