The new nslookup: Resolve-DnsName

Nslookup is a command-line tool for dns name resolution. Resolve-DnsName is the modern version of nslookup. In this blog post I am going to show how to use Resolve-DnsName to query DNS host names and much more.

Standard Query

To perform a standard query simply run the command and specify the host name. Format-Table is not necessary, but helpful.

Resolve-DnsName sid-500.com | Format-Table -AutoSize


Query without Host File

Remember: Your host will first query the host file and the DNS client cache. If and only if the host file and the cache return no result, the DNS Server is contacted. To avoid that, run Resolve-DnsName with the -NoHostFile parameter.

Resolve-DnsName sid-500.com -NoHostsFile

Query in Cache-Only Mode

To demontrate this, I will clear the Dns Client Cache and then try to query sid-500.com. This must lead to an error. Bingo!

Resolve-DnsName sid-500.com -CacheOnly


Specify a DNS-Server

Resolve-DnsName without any parameter will contact your primary DNS-Server which is configured in the settings of your network card. The parameter -Server allows you to specify other DNS servers.

Resolve-DnsName sid-500.com -Server | Format-List


Query for Records

Use the Type parameter to query for specific records.

MX Records (Mail-Server)

Resolve-DnsName cnn.com -Type MX


AAAA Records (IPv6 only)

Resolve-DnsName facebook.com -Type AAAA | Format-List


Wait a minute. Did you notice it? No? Then look at the facebook’s IPv6 Address again. 🙄 They have left nothing to chance.


To use only Link Local Multicast name resolution use the LlmnrOnly parameter. LLMNR will only work with computers which share the same local link.

Dc01 and my computer share the same link. It works.

Resolve-DnsName dc01 -LlmnrOnly | Format-Table -AutoSize


Sid-500.com is not on the same link. Which leads to an error.


Triple Name Resolution

"sid-500.com","facebook.com","cnn.com" | Resolve-DnsName -Type A | Format-Table -AutoSize


Another option is to use nslookup with Foreach-Object.

"sid-500.com","facebook.com","cnn.com" | ForEach-Object {nslookup $_}


Run Resolve-DnsName by using a file with Host Names

Use Get-Content to retrieve all the names from your file. Here is my text file …


And this is the command for A records (IPv4 Addresses) …


Or all NS Records …


Resolving DNS Names by using the TCP Connection Table

Ok, let me explain the following a little more closer. Get-NetTCPConnection gives me all current connections by IP-Address. Right? Ok. So, I tried to call all those connections and then decided to catch one of them and run Resolve-DnsName on it 😉


This gives me the connection to and the local Port 12518. Well, that’s enough to proceed.


Resolve-DnsName (Get-NetTCPConnection -State Established -LocalPort 12518).RemoteAddress -Type PTR | Select-Object NameHost


Oh, it’s Microsoft 😉

Link: https://technet.microsoft.com/de-de/library/jj590781%28v=wps.630%29.aspx?f=255&MSPPError=-2147217396

Related Links

For checking network and domain connectivity see my articles The modern version of ping: Test-Connection and Checking connectivity to Active Directory: Test-ComputerSecureChannel.

6 replies »

Leave a Reply

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out /  Change )

Facebook photo

You are commenting using your Facebook account. Log Out /  Change )

Connecting to %s

This site uses Akismet to reduce spam. Learn how your comment data is processed.