nslookup.exe

Windows ProcessMicrosoft Corporation

Also called nslookup, name server lookup, dns lookup

WindowsSystem Component

DNS lookup command-line tool. It queries name servers interactively or once. It is not a service host.

What you need to know

nslookup queries DNS, it is not a service host.

nslookup.exe is a DNS client tool. You run it, it asks a resolver, it prints records. svchost.exe can host the DNS Client service (Dnscache). Ending nslookup does not stop name resolution for the rest of Windows.

Safe?: Yes, in System32
Is it a service?: No. It is a CLI you run
Can I end it?: That lookup session ends

Feex says

If nslookup is on the list, I treat it as a prompt someone opened. I do not end Dnscache to close that CLI, and I do not call this a service host.

What is nslookup.exe?

nslookup queries DNS, it is not a service host. The image is a console tool in System32. Cached resolution for apps lives in the DNS Client service, not in this exe.

What does it do?

It sends queries and prints A, AAAA, MX, and other records. It does not host Svchost groups and it does not replace ping.

Why is it running?

You or a script launched nslookup. An interactive session stays until you type exit. A one-shot query should exit.

Is it safe?

Usually safe

System32 nslookup.exe is Microsoft. An nslookup.exe in Downloads is not. A long-running copy is still a CLI, not Dnscache.

A legitimate copy normally runs from:

C:\Windows\System32\nslookup.exe

DNS lookup CLI
DNS Client service is a svchost, not this file
Expected publisher: Microsoft Corporation

Can I end it?

Closes that lookup

Ending nslookup.exe stops that tool. Windows name resolution continues. Restarting DNS Client is a different, service-level action.

Can I remove it?

Do not delete nslookup.exe. You would lose the inbox lookup tool. Disabling DNS Client is not how you remove this CLI, and you should not delete System32.

Should it start with Windows?

A script can start it. It is not an inbox service and not Startup Apps by default.

Normal resource behavior

These are contextual labels, not universal averages.

CPU: Low
Memory: Small
Disk: Low
Network: DNS queries to the server you pointed at

File information

nslookup.exe file information
Executable name	nslookup.exe
Common legitimate path	C:\Windows\System32\nslookup.exe
Publisher	Microsoft Corporation
Signature expectation	Signed by Microsoft Windows

Common problems

People restart "DNS Client" because an nslookup window stayed open

Type exit or end this CLI. The service cache is unrelated to one open tool.

A scheduled nslookup they mistake for malware hosting

Read the command line. A System32 copy querying a name is the tool. A namesake in Temp is the exception.

Troubleshooting

Diagnose before you change anything destructive.

Run nslookup from cmd or pwsh and watch it exit

Interactive mode needs exit. That is this exe. services.msc will not show nslookup as a service.

For broken resolution in browsers, check DNS Client and the adapter

This tool is only a probe. Ending nslookup will not flush the cache. Use ipconfig /flushdns for that.

Technical details

nslookup.exe technical details
Image name	nslookup.exe
Role	DNS lookup command-line tool

Sources and verification

Reviewed by Feex editorial. Last verified August 2026 Status: Feex Reviewed. How we research.

Microsoft Learn: nslookup · DNS lookup command-line tool
Microsoft Learn: Windows · Primary Windows documentation
Foxhole process map · First-party samples on Windows PCs. Not a lab benchmark.

Was this article useful?

A yes or no is enough. Pick a reason if you want, or add a short note.