What Is a Reverse DNS Lookup (PTR Record)?

What Reverse DNS Is

Forward DNS answers "what address does this name point to?" Reverse DNS answers the opposite question: "what name is associated with this IP address?"

$ dig -x 8.8.8.8 +short
dns.google.

The answer comes from a PTR (pointer) record. Unlike an A record, a PTR record is not stored in your domain's zone — it lives in a special zone derived from the IP address itself, and it is controlled by whoever owns the IP block, not by whoever owns the domain name.

That ownership split is the single most important thing to understand about reverse DNS, and it explains most of the confusion around it.

How the Address Becomes a Name

DNS is hierarchical from right to left (www.example.com narrows from .com inward). IP addresses are hierarchical from left to right — 203.0.113.45 narrows from the 203 block inward. To fit addresses into the DNS tree, they are reversed and placed under a reserved suffix.

IPv4: in-addr.arpa

The four octets are reversed and appended to in-addr.arpa:

203.0.113.45  →  45.113.0.203.in-addr.arpa

IPv6: ip6.arpa

IPv6 uses nibbles — single hex digits — rather than octets. The address is expanded to its full 32-digit form, reversed, dot-separated, and appended to ip6.arpa:

2001:db8::1
  → 2001:0db8:0000:0000:0000:0000:0000:0001   (expanded)
  → 1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.8.b.d.0.1.0.0.2.ip6.arpa

Every IPv6 reverse name has exactly 32 labels before ip6.arpa. Building these by hand is error-prone; dig -x does the conversion for you.

Who Controls the PTR Record

This is where people get stuck. You cannot add a PTR record in the DNS panel for your own domain, because 45.113.0.203.in-addr.arpa is not part of your domain — it is part of the reverse zone for the 203.0.113.0/24 block.

In practice: set the PTR wherever you got the IP address from. AWS, Google Cloud, Azure, Hetzner, DigitalOcean and Linode all expose this — usually labelled "reverse DNS" or "PTR record" on the instance or the Elastic/floating IP, sometimes gated behind a support request for new accounts.

Sub-/24 Delegation

Reverse zones naturally delegate on octet boundaries, which is a problem if you own only part of a /24. RFC 2317 defines a workaround: the ISP creates CNAMEs in the parent reverse zone pointing at names inside a zone they delegate to you. It is fiddly, and if you have fewer than 256 addresses you will usually be asked to submit PTR values to the ISP instead.

Why It Matters: Email Deliverability

Reverse DNS is largely invisible until you send mail from your own server, at which point it becomes a hard requirement.

Receiving mail servers check Forward-Confirmed Reverse DNS (FCrDNS), a two-step test:

1. Look up the PTR for the connecting IP → get a hostname.
2. Look up the A/AAAA record for that hostname → get an address.
3. The address from step 2 must match the connecting IP.

# Step 1
$ dig -x 203.0.113.45 +short
mail.example.com.

# Step 2 — must return the original address
$ dig mail.example.com +short
203.0.113.45

A PTR that points at a hostname which does not resolve back to the same IP fails FCrDNS and is treated the same as having no PTR at all. Setting only half of the pair is a very common mistake.

Google's sender guidelines require valid forward and reverse DNS records for the sending IP, and Microsoft's Outlook.com policies state the same. Servers with no PTR, or with a generic provider-assigned name like 203-0-113-45.static.example-isp.net, are routinely rejected or filed as spam by bulk-mail filters.

Reverse DNS is necessary but not sufficient. It sits alongside SPF, DKIM and DMARC — a correct PTR will not rescue mail that fails authentication, and correct authentication will not rescue mail from an IP with no PTR.

Other Uses

• Log readability. Web, firewall and SSH logs resolve addresses to names so you can see crawler.example-search.com instead of a bare IP.
• Crawler verification. The documented way to confirm a bot really is Googlebot is FCrDNS: reverse-resolve the IP, check it ends in googlebot.com or google.com, then forward-resolve that name and confirm it matches. Trusting the user-agent string alone is trivially spoofable.
• Network troubleshooting. traceroute names hops from PTR records, which is how you can tell a routing change moved your traffic through a different carrier.
• Abuse attribution. A PTR gives an address a human-readable owner, which speeds up incident handling in both directions.

Checking a PTR Record

# IPv4 and IPv6 — dig builds the reverse name for you
dig -x 8.8.8.8 +short
dig -x 2001:4860:4860::8888 +short

# See the reverse name that was actually queried
dig -x 8.8.8.8

# Ask a specific resolver, bypassing your local cache
dig @1.1.1.1 -x 8.8.8.8 +short

# Windows
nslookup 8.8.8.8

# Full FCrDNS check in one line
host 8.8.8.8 | awk '{print $NF}' | xargs host

Troubleshooting

Frequently Asked Questions

Can one IP address have multiple PTR records? Technically yes, but it is discouraged. Validators that expect a single canonical name may behave inconsistently, so a single PTR per address is the safe configuration.

Does reverse DNS affect SEO? Not directly. It matters for verifying that a crawler visiting your site is genuinely who it claims to be, which is a security and log-analysis concern rather than a ranking one.

Do I need a PTR for a web server? Not for HTTP or HTTPS to work — browsers never perform a reverse lookup. It is worth having for clean logs, and it becomes mandatory the moment that host also sends email.

Why does my PTR show my hosting provider's name? Providers assign a generic default PTR to every address in their block. It is valid DNS, but bulk-mail filters treat it as an unconfigured host. Replace it with your own hostname if the IP sends mail.

Is a PTR record the same as an A record in reverse? No. They are independent records in separate zones with separate owners, and nothing forces them to agree. FCrDNS exists precisely because they can disagree.

Run reverse lookups, inspect PTR records, and confirm the forward record matches with the DNS Lookup tool. If you are configuring a mail host, see What Is a CNAME Record? for why a CNAME on that hostname would suppress its MX records.