Summary of nslookup command and its accompanying DNS noun explanation

read the basic requirements of this article:
1. The use of the cmd command has a certain basis
2. The basic principles of DNS and common concepts have a certain understanding, such as host, alias, forward lookup zone, reverse lookup zone, and so on.
3. A simple understanding of network protocols, such as the basic configuration of TCP/IP

Nslookup is a command-line tool issued by Microsoft for detection and debugging.
As an IT manager, must be on the Windows platform of the use of nslookup command tools, skilled in the heart, the only way to better network configuration check and error.

Since it is important to say nslookup command, what can it do? Do not worry, we will be introduced in the following.

Prerequisites for using Nslookup:
Operational platform: Available in Windows NT/2000/XP, but not integrated with Windows 98
Protocol: The host computer must have the TCP/IP protocol installed

There are 2 modes of nslookup and non interactive modes.
Non-interactive mode: Direct input command in cmd command, return corresponding data
nslookup [-option] [hostname] [Server]

Interactive mode:
Just enter nslookup at the command line and enter the nslookup interactive command line, exit enter exit
>nslookup
Default Server:nameserver1.domain.com
address:10.0.0.1
>
function Introduction and example Description:
1. Resolve the domain name into IP address
Format:
Nslookup Domain Name
Nslookup Set qt=a domain name
If we need to specify a DNS server for domain resolution, you can use the following format
Nslookup Domain DNS server address
such as: nslookup www.163.com 202.96.64.68 (Dalian DNS server)

Someone will say "I use ping also can resolve domain name to IP address, why need nslookup." ”。 OK, let's take www.163.com as an example, using nslookupwww.163.com and ping www.163.com respectively, to see the specific feedback, through one by one instructions to see what the difference is.
Nslookup www.163.com
Screenshots:

Analysis:
The first part:
**can ' t find server name for address 202.96.69.38:server failed
Server:ns.lnpta.net.cn
address:202.96.64.68

There are 2 IP addresses, 202.96.69.38 and 202.96.64.68, and what they are intrinsically related to. Usually the computer will go to the DNS server to resolve the domain name, we use Ipconfig/all to see if they are DNS servers (I experimental Environment ADSL dial-up network), get feedback as follows

This means that 202.96.69.38 and 202.96.64.68 are the 2 primary and secondary DNS servers for my current computer.
The client first went to the primary DNS Server 202.96.69.38 for a connection query, and the result found an exception, and the connection failed, so the **can ' t find Server name for address 202.96.69.38:server Failed this hint, follow the rule primary DNS cannot connect, will automatically go to the secondary DNS 202.96.64.68 to connect, get feedback: Server:ns.lnpta.net.cn
address:202.96.64.68
Where Server:ns.lnpta.net.cn refers to the 202.96.64.68 corresponding hostname, (can be simply understood as the computer name, although inaccurate ^&^), we obtained the domain name information for the springboard through this DNS server.
Part II:
Non-authoritative Answer:
Name:www.cache.gslb.netease.com

Non-authoritative answer: Translated into Chinese as "non-authoritative answer", what is called "non-authoritative answer". Here again a little common sense, assuming that a DNS server does not have a domain name test.com record information, when a client through it request to obtain test.com domain name information, this DNS server through the iterative recursive way from the test company actually store this record information DNS Server to obtain test.com domain information, feedback to the requesting client, while the test.com record information placed in its own cache for a period of time, when there is a client request test.com domain name resolution, this DNS The server directly extracts it from its own cache and returns it to the client, which is called "non-authoritative answer", in short, the answer to the domain name resolution that is obtained from the non-physical record storage DNS server is called "non-authoritative answer".
Name:www.cache.gslb.netease.com refers to the actual host name record of the www.163.com domain name.

Part III:
addresses:61.135.253.17, 61.135.253.18, 61.135.253.10, 61.135.253.11
61.135.253.12, 61.135.253.13, 61.135.253.14, 61.135.253.15, 61.135.253.16
Aliases:www.163.com

Address has multiple records: 61.135.253.17/18/16/12., Through this we know in fact, 163.com domain name actually corresponds to multiple physical hosts, users visit www.163.com, according to a certain rule by one of the computer to answer, this can effectively carry out the domain name load balance, careful down machine oh.
Aliase:www.163.com: Indicates that www.163.com is just an alias in the DNS record to facilitate our memory

Ping www.163.com
(Small Knowledge ping command uses ICMP protocol)

By pinging, we see that we can only get one of the many IP addresses above via nslookup, and that this IP address is not fixed, nor is it possible to know which DNS server we are getting the domain name resolution information from.
The difference between Ping and Nslookup is detailed to this already at a glance.

Introduction to Error Types
1 * * * * DNS serever can ' t find "domain name" non-existent domain
This indicates that DNS server is working correctly, but the corresponding DNS record information is not found, and you need to log on to DNS server to view the forward zone or reverse zone, and whether the IP address records for the domain name have been added to the DNS database
2 * * * Can ' t find server name to Domain:no response from server
3) * * * * * * *: non-existent domain
This indicates that the test host is not able to find a DNS server available at all in the current network. At this point, we want to fully detect the connectivity of the entire network, and check whether the DNS server is in normal working state, using a step-by-step method to find out the source of the DNS service can not start
2. Reverse parsing, by IP address, resolution domain name
Format
Nslookup–qt=ptr 192.168.1.45
Or
nslookup carriage return
Set QT=PTR carriage return
192.168.1.45 carriage return, come to the result
Note Qt must be lowercase
There is a forward zone and a reverse zone in the DNS server; The forward zone is the name corresponding to the IP address; the reverse zone is the corresponding name of the reverse store of the IP address; With this command, you can confirm that there is no exception to the reverse record of the domain name.

3. Query mail server information
Domain administrators sometimes want to view information about mail servers within a domain, and you can use the following command
Format:
NSLOOKUP–QT=MX www.163.com
This command allows you to view the IP list of the mail server for the domain (if it is more than one mail server), and the corresponding basic level perference, where the smaller the number, the higher the priority level.

4. View named server NS
NS is a domain name corresponding to multiple servers, which server to the domain name and satellite records to resolve.
Format:
Nslookup–qt=ns www.test.com

5. View the time the DNS cache record was saved
Format
Nslookup–d3 test.com

The TTL is the time that the cache is reserved.