Reverse DNS and PTR records

What reverse DNS is#

DNS is usually used to turn a name into an address. Reverse DNS turns an address back into a name. The answer is stored in a PTR record (pointer record), and it is the reason a lookup can show a hostname next to an IP address, and why a traceroute prints names instead of bare numbers.

The forward and reverse directions are stored in different places and controlled by different people. Whoever owns a domain controls what its names point to. Whoever owns an IP block, normally an ISP or a hosting company, controls what its addresses point back to. Those are often unrelated parties, which is why reverse records are so often missing, generic or out of date.

How the lookup works#

Reverse records live under a special domain. For IPv4 the address is written backwards, one octet at a time, and .in-addr.arpa is added. Writing it backwards puts the most specific part on the left, matching how DNS names are read, so the registry that delegated the block can delegate the records for it in turn.

dig -x 8.8.8.8 +short          # Linux, macOS: prints dns.google.
nslookup 8.8.8.8               # Windows, macOS, Linux
Resolve-DnsName 8.8.8.8        # PowerShell

The DNS lookup tool has a reverse tab: enter an address and it does the conversion and the query. A full IP lookup includes the reverse name as one of its fields.

Why anyone cares#

• Email delivery. Receiving mail servers commonly check the sending address. A missing or generic reverse name is one of the classic signs of a hacked machine or a spam source, and is a frequent reason legitimate mail from a new server lands in spam or is rejected.
• Readable logs and diagnostics. A hostname says what a machine is. ae-1.r21.example.net in a traceroute tells you it is a router in a carrier's backbone. A number tells you nothing.
• Security review. Reverse names of scanning and attacking addresses help attribute them to a hosting provider or a residential network.
• Some services insist on it. Older SSH, FTP and logging setups look up the connecting address and reject or slow down connections that have no reverse name.

Forward-confirmed reverse DNS#

A reverse record is a claim made by whoever controls the address block, and nothing forces it to be true. Anyone with control of a block can point its addresses at any name, including one belonging to someone else. So a reverse name proves nothing on its own. Forward-confirmed reverse DNS (FCrDNS) adds the check that makes it useful:

1. Look up the PTR record for the address, and get a name.
2. Look up that name's A or AAAA records.
3. The address you started with must be among the answers.

If the loop closes, the owner of the address and the owner of the name agree with each other. Mail servers rely on this. A name that fails it, such as one that points at a domain whose own records do not point back, should be treated as if it were not there.

Who can change yours#

Not you, in most cases, unless you own the address block. The record for a residential connection is set by your ISP, and usually follows a pattern that includes the address, such as pool-203-0-113-42.example-isp.net. Hosting and cloud providers give customers a control-panel field for it, and many will only accept a name that already resolves forward to your address, which is the FCrDNS rule enforced at the source.

When an ISP delegates part of a /24 to a customer, it cannot hand over the reverse zone for the whole block. The workaround is a special naming scheme described in RFC 2317. If you are trying to set reverse DNS for a small block and the panel looks strange, that is why.

Common questions#