The second argument to both host and nslookup, specifies the server to use for the lookup. So, you can compare the results of the DNS server specified in /etc/resolv.conf, with others like those mentioned above, eg host youtube.com 8.8.8.8 or nslookup youtube.com 4.2.2.4 However, youtube.com will no doubt be using global server load balancing, which means the DNS response will be based on the source IP address of the DNS request, so you can be directed to the closest youtube.com server(s). So, since you cant be sure the DNS results will be consistent across DNS servers, you can't use that to determine if you're being MITM'd. Mind you I don't think a non-targetted MITM would bother with someone's youtube traffic, but if your concerned about that just connect to youtube with https, so the certificate can be verified.