Authoritative vs Non-Authoritative Answers

The Non-authoritative answer marker in nslookup means the result came from a resolver's cache, not from a server that actually holds the zone. This explains the difference, why it is usually fine, and how to get an authoritative answer when you need one.

When nslookup prints Non-authoritative answer: before a result, it is telling you something specific about where that answer came from.

Two kinds of server

DNS has authoritative servers and recursive resolvers. An authoritative server holds the actual zone data for a domain; it is the source of truth. A recursive resolver (like 1.1.1.1 or 8.8.8.8, or your 's) does not own any zones. It answers on your behalf by asking the authoritative servers and then caching the result for its (time to live).

When you query a recursive resolver and it answers from that cache, the answer is non-authoritative: correct, but a copy, possibly a few seconds or minutes old. That is what the marker means. When the marker is absent, you reached a server that is authoritative for the name, and the data came straight from the zone.

Why non-authoritative is usually fine

For everyday lookups, a non-authoritative answer is exactly what you want: it is fast, and the TTL keeps it fresh enough. Caching is the whole reason DNS scales. You only care about the distinction when the cache might be stale, which is precisely when you have just changed a record and are waiting for the world to catch up.

Getting an authoritative answer

If you need the current truth, bypass the cache and ask an authoritative server directly. Find the zone's name servers (an NS lookup), then query one of them: in nslookup, run server ns1.example.com. and then the name; in dig, use dig @ns1.example.com example.com. The answer will come back without the non-authoritative marker (and in dig, with the aa flag set), telling you that you are looking at the zone itself rather than someone's cached copy of it.

Authoritative is about provenance, not accuracy

An authoritative answer comes from a server holding the zone; a non-authoritative one comes from a cache. Neither label says the answer is right.

An authoritative server can serve a zone that was edited wrongly an hour ago and answer with complete confidence. A cached answer can be perfectly correct and merely old. The words describe where the data came from, and correctness is a separate question the protocol does not answer.

The place it matters is timing. After a change, only the authoritative server can tell you whether the change is live; every resolver in the path will keep serving what it holds until the TTL expires, and that is not a fault to escalate — it is the design working.