Insight: Diving into DNS with Linux nslookup—A Beginner's Guide for Ubuntu Users

Insight: Diving into DNS with Linux nslookup—A Beginner's Guide for Ubuntu Users

Welcome back, Ubuntu explorers! Yesterday, we dipped our toes into the world of DNS with the dig command. Today, we're going to explore another useful tool for querying Domain Name System (DNS) servers: the nslookup command. While dig offers a more comprehensive set of features, nslookup provides a simpler and often more straightforward way for beginners to perform common DNS lookups.

Think of DNS as the internet's phonebook. When you type a website address like www.ubuntu.com into your browser, your computer needs to translate that human-readable name into a numerical IP address that servers understand. Both nslookup and dig help you perform this translation and gather other DNS-related information.

Basic Lookups with nslookup

Let's start with the most fundamental task: finding the IP address associated with a domain name. Open your Ubuntu terminal (Ctrl+Alt+T) and type:

Bash

nslookup www.ubuntu.com  

You should see output similar to this:

Bash

Server:         192.168.1.1
Address:        192.168.1.1#53

Non-authoritative answer:
www.ubuntu.com  canonical name = canonical.ubuntu.com.
Name:   canonical.ubuntu.com
Address: 91.189.91.26
Address: 91.189.91.27  

Let's break down this output:

• Server: This line shows the IP address of the DNS server your system is currently using (in this case, likely your router).
  
  
• Address: This is the IP address of that DNS server followed by the port number (53 is the standard port for DNS).
  
  
• Non-authoritative answer: This indicates that the DNS server you queried isn't the ultimate authority for the ubuntu.com domain but rather provided an answer from its cache.
  
  
• canonical name = canonical.ubuntu.com. Some websites use a "canonical name" or alias. Here, www.ubuntu.com points to canonical.ubuntu.com.
  
  
• Name: This shows the actual domain name for which the IP address is being provided.
  
  
• Address: These are the IP addresses associated with canonical.ubuntu.com. You might see multiple IP addresses, which can indicate multiple servers hosting the website for redundancy and load balancing.

Looking Up Different Record Types

DNS records come in various types, each holding different kinds of information. nslookup allows you to query for specific record types using the -type= option. Here are a few common ones:

MX (Mail Exchanger): 

To find the mail servers responsible for handling email for a domain:

Bash

nslookup -type=mx ubuntu.com  

The output will show the priority and hostname of the mail servers. Lower priority numbers indicate more preferred servers.


NS (Name Server): 

To find the authoritative name servers for a domain:

Bash

nslookup -type=ns ubuntu.com  

These are the servers that hold the primary DNS records for the domain.


TXT (Text): 

These records can contain arbitrary text information and are often used for verification purposes (like SPF records for email authentication):

Bash

nslookup -type=txt ubuntu.com  

CNAME (Canonical Name): 

As we saw earlier, this record creates an alias for a domain name:

Bash

nslookup -type=cname www.ubuntu.com  

A (Address): 

This is the basic record we looked at initially, mapping a hostname to an IPv4 address. You can explicitly ask for A records:

Bash

nslookup -type=a ubuntu.com  

AAAA (IPv6 Address): 

For looking up IPv6 addresses:

Bash

nslookup -type=aaaa ubuntu.com  

Specifying a Different DNS Server

By default, nslookup uses the DNS server configured on your system. However, you can specify a different DNS server to query by providing its IP address after the domain name:

Bash

nslookup www.google.com 8.8.8.8  

In this example, we're querying Google's public DNS server (8.8.8.8) for the IP address of www.google.com. This can be useful for troubleshooting or comparing results from different DNS servers.

Interactive Mode

nslookup also has an interactive mode. You can enter it by simply typing nslookup in your terminal and pressing Enter. You'll see a > prompt. Here, you can enter domain names or commands. For example:

Bash

> www.debian.org
Server:         192.168.1.1
Address:        192.168.1.1#53

Non-authoritative answer:
Name:   www.debian.org
Address: 151.101.12.132
Address: 151.101.116.132
Address: 151.101.64.132
Address: 151.101.4.132
Address: 2a04:4e4:2::64
Address: 2a04:4e4:3::64
Address: 2a04:4e4:8::64
Address: 2a04:4e4:9::64  

You can change the query type within interactive mode using the set type= command:

Bash

> set type=mx
> ubuntu.com
Server:         192.168.1.1
Address:        192.168.1.1#53

Non-authoritative answer:
ubuntu.com      mail exchanger = 10 mail.canonical.com.
ubuntu.com      mail exchanger = 20 mail-backup.canonical.com.  

To exit interactive mode, type exit and press Enter.

nslookup vs. dig: A Quick Note

As we mentioned at the beginning, dig is often considered the more powerful and flexible DNS lookup tool. It provides more detailed output and offers a wider range of options for crafting specific DNS queries. However, for simple and common DNS lookups, nslookup can be a quicker and easier tool for beginners to grasp.

Think of nslookup as a good starting point for understanding DNS basics. Once you're comfortable with it, you might find yourself exploring the more advanced capabilities of dig.

Conclusion

nslookup is a valuable tool in your Ubuntu toolkit for understanding how domain names are resolved to IP addresses and for querying various types of DNS records. Experiment with the commands we've covered, try looking up different websites and record types, and you'll gain a better understanding of the internet's fundamental naming system. Happy exploring!

Need Ubuntu Expertise?

We'd love to help you with your Ubuntu projects.  Feel free to reach out to us at info@pacificw.com.

Written by Aaron Rose, software engineer and technology writer at Tech-Reader.blog.