Skip go content

nslookup.exe

Windows ProcessMicrosoft Corporation

Awọn iwe-aṣẹ wiwa iwe-aṣẹ nslookup, name server lookup, dns lookup

WindowsSystem Component

DNS lookup command-line tool. E dey query name servers interactively or once. E no be service host.

Wetin you need know

nslookup dey query DNS, e no be service host.

nslookup.exe na DNS client tool. You run am, e go ask resolver, e go print records. svchost.exe fit host di DNS Client service (Dnscache). To end nslookup no dey stop name resolution for di rest of Windows.

E safe?
Check the running file path, signature, and publisher. Name alone no fit confirm say e safe.
Na service?
No. Na CLI wey you dey run
I fit end am?
Dat lookup session go end
Feex tok say
If nslookup dey di list, I dey treat am as prompt wey person open. I no dey end Dnscache to close dat CLI, and I no dey call dis one service host.

Wetin be nslookup.exe?

nslookup dey query DNS, e no be service host. Di image na console tool inside System32. Cached resolution for apps dey stay inside di DNS Client service, no be inside dis exe.

Wetin e dey do?

E dey send queries and print A, AAAA, MX, and other records. E no dey host Svchost groups and e no dey replace ping.

Wetin make am dey run?

You or script launch nslookup. Interactive session go stay until you type exit. One-shot query suppose exit.

Inspect the running instance

Inside Windows PowerShell, this read-only query show matching process IDs, creation times and executable paths on this PC. (pcm)

Get-CimInstance -ClassName Win32_Process | Where-Object { $_.Name -eq 'nslookup.exe' } | Select-Object ProcessId, ParentProcessId, CreationDate, Name, ExecutablePath | Format-List

No result or a path we no fit access is inconclusive. Protected processes fit restrict access, and process IDs fit be reused. Keep personal paths local. (pcm)

Use the file-identity guide to compare signatures and product metadata. A filename alone no fit establish safety. (pcm)

E dey safe?

Check dis running file

System32 nslookup.exe na Microsoft. nslookup.exe inside Downloads no be Microsoft. Copy wey run for long time still be CLI, no be Dnscache.

Compare the recorded location with the actual file. A familiar folder alone no fit establish identity. (pcm)

C:\Windows\System32\nslookup.exe

  • DNS lookup CLI
  • DNS Client service na svchost, no be dis file
  • Expected publisher: Microsoft Corporation

I fit end am?

Dey close dat lookup

To end nslookup.exe dey stop dat tool. Windows name resolution go continue. To restart DNS Client na different, service-level action.

I fit comot am?

No

No delete nslookup.exe. You go lose di inbox lookup tool. To disable DNS Client no be how to commot dis CLI, and you no suppose delete System32.

E suppose start with Windows?

Script fit start am. E no be inbox service and e no dey Startup Apps by default.

Measure resource use

Measure the current process rather than assume a universal baseline
CPU and memory Compare several observations for the same PID and workload. This entry get no independently measured universal baseline. (pcm)
Disk and network Attribute activity to the actual process and current task; a filename alone no fit establish expected destinations or transfer volume. (pcm)

File information

nslookup.exe file information
Executable name nslookup.exe
Recorded installation path C:\Windows\System32\nslookup.exe
Publisher Microsoft Corporation
Signature check Inspect the actual file; this entry no dey certify its certificate identity. (pcm)

Common wahala dem

People dey restart "DNS Client" because one nslookup window remain open

Type exit or end dis CLI. Di service cache no concern one open tool.

Scheduled nslookup wey dem mistake for malware hosting

Read di command line. System32 copy wey dey query name na di tool. Copy with same name inside Temp na di exception.

How to troubleshoot

Diagnose before you change anything wey fit scatter things.

Run nslookup from cmd or pwsh and watch am exit

Interactive mode need exit. Na dis exe be dat. services.msc no go show nslookup as service.

For broken resolution inside browsers, check DNS Client and di adapter

Dis tool na probe only. To end nslookup no go flush di cache. Use ipconfig /flushdns for dat one.

Technical details

Technical details
nslookup.exe technical details
Image name nslookup.exe
Role DNS lookup command-line tool

Check the identity of running file

A filename alone no fit establish safety. Verify the actual path, signature and product identity. (pcm)

Sources and verification

Recorded source label: August 2026. Dis label no establish independent verification. How we dey do research.

Dis article make sense to you?

Yes or no dey enough. Choose reason if you want, or add short note.

Dis article make sense to you?