no ip domain-lookup
Prevent IOS from broadcasting DNS queries for mistyped CLI commands, which causes annoying delays in lab environments.
Definition: no ip domain-lookup is a Cisco IOS global config command. Disables DNS lookup on mistyped commands in the CLI. Without this command, IOS attempts to resolve every unknown word as a hostname via DNS broadcast, causing 30-second hangs after typos.
Overview
The `no ip domain-lookup` command is a fundamental configuration on Cisco IOS devices that disables the automatic DNS resolution of unrecognized commands. When a user types a command that the IOS parser does not recognize, the device by default attempts to resolve it as a hostname via DNS. This can cause significant delays, especially in lab or isolated environments where no DNS server is available, as the device will wait for a timeout (typically 30 seconds) before returning an error.
By disabling this feature, the device immediately returns an error for mistyped commands, improving the user experience and reducing frustration during configuration. The command operates at the global configuration mode and affects the entire device. It does not require any parameters and is a simple toggle.
The underlying concept is that Cisco IOS treats any unrecognized text as a potential hostname and tries to resolve it through DNS, a behavior inherited from the early days of networking when devices were often named and reachable via DNS. In modern networks, especially during initial setup or troubleshooting, this behavior is often undesirable. Alternatives include configuring a domain name with `ip domain-name` and setting up DNS servers with `ip name-server`, but these are only useful if DNS resolution is actually needed.
The `no ip domain-lookup` command is typically one of the first commands applied when configuring a new device, as it prevents accidental delays. It is also commonly used in lab environments where DNS is not configured. The command does not affect the device's ability to perform DNS lookups for other purposes (e.g., when using `ping` with a hostname); it only stops the automatic lookup of mistyped commands.
The command is saved to the running configuration and persists across reboots if saved to startup configuration. There are no privilege level requirements beyond global config mode (privilege level 15). The command is available in all IOS versions and is considered a best practice for initial device setup.
no ip domain-lookupWhen to Use This Command
- Lab and exam environments — stop the 30-second hang after a typo
- Devices with no DNS server configured — prevent broadcast storms from repeated DNS queries
- Security hardening — prevent a compromised router from broadcasting internal command typos
Command Examples
Disable DNS lookup to prevent typo delays
Router(config)# no ip domain-lookup Router(config)# end Router# shw ip int bri Translating "shw"...domain server (255.255.255.255) % Unknown command or computer name, or unable to find computer address ! With no ip domain-lookup, the above resolves instantly instead of waiting 30 seconds
Understanding the Output
After no ip domain-lookup, mistyped commands return an error immediately. Without it, IOS broadcasts to 255.255.255.255 on UDP 53 and waits for a DNS response before returning the error — in lab scenarios with no DNS server, this is always a 30-second timeout.
Configuration Scenarios
Disable DNS Lookup on a New Router
When setting up a new Cisco router in a lab or isolated network, the default DNS lookup behavior can cause delays when mistyping commands. This scenario shows how to disable it immediately after entering global configuration mode.
Topology
Single router: R1Steps
- 1.Step 1: Enter privileged EXEC mode: R1> enable
- 2.Step 2: Enter global configuration mode: R1# configure terminal
- 3.Step 3: Disable DNS lookup: R1(config)# no ip domain-lookup
- 4.Step 4: Exit configuration mode: R1(config)# end
- 5.Step 5: Save the configuration: R1# copy running-config startup-config
! Enter global configuration mode R1# configure terminal ! Disable DNS lookup R1(config)# no ip domain-lookup ! Exit and save R1(config)# end R1# copy running-config startup-config
Verify: Use `show running-config | include domain-lookup` to verify the command is present. Expected output: `no ip domain-lookup`.
Watch out: If you later need DNS resolution for commands like `ping server.example.com`, you must re-enable it with `ip domain-lookup` and configure DNS servers. Disabling it globally affects all DNS resolution attempts from the CLI.
Prevent Delays During Router Configuration in a Production Network
In a production network where DNS servers are configured, but you are performing maintenance and want to avoid delays from mistyped commands, you can temporarily disable DNS lookup. This scenario shows how to do it and then re-enable it after the maintenance window.
Topology
Single router: R1 connected to a DNS server at 192.168.1.100Steps
- 1.Step 1: Enter privileged EXEC mode: R1> enable
- 2.Step 2: Enter global configuration mode: R1# configure terminal
- 3.Step 3: Disable DNS lookup: R1(config)# no ip domain-lookup
- 4.Step 4: Perform configuration tasks (e.g., interface configs, routing protocols)
- 5.Step 5: Re-enable DNS lookup: R1(config)# ip domain-lookup
- 6.Step 6: Exit and save: R1(config)# end; R1# copy running-config startup-config
! Enter global configuration mode R1# configure terminal ! Disable DNS lookup temporarily R1(config)# no ip domain-lookup ! Perform maintenance tasks... ! Re-enable DNS lookup R1(config)# ip domain-lookup ! Exit and save R1(config)# end R1# copy running-config startup-config
Verify: Use `show running-config | include domain-lookup` to check the current state. If enabled, the line will not appear (since `ip domain-lookup` is default). If disabled, `no ip domain-lookup` will appear.
Watch out: If you forget to re-enable DNS lookup, subsequent commands that rely on DNS (like `ping` or `telnet` with hostnames) will fail. Always verify the configuration after maintenance.
Troubleshooting with This Command
The `no ip domain-lookup` command is primarily used to prevent a specific symptom: long delays (up to 30 seconds) when typing an unrecognized command. If you are experiencing such delays, the first step is to check whether DNS lookup is enabled. Use `show running-config | include domain-lookup` to see if the command is present.
If the output shows `no ip domain-lookup`, then DNS lookup is disabled and the delay is caused by something else. If the output is empty (default), DNS lookup is enabled and likely the cause. To confirm, you can simulate a mistyped command (e.g., `router# show runn`) and observe the delay.
If the device pauses for several seconds before returning `% Invalid input detected`, DNS lookup is the culprit. The fix is to enter global configuration mode and issue `no ip domain-lookup`. After disabling, the same mistyped command should return an error immediately.
Another symptom is when the device attempts to resolve a hostname that you actually intended to use (e.g., `ping server1`). In that case, you need DNS lookup enabled, but you should ensure DNS servers are configured with `ip name-server`. If DNS lookup is disabled, `ping server1` will fail immediately with `% Unrecognized host or address, or protocol not running`.
To correlate with other commands, use `debug ip domain` to see DNS resolution attempts (though this is rarely needed). In summary, the diagnostic flow is: 1) Identify the symptom (delay or immediate failure). 2) Check running-config for `no ip domain-lookup`. 3) If enabled and delay occurs, disable it. 4) If disabled and you need hostname resolution, enable it and configure DNS servers. The command itself is simple, but understanding its impact on the CLI experience is crucial for efficient network engineering.
CCNA Exam Tips
CCNA exam: this is a standard first command in any lab configuration
Know that it only affects CLI behaviour — it does NOT prevent the router from using DNS for actual hostname resolution via ip name-server
To re-enable DNS lookup, use ip domain-lookup
Common Mistakes
Thinking no ip domain-lookup breaks DNS for actual hostname resolution tasks — it only prevents CLI typo lookups
Confusing this with ip domain-name (which sets the domain suffix used for key generation and hostname resolution)
no ip domain-lookup vs hostname
Both 'no ip domain-lookup' and 'hostname' are global configuration commands that modify device behavior, but they address different aspects of CLI interaction. They are often grouped together because both can affect the user experience when entering commands, and both are commonly configured during initial device setup.
| Aspect | no ip domain-lookup | hostname |
|---|---|---|
| Scope | Disables DNS lookup for all unrecognized CLI commands | Sets the device hostname for identification |
| Configuration Mode | Global configuration | Global configuration |
| Effect on CLI | Prevents 30-second delay after typos by skipping DNS resolution | Changes the CLI prompt to reflect the new hostname |
| Persistence | Persists across reboots when saved to startup-config | Persists across reboots when saved to startup-config |
| Relation to DNS | Directly controls DNS lookup behavior for CLI parsing | Indirectly affects DNS through domain name appending (e.g., in SSH key generation) |
| Typical Use | Enable on production routers to avoid CLI hangs | Set during initial deployment for network identification |
Use no ip domain-lookup when you want to eliminate the 30-second delay caused by DNS resolution of mistyped commands, especially on routers where you frequently make typos.
Use hostname when you need to assign a unique, meaningful name to the device for management and neighbor discovery via CDP or LLDP.
Platform Notes
In IOS-XE (e.g., Catalyst 9000 switches, ISR 4000 routers), the command `no ip domain-lookup` behaves identically to classic IOS. The syntax and output are the same. In NX-OS (e.g., Nexus switches), the equivalent command is `no ip domain-lookup` as well, but note that NX-OS uses a different configuration mode (configure terminal) and the command is available in global config.
However, NX-OS also has a separate command `ip domain-lookup` that is enabled by default. There is no difference in behavior. For ASA firewalls, the command is `no domain-lookup` (without the `ip` prefix) in global configuration mode.
In IOS-XR (e.g., ASR 9000), the command is `domain lookup disable` under the `domain` configuration mode, or you can use `no domain lookup` in global config. The exact syntax varies by IOS-XR version, but the concept is the same. Across all platforms, the command is saved in the running configuration and can be verified with `show running-config`.
There are no significant differences between IOS 12.x, 15.x, or 16.x; the command has remained consistent. Always check the specific platform documentation for exact syntax, but the command is widely supported.
Related Commands
crypto key generate rsa
Generates RSA key pairs used to enable SSH on Cisco IOS devices. The modulus size determines key strength — minimum 768 bits for SSH version 1, 1024 bits recommended for SSH version 2.
hostname
Sets the hostname of a Cisco router or switch. The hostname appears in the CLI prompt, is used in SSH key generation (hostname.domain-name), and is advertised via CDP to neighbour devices.
Practice for the CCNA 200-301
Test your knowledge with practice questions covering all CCNA 200-301 exam domains.
Practice CCNA 200-301 Questions