Use Windows DNS tools without changing DNS
Windows nslookup can help a support operator inspect authentication dependencies without opening a DNS control panel. The useful output is an attributable answer to a particular name and record type. A screenshot containing a familiar domain name is not enough. Record the server, the question and the time, then explain how that observation relates to the mail identity under investigation.
This guide is scoped to Microsoft's nslookup documentation for Windows 11 and Windows Server 2025, reviewed on 8 November 2026. It does not claim to cover the behavior of a Unix implementation with the same command name. All examples are proposed read-only DNS queries; none was run for this article. Documentation addresses and example.com names must be replaced only within an approved investigation.
Choose the owner name before the command
Ask for the exact message or sender configuration that identifies the dependency. SPF commonly concerns an SMTP identity that can differ from the visible From address. DKIM uses the selector and signing domain in the signature to locate the key. Looking up example.com TXT does not inspect every possible selector below it. RFC 7208 RFC 6376
For a policy check, _dmarc.example.com. is an explicit owner to investigate, not proof that this is the only policy-discovery query a verifier might need. Keep authentication discovery and alignment conclusions with the mail owner. A support ticket can accurately report the DNS answer without prematurely declaring a DMARC pass. RFC 9989
End the proposed names with a period. Microsoft's documentation explains that a name without that terminator can be affected by domain and search settings. That is especially relevant on corporate Windows systems, where suffix configuration can make an unintended question look plausible. Retain the exact spelling rather than retyping it from memory. Microsoft nslookup
Prefer a single explicit query for a ticket
A proposed one-shot query is nslookup -type=TXT _dmarc.example.com. 192.0.2.53. The final argument names the DNS server; omitting it uses the default server. The address here is a documentation placeholder, not a usable recommendation. A matching DKIM question could be nslookup -type=TXT selector1._domainkey.example.com. 192.0.2.53, after obtaining the real selector from authorized evidence. Microsoft nslookup
Record a UTC timestamp separately, the Windows edition and build, and the active network context. Include the whole result, not only the text value. If a VPN or adapter change occurs between observations, record it; those queries may have followed different paths. Share only the relevant portion of network configuration, since a broad support bundle can reveal unrelated internal names and addresses.
Use nslookup -type=NS example.com. 192.0.2.53 as a proposed question about nameserver records. Treat the result as one input to identifying authority, not proof that the selected recursive server is authoritative. An address obtained from an unverified screenshot should not become the destination for the next query without checking the domain and source.
Use interactive mode when extra detail is needed
For an approved investigation needing several related questions, the proposed entry is nslookup - 192.0.2.53. At the interactive prompt, enter set type=TXT, then set debug, then _dmarc.example.com., and finally exit. Each is a separate input. These instructions are not output and do not depict an executed session. Microsoft documents the type setting and debug mode separately. Microsoft set type Microsoft set debug
Debug mode provides more packet and response detail for interpretation. It does not alter the zone or certify the answer. Preserve whatever response status, flags, TTL and authority information the actual output provides. If the evidence is insufficient for a DNSSEC or delegation conclusion, ask for a more suitable diagnostic capture rather than filling gaps from expectation.
Reset the question deliberately when changing record types. A common support error is to continue an interactive session assuming the earlier setting no longer applies. Prefer a fresh one-shot command when a ticket needs a reproducible example another operator can understand without reconstructing session history.
Interpret labels and failures in context
A non-authoritative answer is not automatically wrong. It can be a normal recursive response containing cached data. An authoritative response establishes a different vantage point, not an end-to-end authentication result. The DNS header's authority and status fields describe the response, and their meaning must be kept distinct from the returned TXT text. RFC 1035
Microsoft distinguishes a timeout, no records for the selected type, a nonexistent domain and server failure. Keep those categories separate in the incident. A timeout warrants investigation of reachability and server response, not immediate creation of a TXT record. A no-records result warrants checking the exact owner and type before considering a change. Microsoft nslookup
If a selector is a CNAME, retain the alias and investigate its target under the proper owner's scope. If TXT text is split across quoted strings, preserve the original record boundaries. A pasted string that silently combines separate resource records can hide a configuration error or manufacture one. RFC 1035
Finish with a comparison and an honest handoff
A fictional support finding might say that the corporate recursive server and a verified authority returned different values for the same TXT owner at recorded times. That supports further cache or view investigation. It does not establish which value a remote mailbox used, and it does not justify a zone edit without the DNS owner's review.
Keep nslookup separate from cache maintenance. A lookup is not a local cache flush; Microsoft's separate ipconfig utility documents that operation. Do not append modifying commands to a read-only investigation merely because the result is inconvenient. Microsoft ipconfig
The finished ticket should include exact queries, actual responses, timestamps, identities and the remaining question. Here those operational observations are absent, so publication evidence remains incomplete. Syntax checked against documentation is useful preparation, but only an authorized real capture can satisfy the original-query gate.