nslookup and dig

nslookup ships on Windows. dig ships with the [BIND 9 utilities][isc-dig].

$ dig @1.1.1.1 isitdns.net

Task by task#

Where they differ#

• Search suffix. nslookup appends the resolver's configured search domain to a bare name before querying; dig never does unless you pass +search. A trailing dot forces the literal name in both. Source: [BIND 9 nslookup manpage][isc-nslookup] (search/nosearch, srchlist).
• A and AAAA together. With no -type given, nslookup queries A and then AAAA and prints both; dig with no type asks only A. Source: [BIND 9 nslookup manpage][isc-nslookup]: "The defaults are A and then AAAA... only the default behavior looks up both."
• No flags line. dig's default output prints the full header (qr aa rd ra ad, RCODE, section counts). nslookup shows none of that unless debug is on: -debug on the command line or set debug in interactive mode; it is off by default. Source: [BIND 9 nslookup manpage][isc-nslookup] (nodebug keyword, default nodebug; "Options can also be specified on the command line if they precede the arguments and are prefixed with a hyphen").
• DNSSEC / AD visibility. dig sets the AD (authentic data) bit on its own queries by default, so a validating resolver's ad flag shows up on a plain lookup (RFC 6840 §5.8); +dnssec also requests the RRSIGs. nslookup has no DNSSEC option: it cannot set DO or display AD. Source: [BIND 9 nslookup manpage][isc-nslookup] (no DNSSEC keyword in the option list).

$ nslookup isitdns.net 1.1.1.1
Server:         1.1.1.1
Address:        1.1.1.1#53

Non-authoritative answer:
Name:   isitdns.net
Address: 104.21.56.211
Name:   isitdns.net
Address: 172.67.155.242
Name:   isitdns.net
Address: 2606:4700:3032::6815:38d3
Name:   isitdns.net
Address: 2606:4700:3036::ac43:9bf2

Non-authoritative answer: labels any response with the Authoritative Answer bit clear, which is every answer relayed by a recursive resolver, cache hit or not (RFC 1035 §4.1.1, the AA bit). nslookup shows the label; it does not show the bit itself. dig's flags line shows aa directly.

[isc-nslookup]: https://bind9.readthedocs.io/en/latest/manpages.html#std-iscman-nslookup [ms-nslookup]: https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/nslookup [isc-dig]: https://bind9.readthedocs.io/en/latest/manpages.html#dig-dns-lookup-utility

See also#

• dig-tool: the in-browser dig on the isitdns front page, which emits dig, kdig, and nslookup equivalents for every query
• dig-along: every common record type, live, hands-on
• dig-flags: the dig flags this wiki uses
• anatomy-of-a-query: what happens between the time you hit Enter and the answer arrives
• query-types: record types and rcodes explained
• dnssec-troubleshooting: where delv comes in
• dot-doh: DoT, DoH, and DoQ for encrypted DNS queries
• ptr: reverse DNS and the in-addr.arpa zone
• [Microsoft Learn: nslookup reference][ms-nslookup]
• [ISC BIND 9: nslookup manpage][isc-nslookup]
• [ISC BIND 9: dig manpage][isc-dig]