Reverse DNS Lookup

How reverse DNS works

Reverse DNS (rDNS) performs the inverse of a standard DNS lookup. While a forward DNS lookup answers the question "what IP does this domain point to?", a reverse DNS lookup answers "what domain does this IP point back to?". It does this by querying PTR (Pointer) records stored in the special .arpa DNS zone.

For IPv4 addresses, reverse lookups use the in-addr.arpa zone. The IP address is reversed and appended with .in-addr.arpa to form a PTR query. For example, to look up the PTR record for 8.8.8.8, the system queries 8.8.8.8.in-addr.arpa and retrieves the PTR record that points to dns.google. For IPv6 addresses, the ip6.arpa zone is used, with each nibble of the address reversed and separated by dots.

PTR records are not automatically created when you set up a forward DNS record. They must be configured separately by the entity that owns the IP address block — typically your ISP or hosting provider. This is because IP address ownership and DNS zone management are handled by different parties. ISPs allocate IP addresses to customers, while DNS zones for domain names are managed through domain registrars. The reverse DNS zone for an IP range is managed by the ISP, so they must add the PTR record on your behalf.

Reverse DNS is widely used for email server authentication, network troubleshooting, server logging, and security analysis. Mail servers frequently perform rDNS checks on connecting SMTP servers and may reject email from IPs without valid, matching PTR records. Network administrators use reverse lookups to identify hosts in log files, and security analysts use them to map IP addresses encountered during investigations back to known domain names.

Why reverse DNS matters

Reverse DNS plays a critical role in three primary areas: email delivery, network troubleshooting, and security. In email, most major mail providers including Gmail, Outlook, and Yahoo perform rDNS checks on incoming SMTP connections. If the connecting IP does not have a PTR record that matches the HELO/EHLO hostname, the email is more likely to be flagged as spam or rejected outright. This makes proper rDNS configuration essential for anyone running a mail server.

For system administrators, reverse DNS helps identify hosts in log files. When analysing access logs, firewall logs, or authentication logs, seeing domain names alongside IP addresses makes it much easier to understand traffic patterns and identify known services. Tools like traceroute, netstat, and SSH daemons all use reverse DNS to display meaningful hostnames instead of raw IP addresses.

In security contexts, reverse DNS is used during threat intelligence and incident response. When investigating a suspicious IP, checking its PTR record can reveal which hosting provider or organisation owns the address. Many CDNs and cloud providers configure their PTR records to include identifiable patterns, making it possible to determine that an IP belongs to AWS, Google Cloud, or a specific VPN provider.

Limitations of reverse DNS

Reverse DNS has several important limitations. Not all IP addresses have PTR records configured — many residential and mobile IPs lack reverse DNS entirely. The PTR record may not match the forward DNS name, which is called a "forward-confirmed reverse DNS" (FCrDNS) mismatch. Some ISPs assign generic PTR records that reveal no useful information about the actual service running on the IP. Additionally, reverse DNS lookups are inherently slower than forward lookups because they must traverse the .arpa namespace, and misconfigured PTR records can cause significant latency in applications that perform reverse lookups synchronously.

Frequently asked questions