Reverse DNS Lookup

How Reverse DNS Works

Reverse DNS (rDNS) is the process of resolving an IP address back to a domain name or hostname. While standard (forward) DNS translates domain names into IP addresses (e.g., google.com resolves to 142.250.80.46), reverse DNS does the opposite. It uses a special domain called the in-addr.arpa zone, where IP addresses are stored in reverse octet order as PTR (Pointer) records.

For example, to look up the reverse DNS for the IP address 8.8.8.8 (Google's public DNS server), the query is made to 8.8.8.8.in-addr.arpa, which returns dns.google. The in-addr.arpa zone is maintained by the organization that owns the IP address block — typically an ISP or hosting provider — rather than the domain owner. This is why setting up reverse DNS requires coordinating with your IP address provider, not just your domain registrar.

Reverse DNS and Email Deliverability

Reverse DNS is critically important for email servers. When your mail server sends an email, the receiving mail server performs a reverse DNS lookup on your server's IP address. If the lookup fails — returning no PTR record — many receiving servers will reject the email outright or flag it as suspicious. A 2023 analysis by email security provider Proofpoint found that missing or mismatched PTR records are among the top technical factors contributing to email being classified as spam.

• PTR record requirement: Your mail server's IP address must have a PTR record pointing to a hostname. The hostname should ideally match your mail server's FQDN (Fully Qualified Domain Name).
• Forward-confirmed rDNS (FCrDNS): The gold standard for email deliverability. This means the PTR record of your IP resolves to a hostname, and a forward lookup of that hostname resolves back to the same IP. Gmail, Microsoft 365, and most enterprise mail servers check for FCrDNS.
• Generic PTR records: Records like "customer.isp.net" or "pool-192-168-1-1.isp.com" are common on residential ISP IP ranges. Many mail servers automatically reject email from IPs with generic reverse DNS because residential connections are commonly used by malware for spam campaigns.

Network Troubleshooting with Reverse DNS

Beyond email, reverse DNS is a powerful tool for network troubleshooting and security analysis. When analyzing firewall logs, intrusion detection alerts, or server access logs, raw IP addresses provide little context. Performing reverse lookups on the source IPs can reveal whether traffic is coming from a known CDN (like Cloudflare or Fastly), a cloud provider (like Amazon AWS or Google Cloud), a corporate network, or a residential ISP connection.

Security teams use reverse DNS to correlate attack traffic with known threat actors, identify command-and-control servers in malware investigations, and verify that server-to-server communication is occurring between expected hosts. Network engineers use it to identify unknown devices on their network — an IP with no reverse DNS record may represent an unmanaged or rogue device that was not properly provisioned.

System administrators routinely use reverse DNS in log analysis. When reviewing Apache or Nginx access logs, SSH authentication logs, or application security events, enabling DNS resolution turns IP addresses into meaningful hostnames that can reveal geographic origin, ISP attribution, or cloud provider ownership at a glance. The dig -x command and the nslookup utility both perform reverse lookups from the command line, but our web-based tool provides the same capability without requiring local DNS tools to be installed.

For IPv6 reverse DNS, the process is similar but uses the ip6.arpa zone instead of in-addr.arpa, and the address nibbles are reversed individually rather than by octet. For example, the IPv6 address 2001:db8::1 would be queried as 1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.8.b.d.0.1.0.0.2.ip6.arpa. As IPv6 adoption grows, verifying IPv6 PTR records becomes increasingly important for mail server deliverability and network documentation.