A reverse DNS lookup takes an IP address and returns the domain name associated with that IP. A traditional DNS lookup does just the opposite.
What is reverse DNS?
A reverse DNS lookup is a DNS query for the domain name associated with a given IP address. This accomplishes the opposite of the more-commonly-used forward DNS lookup, in which the DNS system is queried to return an IP address.
There are standards from the Internet Engineering Task Force (IETF) suggesting that every domain should be capable of reverse DNS lookup, but as reverse lookups are not critical to the normal function of the internet, they are not a hard requirement. As such, reverse DNS lookups are not universally adopted.
What are reverse DNS lookups used for?
Reverse lookups are very commonly used by email servers. Many email servers will reject messages from any server that does not support reverse lookups. This is because spammers typically use invalid IPs, so these email servers check and see if the message came from a valid server before bringing it onto their network.
It’s also common for logging software to employ reverse lookups in order to provide users with human-readable domains in their log data as opposed to a bunch of numeric IP addresses.
How does reverse DNS work?
Reverse DNS lookups query DNS servers for a PTR (pointer) record; if the server does not have a PTR record, it cannot resolve a reverse lookup. PTR records store IP addresses with their segments reversed, and they append ‘.in-addr.arpa’ to that. For example if a domain has an IP address of 1.2.3.4, the PTR record will store that information as 4.3.2.1.in-addr.arpa.
