dig prints every record in the same five columns. nslookup does something different: it labels each record type in words, which is friendlier to read but means the format changes from type to type.

The per-type formats

  • A / (addresses): a Name: line, then one or more Address: lines. An IPv6 answer sits on an Address line too; you tell it apart by the colons.
  • (mail): example.com mail exchanger = 10 mail.example.com. The number is the preference (lower is preferred) and the rest is the mail host.
  • NS (name servers): example.com nameserver = a.iana-servers.net.
  • (aliases): www.example.com canonical name = example.com. The name on the left is an alias for the target on the right.
  • : example.com text = "v=spf1 -all", with the value quoted.
  • (reverse): 34.216.184.93.in-addr.arpa name = example.com. Note the label is name =, not canonical name =.
  • (services): service = 1 10 5060 sip.example.com., which is priority, weight, port, and target in that order.
  • : unlike the others, this spans several indented lines under a bare name, one field per line: origin, mail addr, serial, and the refresh, retry, expire, and minimum timers.

The one to watch

SOA is the odd one out, because it is the only type nslookup breaks across multiple lines. The mail addr field is a mailbox with the first dot standing in for the @, and minimum doubles as the negative-cache (time to live), so it governs how long a "does not exist" answer for the zone is remembered. If you want the same fields laid out the classic way, dig prints them on a single SOA record line instead.

"Non-authoritative answer" is about cache, not correctness

The line that confuses people most is the one printed before most answers.

It does not mean the answer is doubtful. It means the response came from a resolver's cache rather than from a server authoritative for that zone. A cached answer is usually correct and always faster.

The reason it matters operationally is timing: immediately after a DNS change, a non-authoritative answer is exactly the stale one you do not want to test against. Query the authoritative server directly — server in interactive mode — and the label disappears along with the doubt.