Reverse DNS (in-addr.arpa / ip6.arpa)
How reverse DNS works, PTR record construction, and examples for IPv4 and IPv6 addresses.
What is Reverse DNS?
Reverse DNS (rDNS) converts IP addresses back to domain names using PTR records. While normal DNS goes from name to IP address, reverse DNS goes from IP address to name. This is used for logging, email verification, security checks, and troubleshooting. Many mail servers require valid reverse DNS to accept email.
How Reverse DNS Works
Reverse DNS uses special domains that represent IP addresses in reverse order: - IPv4 uses the .in-addr.arpa domain - IPv6 uses the .ip6.arpa domain The IP address is reversed and each part becomes a label in the domain name, then a PTR record provides the hostname.
IPv4 Reverse DNS (in-addr.arpa)
Process Steps
- Take the IPv4 address (e.g., 192.0.2.1)
- Reverse the octets (1.2.0.192)
- Add .in-addr.arpa domain (1.2.0.192.in-addr.arpa)
- Query for PTR record at that name
- PTR record contains the hostname
IPv4 Examples
1.2.0.192.in-addr.arpahost1.example.com1.0.0.10.in-addr.arpagateway.internal1.254.16.172.in-addr.arparouter.company.local8.8.8.8.in-addr.arpadns.googleNetwork Delegation
ISPs delegate reverse DNS zones to customers for their IP blocks
| Network | Reverse Zone | Description |
|---|---|---|
192.0.2.0/24 | 2.0.192.in-addr.arpa | Entire /24 network reverse zone |
203.0.113.0/27 | 0-27.113.0.203.in-addr.arpa | Smaller subnet with CNAME delegation |
IPv6 Reverse DNS (ip6.arpa)
Process Steps
- Take IPv6 address and expand to full form
- Remove colons and reverse all hex digits
- Insert dots between each hex digit
- Add .ip6.arpa domain
- Query for PTR record
IPv6 Examples
2001:0db8:0000:0000:0000:0000:0000:00011.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.8.b.d.0.1.0.0.2.ip6.arpahost1.example.com2001:0db8:85a3:0000:0000:8a2e:0370:73344.3.3.7.0.7.3.0.e.2.a.8.0.0.0.0.0.0.0.0.3.a.5.8.8.b.d.0.1.0.0.2.ip6.arpaserver.company.netfe80:0000:0000:0000:0000:0000:0000:00011.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.8.e.f.ip6.arpa(typically not configured)Practical Examples and Tools
Command Examples
| Command | Description | Expected Result |
|---|---|---|
dig -x 8.8.8.8 | Query reverse DNS for 8.8.8.8 | dns.google. |
dig PTR 8.8.8.8.in-addr.arpa | Direct PTR query (same as above) | dns.google. |
dig -x 2001:4860:4860::8888 | IPv6 reverse DNS query | dns.google. |
nslookup 1.1.1.1 | Windows/generic reverse lookup | one.one.one.one. |
Common Use Cases
- Email servers checking sender reputation
- Web server logs showing hostnames instead of IPs
- Security tools identifying suspicious connections
- Network troubleshooting and asset identification
- Compliance auditing and documentation
Troubleshooting Common Issues
Causes: PTR record not configured, Wrong delegation, DNS server issue
Solutions: Check with IP provider, Verify PTR record exists, Test different DNS servers
Causes: Misconfigured PTR record, Stale DNS cache, Wrong hostname
Solutions: Verify PTR points to correct name, Clear DNS cache, Check forward/reverse match
Causes: Mail server missing PTR record, PTR doesn't match HELO name
Solutions: Configure PTR record with ISP, Ensure PTR matches mail server name
Best Practices
- Always configure reverse DNS for mail servers
- Use meaningful hostnames in PTR records
- Ensure forward and reverse DNS match
- Keep PTR records up to date when changing hostnames
- Test reverse DNS from multiple locations
- Document your reverse DNS naming convention