I don't thing there is such a thing like a order of the IPs. I think the DNS server sends them in a random order, that's why nslookup displays it in different order everytime. However /dns returns them in same order everytime. I think they are cached by winsock, because if you type "iptables /registerdns" the ips on /dns will be displayed in another order.
Example:
//.timer 2 0 dns irc.efnet.net | run ipconfig /registerdns | .timer 1 2 dns irc.efnet.net
Types twice the addresses in the same order, deletes cache(or updates it) and then types the ips again in a different order. Probably nslookup is giving it in different order everytime because it avoids using the cache.
