1. What Does "Non-Authoritative Answer" Mean in nslookup?

When you run an nslookup command, the output looks something like this:

$ nslookup example.com Server: 8.8.8.8 Address: 8.8.8.8#53 Non-authoritative answer: Name: example.com Address: 93.184.216.34

The line "Non-authoritative answer" is nslookup telling you: "I got this result from a DNS server that has a cached copy of this record — not from the DNS server that officially owns it."

Is this a problem? Almost never. The information is correct. The IP address returned is the same IP address that the authoritative server would return. The "non-authoritative" label is about where the answer came from, not about whether the answer is accurate.

Think of it like getting directions from a local resident who knows the area versus calling the city planning office directly. The directions are the same. The local resident is "non-authoritative" in the technical sense — they're not the official source — but they're giving you correct information.

2. Authoritative vs Non-Authoritative DNS: The Core Difference

Understanding this distinction requires knowing what "authoritative" means in the DNS world.

Authoritative DNS Server

An authoritative DNS server is the server that officially stores and manages DNS records for a specific domain. When you register a domain and set up DNS hosting (through Cloudflare, your registrar, or a dedicated DNS provider), those DNS servers become the authoritative nameservers for your domain.

When someone queries one of these authoritative servers directly, the response comes back without the "Non-authoritative answer" label.

$ nslookup example.com ns1.example.com Server: ns1.example.com Address: 205.251.196.1#53 Name: example.com Address: 93.184.216.34

No "Non-authoritative answer" line — because you queried the authoritative server directly.

Non-Authoritative DNS Server (Recursive/Caching)

A non-authoritative server is any DNS server that doesn't officially own the domain's records. These servers:

1. Receive DNS queries from users (browsers, terminals, apps)
2. Look up the answer from an authoritative server if they don't have it cached
3. Cache the answer for future queries
4. Return the cached answer to you — with the "Non-authoritative answer" label

3. How DNS Actually Works (Why Non-Authoritative is Normal)

Here's the full DNS resolution process — which explains why almost every nslookup query returns "Non-authoritative answer":

Step 1: You Run nslookup

nslookup example.com

Your terminal sends this query to the DNS server configured on your device. This is almost always your ISP's DNS server, Google (8.8.8.8), Cloudflare (1.1.1.1), or your router.

Step 2: Your DNS Server Checks Its Cache

If your DNS server has recently resolved example.com for any of its users, it has a cached copy. It returns that cached copy to you immediately — with the "Non-authoritative answer" label, because the answer came from cache, not directly from example.com's nameservers.

Step 3: If Not Cached — The Full Resolution Chain

If the record isn't cached, your DNS server starts climbing the DNS hierarchy:

Your DNS server → asks Root DNS Servers ("who handles .com?") → asks .com TLD Servers ("who handles example.com?") → asks example.com's Authoritative Nameservers ("what's the A record?") → gets the answer → caches it → returns it to you (still marked "Non-authoritative")

The Three-Tier DNS System

Tier 1: Root Name Servers (13 servers worldwide) ↓ "I know who handles .com domains" Tier 2: TLD Name Servers (.com, .net, .org, etc.) ↓ "I know who handles example.com" Tier 3: Authoritative Name Servers (specific to each domain) ↓ "Here's the actual IP address for example.com"

4. Reading a Full nslookup Output

Here's a complete nslookup output with every element explained:

$ nslookup example.com Server: 8.8.8.8 ← The DNS server you queried Address: 8.8.8.8#53 ← Its IP address and port 53 (DNS port) Non-authoritative answer: ← Response is from cache, not authoritative server Name: example.com ← The domain you queried Address: 93.184.216.34 ← The A record (IPv4 address)

Multiple Addresses

Some domains return multiple IP addresses (for load balancing):

$ nslookup google.com Server: 8.8.8.8 Address: 8.8.8.8#53 Non-authoritative answer: Name: google.com Address: 142.250.185.78 Address: 142.250.185.110 Address: 142.250.185.100

CNAME in the Output

$ nslookup www.example.com Non-authoritative answer: www.example.com canonical name = example.com. Name: example.com Address: 93.184.216.34

5. How to Get an Authoritative Answer When You Need One

Most of the time, the non-authoritative answer is perfectly fine. But if you need the official, most current record — for example, when you've just updated DNS records and want to confirm the change — here's how to query the authoritative server directly.

Step 1: Find the Authoritative Nameservers

# Method 1: nslookup nslookup -type=ns example.com # Method 2: nslookup with SOA record nslookup -type=soa example.com

Or use Rankcept's free DNS Lookup tool — enter your domain and instantly see all NS records without typing any commands.

Step 2: Query the Authoritative Server Directly

nslookup example.com ns1.example.com

Output (no "Non-authoritative answer" line):

Server: ns1.example.com Address: 205.251.196.1#53 Name: example.com Address: 93.184.216.34

No "Non-authoritative answer" — you're getting the official record directly from the source.

6. nslookup MX Record Lookup — With Examples

MX (Mail Exchange) records tell mail servers where to deliver email for a domain. Checking MX records with nslookup is one of the most common troubleshooting tasks for email delivery issues.

Basic MX Lookup

nslookup -type=mx example.com

Output:

Server: 8.8.8.8 Address: 8.8.8.8#53 Non-authoritative answer: example.com mail exchanger = 10 mail.example.com example.com mail exchanger = 20 mail2.example.com

The numbers (10, 20) are priority values — lower number = higher priority.

7. TXT Record Lookup with nslookup

TXT records have multiple uses: SPF email authentication, DKIM keys, domain verification for Google/Microsoft, and DMARC policies.

Basic TXT Lookup

nslookup -type=txt example.com

Output:

Server: 8.8.8.8 Address: 8.8.8.8#53 Non-authoritative answer: example.com text = "v=spf1 include:_spf.google.com ~all" example.com text = "google-site-verification=abc123xyz"

8. When Non-Authoritative Actually Is a Problem

In most cases, non-authoritative answers are fine. Here are the rare situations where they can cause genuine issues:

1. You Just Changed DNS Records

If you changed an A record or MX record and ran nslookup immediately, you might get the old cached value. This isn't a problem with your DNS change — it's just the cache hasn't expired yet.

Wait for the TTL to expire. Check the TTL of your record (visible in authoritative answers) — that's how long caches keep the old value.

2. DNS Propagation Debugging

During DNS propagation, different DNS servers around the world may have different cached values — some showing the old record, others showing the new one. To see what the authoritative server says (the definitive answer), query it directly as shown in Section 5.

9. Checking DNS Records Without the Command Line

Rankcept's DNS Lookup lets you check any DNS record type — A, MX, TXT, CNAME, NS, SOA — from any browser with no installation required.

10. Frequently Asked Questions

Disclaimer: This guide is for educational purposes. DNS configurations may vary based on hosting provider and DNS host settings.