How does reverse DNS work?
Show the answer
Say this first
A PTR record maps an address back to a name. The address is written backwards under a special domain: 192.0.2.25 becomes 25.2.0.192.in-addr.arpa. IPv6 uses ip6.arpa with every hex nibble written in reverse. Whoever holds the address block controls the reverse zone, usually your ISP or your RIR delegation, not whoever owns the forward domain.
Go deeper
Why backwards
DNS names get more specific from right to left. IP addresses get more specific from left to right.
Reversing the octets lets reverse zones be delegated along address boundaries: the /24 owner gets
2.0.192.in-addr.arpa.
IPv6
2001:db8::25 is expanded to 32 nibbles and reversed:
5.2.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.8.b.d.0.1.0.0.2.ip6.arpadig -x 2001:db8::25 builds that name for you.
Blocks smaller than /24
Reverse delegation follows octet boundaries. For a /28, RFC 2317 classless delegation uses CNAMEs in the ISP's zone that point into a zone you host. Otherwise you ask the ISP to create the PTRs.
Where it matters
- Mail: receivers check that a sending IP has a PTR and that the name resolves back to the same IP (forward-confirmed reverse DNS). Missing or mismatched records hurt delivery.
- Logs and traceroute output become readable.
- Some servers do reverse lookups on every login (OpenSSH
UseDNS), which makes logins slow when reverse DNS times out.
They will ask next
You have a /28 from your ISP. How do you get PTR records for it?
Ask the ISP to create them, or ask for an RFC 2317 delegation so you can manage them in your own DNS. Adding PTRs to your example.com zone does nothing, because nobody looks there.
How do you look up a PTR?
dig -x 192.0.2.25 +shorton Linux, ornslookup 192.0.2.25. Both build the in-addr.arpa name for you.
Traps
- Thinking PTR records for public addresses live in your own forward zone.