nslookup

nslookup is the DNS query tool that ships on both Windows and *NIX. It’s available everywhere, which makes it the fallback resolver on Windows (where dig is not installed by default) and a reliable post-exploitation reconnaissance tool. Microsoft documents it in the Windows Commands reference.

Basic syntax

Only the domain is required; an optional record type and name server can be supplied:

nslookup -type=$QUERY_TYPE $DOMAIN $NAME_SERVER
 
# Examples
nslookup -type=A  microsoft.com 8.8.8.8
nslookup          tryhackme.com 1.1.1.1
nslookup -type=MX google.com

Omitting $NAME_SERVER queries the system’s configured resolver; specifying one tests a specific server directly (useful for confirming a server will answer for a zone, or for DNS-based data exfiltration checks).

Interactive mode and zone transfer

Running nslookup with no arguments drops into an interactive shell. From here you can point at a target server and enumerate records:

> server 1.2.3.4            # set the resolver to query
> set type=any              # return all record types
> example.com               # query the domain
> ls -d example.com         # attempt a full zone listing / transfer

ls -d $DOMAIN attempts to list all records for the zone — effectively a zone transfer (AXFR). Most public servers refuse it, but a misconfigured authoritative server that allows AXFR to anyone hands over the entire zone file: every host, subdomain, MX, and TXT record. That’s a high-value reconnaissance win, so it’s always worth the attempt against a target’s name servers.

Recon notes

• set type=MX / NS / TXT / SOA narrows or broadens what you pull; TXT records frequently leak SPF data, verification tokens, and internal hostnames.
• Because nslookup is a signed, built-in Microsoft binary, its DNS traffic blends into normal resolver noise — handy for living-off-the-land lookups on a hardened host.

Sources

• nslookup — Microsoft Windows Commands reference

Related

• dig — the more powerful Unix DNS tool (AXFR, +short, +trace)
• nip-io — wildcard-DNS hostnames for arbitrary IPs
• windows-reconnaissance-commands — broader command-line enumeration toolkit
• netstat — sibling built-in triage tool