The part of the / a query you want is called "authority." The record type is called NS.
I use "dig" for this. Because Windows is lacking in tools, I install the (free, open-source) Cygwin package at it includes it.
nslookup can also do this and is available by default on Windows systems.
On my older Windows system, the nslookup that comes with can give you this via (at least) via either asking for "all records" or "ns records".
Here's doing it with my XP box's cmd prompt for Google.com:
nslookup
> set type=NS
> google.com
Server: h-67-100-88-26.snfc.ca.megapath.net
Address: 67.100.88.26
Non-authoritative answer:
google.com nameserver = ns4.google.com
google.com nameserver = ns1.google.com
google.com nameserver = ns2.google.com
google.com nameserver = ns3.google.com
ns3.google.com internet address = 216.239.36.10
ns4.google.com internet address = 216.239.38.10
ns1.google.com internet address = 216.239.32.10
ns2.google.com internet address = 216.239.34.10
>
The following is the help screen for the Windows XP Corporate Edition nslookup:
Commands: (identifiers are shown in uppercase, [] means optional)
NAME - print info about the host/domain NAME using default server
NAME1 NAME2 - as above, but use NAME2 as server
help or ? - print info on common commands
set OPTION - set an option
all - print options, current server and host
[no]debug - print debugging information
[no]d2 - print exhaustive debugging information
[no]defname - append domain name to each query
[no]recurse - ask for recursive answer to query
[no]search - use domain search list
[no]vc - always use a virtual circuit
domain=NAME - set default domain name to NAME
srchlist=N1[/N2/.../N6] - set domain to N1 and search list to N1,N2, etc.
root=NAME - set root server to NAME
retry=X - set number of retries to X
timeout=X - set initial time-out interval to X seconds
type=X - set query type (ex. A,ANY,CNAME,MX,NS,PTR,SOA,SRV)
querytype=X - same as type
class=X - set query class (ex. IN (Internet), ANY)
[no]msxfr - use MS fast zone transfer
ixfrver=X - current version to use in IXFR transfer request
server NAME - set default server to NAME, using current default server
lserver NAME - set default server to NAME, using initial server
finger [USER] - finger the optional NAME at the current default host
root - set current default server to the root
ls [opt] DOMAIN [> FILE] - list addresses in DOMAIN (optional: output to FILE)
-a - list canonical names and aliases
-d - list all records
-t TYPE - list records of the given type (e.g. A,CNAME,MX,NS,PTR etc.)
view FILE - sort an 'ls' output file and view it with pg
exit - exit the program
The following is the first of the "man pages" for dig:
DIG(1) BIND9 DIG(1)
NAME
dig - DNS lookup utility
SYNOPSIS
dig [@server] [-b address] [-c class] [-f filename] [-k filename] [-m]
[-p port#] [-q name] [-t type] [-x addr] [-y [hmac:]name:key] [-4]
[-6] [name] [type] [class] [queryopt...]
dig [-h]
dig [global-queryopt...] [query...]
DESCRIPTION
dig (domain information groper) is a flexible tool for interrogating
DNS name servers. It performs DNS lookups and displays the answers that
are returned from the name server(s) that were queried. Most DNS
administrators use dig to troubleshoot DNS problems because of its
flexibility, ease of use and clarity of output. Other lookup tools tend
to have less functionality than dig.
Although dig is normally used with command-line arguments, it also has
a batch mode of operation for reading lookup requests from a file. A
brief summary of its command-line arguments and options is printed when
the -h option is given. Unlike earlier versions, the BIND 9
implementation of dig allows multiple lookups to be issued from the
command line.
Unless it is told to query a specific name server, dig will try each of
the servers listed in /etc/resolv.conf.
When no command line arguments or options are given, dig will perform
an NS query for "." (the root).
It is possible to set per-user defaults for dig via ${HOME}/.digrc.
This file is read and any options in it are applied before the command
line arguments.
The IN and CH class names overlap with the IN and CH top level domains
names. Either use the -t and -c options to specify the type and class,
use the -q the specify the domain name, or use "IN." and "CH." when
looking up these top level domains.
