DNS glossary

What is reverse DNS lookup?

Reverse DNS lookup (reverse DNS resolution) is a DNS query method that finds the domain name associated with an IP address. It works by querying a PTR record in the in-addr.arpa zone for IPv4 or the ip6.arpa zone for IPv6, as described in RFC 1035 and RFC 3596.

Let's simplify your DDI
Abstract isometric UI showing network ranges, usage bars, region names (EMEA/APAC), and a purple "Deploy" button
Key takeawaysKey takeaways are generated with AI assistance. Because automated summaries can occasionally contain errors or miss important context, always refer to the full blog post for complete information.

Reverse DNS lookup is a DNS query method that resolves an IP address to its associated hostname by querying a PTR record in the in-addr.arpa (IPv4) or ip6.arpa (IPv6) zone, enabling mail servers, logging systems, and security tools to display readable names instead of raw addresses. Organizations must create and maintain PTR records alongside forward DNS records to ensure consistency and support critical functions like mail delivery verification through forward-confirmed reverse DNS and accurate incident investigation through readable logs. Poor PTR management—including missing records, stale entries, and forward-reverse mismatches—causes legitimate mail rejection, confusing logs, and slow incident response, which can be mitigated by automating PTR creation through integrated IP address management systems.

  • Reverse DNS lookups follow the address allocation hierarchy, with the reverse zone usually delegated to the network owner, often through an internet service provider or regional internet registry, and queries traverse from the root through authoritative name servers to retrieve the PTR record or return NXDOMAIN if none exists.
  • Many receiving mail servers enforce forward-confirmed reverse DNS checks, which verify that the hostname returned from a PTR record query resolves back to the same IP address, and missing or mismatched records can cause legitimate mail to be rejected or marked as spam.
  • PTR records are separate from forward A or AAAA records and can disagree with them, requiring administrators to create and maintain both independently and use consistency-checking tools to detect discrepancies that complicate troubleshooting and security investigations.

Reverse DNS lookup at a glance

AttributeValue
Full nameReverse DNS lookup
CategoryDNS query method
Defined inRFC 1035 for IPv4 PTR records and in-addr.arpa, RFC 3596 for IPv6 and ip6.arpa
Protocol and portDNS, port 53 over UDP and TCP
OSI layerLayer 7 (application)
Primary useMapping an IP address to a hostname for logging, troubleshooting, and mail server verification
Related termsPTR record, in-addr.arpa, ip6.arpa, forward DNS lookup, DNS zone, forward-confirmed reverse DNS

How reverse DNS lookup works

A reverse DNS lookup turns an IP address into a name by rewriting the address as a domain name and asking for a PTR record. The delegation of reverse zones follows the address allocation hierarchy.

  1. Reformat the address: The resolver reverses the octets of an IPv4 address and appends in-addr.arpa. For example, 192.0.2.10 becomes 10.2.0.192.in-addr.arpa. IPv6 addresses are written as reversed hexadecimal nibbles under ip6.arpa.
  2. Send a PTR query: The resolver asks for a PTR record at that name. It starts at the root and follows delegations to the name servers responsible for the reverse zone, or answers from cache.
  3. Reach the authoritative server: The reverse zone is usually delegated to the network owner, often through the internet service provider or a regional internet registry for the address block.
  4. Return the answer: The authoritative server returns the PTR record containing a hostname, or a negative response such as NXDOMAIN if no record exists.

A PTR record is separate from the forward A or AAAA record, so the two can disagree. Administrators must create and maintain both. Some tools check consistency by resolving the returned name forward and comparing the result with the original address.

Why reverse DNS lookup matters in enterprise networks

Reverse DNS lookups run constantly in the background. Mail servers, logging systems, security tools, and troubleshooting utilities such as traceroute use them to display names instead of raw addresses. Because every address in use may need a PTR record, the volume of records grows with the size of the network, and each change in addressing must be reflected in the reverse zones.

Reverse DNS also supports security and email delivery. Many receiving mail servers check that a sending IP address has a PTR record, and some require that the returned name resolves back to the same address, a practice known as forward-confirmed reverse DNS. Missing or mismatched records can cause legitimate mail to be rejected or marked as spam. Analysts also rely on PTR data to interpret logs, though it should not be trusted alone, since whoever controls the reverse zone can publish any name.

Poor management shows up as stale records, missing records, and mismatches between forward and reverse data. These slow incident response, produce misleading logs, and cause mail problems. Automating PTR creation alongside address assignment through IP address management reduces these errors.

Reverse DNS lookup vs PTR record

A reverse DNS lookup is the query process that resolves an IP address to a name, while a PTR record is the resource record that stores the answer. What is PTR record?

AttributeReverse DNS lookupPTR record
What it isA query processA DNS resource record type
RoleAsks for the name tied to an addressHolds the name returned to the query
Who creates itA resolver or application on demandAn administrator or an automated DDI process
LocationRuns across resolvers and authoritative serversStored in an in-addr.arpa or ip6.arpa zone

Reverse DNS lookup vs A record

A reverse lookup maps an IP address to a name using a PTR record, while a forward lookup of an A record maps a name to an IPv4 address. What is A record?

AttributeReverse DNS lookupA record
DirectionAddress to nameName to IPv4 address
Record type queriedPTRA
Zone usedin-addr.arpa or ip6.arpaThe zone of the domain name
Delegation followsAddress allocationDomain registration

Common reverse DNS lookup issues

Hosts get addresses from DHCP or static assignment, but nobody creates the matching PTR record. Logs and traceroute output show bare addresses, and some mail servers reject or penalize messages from those hosts.

The PTR record returns a name whose A or AAAA record points to a different address, or to none. Forward-confirmed reverse DNS checks fail, and services that require matching records deny or flag the connection.

The network owner never receives delegation from the provider or address registry for the block. Queries return SERVFAIL or NXDOMAIN, or return the provider's generic names instead of the intended hostnames.

Addresses are reassigned, but old PTR records remain. Logs then attribute traffic to the wrong host name, which complicates incident investigation.

Tools that resolve every address, such as log viewers and firewalls, stall when reverse zones point to name servers that do not respond. The delay shows up as timeouts until the resolver gives up.

See how unified DDI simplifies network operations

Manage DNS, DHCP and IP addresses from one platform with automation, visibility and control built in.

Talk to us

Reverse DNS lookup FAQ

Related terms

Article

PTR record

A DNS record that resolves IPv4 or IPv6 addresses to domain names.

Learn more
Article

A record

A DNS record that maps domain names to IPv4 addresses.

Learn more
Article

AAAA record

A DNS record that maps domain names to IPv6 addresses.

Learn more
Article

IPAM (IP address management)

A method for planning, tracking, and managing IP address space on a network.

Learn more
Article

DNS zone

A distinct, contiguous portion of the domain name space for which administrative responsibility has been delegated to a single manager.

Learn more
Article

Fully Qualified Domain Name (FQDN)

A domain name that specifies its exact location in the tree hierarchy of DNS.

Learn more
Article

DDI (DNS, DHCP, and IPAM)

The integration of DNS, DHCP, and IPAM into one management solution.

Learn more
Article

IPv4 (Internet Protocol version 4)

The fourth version of Internet Protocol that uses 32-bit addresses to route most of today’s internet traffic; the global supply of IPv4 addresses is exhausted. Learn More

Learn more
Browse the full glossary