My IP Help

Reverse DNS

Also known as: rDNS, PTR lookup

The process of resolving an IP address back to a hostname using PTR records in special DNS zones like in-addr.arpa (IPv4) and ip6.arpa (IPv6).

Last updated:

What is reverse DNS?

Reverse DNS (rDNS) is the reverse of the usual DNS lookup: instead of converting a hostname like www.example.com into an IP address, it converts an IP address back into a hostname. This is accomplished with a PTR record (pointer record) stored in a special reverse DNS zone.

For IPv4, reverse lookups live under in-addr.arpa, with the octets reversed. To look up 192.0.2.33, a resolver queries:

33.2.0.192.in-addr.arpa  →  PTR  mail-out-3.example.net.

For IPv6, the reverse zone is ip6.arpa, and each hex digit of the address becomes its own label (reversed), producing queries like 3.3.0.0.2.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.8.b.d.0.1.0.0.2.ip6.arpa.

Who sets reverse DNS?

Reverse DNS for a block of IPs is controlled by the organization that owns the allocation — the ISP, hosting provider, or enterprise that received the CIDR range from its RIR. The owner delegates the reverse zone to their own name servers and sets PTR records there. End users cannot unilaterally change the PTR for their residential IP; they would need to ask their ISP.

Why reverse DNS matters

  • Email deliverability — most mail servers reject or heavily penalize messages from IPs whose PTR record doesn't match the hostname in the SMTP HELO (this is why setting rDNS correctly is essential for running your own mail server)
  • Server identification — operators often encode the hostname, datacenter, and role into PTR records, which makes tracing traffic paths much easier
  • Traceroutes and logs — rDNS turns otherwise opaque IPs in logs into readable hostnames
  • Threat intelligence — cloud providers, datacenters, and residential ISPs have distinctive PTR patterns, so rDNS can help classify an IP at a glance

Residential and mobile IPs often have generic, auto-generated PTR records like cpe-198-51-100-42.example-isp.net, which reveal the ISP and often the region.

Frequently Asked Questions

On the command line, run `dig -x 8.8.8.8` (Linux/macOS) or `nslookup 8.8.8.8` (Windows). Both query the appropriate `in-addr.arpa` (IPv4) or `ip6.arpa` (IPv6) zone for the PTR record. Programmatically, most languages expose `gethostbyaddr()` or equivalent. Online tools like our reverse DNS lookup do the same query through a hosted resolver and return the resulting hostname. Note that not every IP has a PTR record set; many simply return NXDOMAIN.
Only if you control the IP block. Reverse DNS for an IP is delegated to whoever owns the allocation — typically your ISP, hosting provider, or cloud platform. End users on residential connections cannot change their PTR record without asking the ISP. Cloud providers (AWS, GCP, Azure) and most VPS hosts expose a self-service form to set the PTR for IPs they assign to you — essential when running a mail server.
Receiving mail servers use reverse DNS as a basic anti-spam check. They look up the PTR record for the connecting IP and compare it to the hostname in the SMTP `HELO/EHLO` command and to a forward DNS resolution of the PTR (FCrDNS — Forward Confirmed reverse DNS). Mismatches and missing PTRs strongly correlate with spam, so most large mail providers (Google, Microsoft, Yahoo) reject or heavily penalize messages from IPs with bad reverse DNS. Setting a matching PTR is the single most important thing for self-hosted email deliverability.
A PTR (pointer) record is a DNS record type that maps an IP address back to a hostname — the reverse of an A or AAAA record. PTRs live in special reverse-DNS zones: `in-addr.arpa` for IPv4 (with octets reversed) and `ip6.arpa` for IPv6 (with each hex digit as its own reversed label). A single IP can have only one PTR record in standard usage, though some registries allow multiple for round-robin or multi-homing scenarios.
Residential and small-business ISPs auto-generate PTR records for every customer IP using a template like `cpe-198-51-100-42.isp-example.net` or `host-198-51-100-42.bbcustomer.example.net`. The template typically encodes the IP, sometimes the city or POP, and the ISP name. Generic templated PTRs are a strong "this is a consumer connection" signal for traffic analysis and spam filtering, even before you check anything else about the IP.
Back to glossary