Reverse DNS lookup (rDNS) is a process to determine the hostname or host associated with a given IP address or host address. A hostname (occasionally also, a sitename) is the unique name by which a network attached device ( which could consist of a computer, file server, network storage device, fax machine, copier, cable modem, etc. ... An IP address (Internet Protocol address) is a unique address that devices use in order to identify and communicate with each other on a computer network utilizing the Internet Protocol standard (IP)—in simpler terms, a computer address. ...

Overview

Typically, the DNS is used to determine what IP address is associated with a given hostname; so, to reverse resolve a known IP address is to lookup what the associated hostname is belonging to that IP address. The domain name system (DNS) stores and associates many types of information with domain names, but most importantly, it translates domain names (computer hostnames) to IP addresses. ... An IP address (Internet Protocol address) is a unique address that devices use in order to identify and communicate with each other on a computer network utilizing the Internet Protocol standard (IP)—in simpler terms, a computer address. ... A hostname (occasionally also, a sitename) is the unique name by which a network attached device ( which could consist of a computer, file server, network storage device, fax machine, copier, cable modem, etc. ...

A reverse lookup is often referred to as reverse resolving, or more specifically reverse DNS lookup, and is accomplished using a "reverse IN-ADDR entry" in the form of a PTR record. The Domain Name System or DNS is a system that stores information about host names and domain names in a kind of distributed database on networks, such as the Internet. ...

Reverse DNS requirement

RFC 1912 Section 2.1 states "Every Internet-reachable host should have a name" and "Make sure your PTR and A records match". RFC 1033 Section "INSTRUCTIONS" states the following (note especially the last sentence):

 Adding a host. To add a new host to your zone files: Edit the appropriate zone file for the domain the host is in. Add an entry for each address of the host Optionally add CNAME, HINFO, WKS, and MX records. Add the reverse IN-ADDR entry for each host address in the appropriate zone files for each network the host i[s] on. 

IPv4 Reverse DNS

Reverse DNS lookups for IPv4 addresses use a reverse IN-ADDR entry in the special domain in-addr.arpa. An IPv4 address is represented in the in-addr.arpa domain by a sequence of bytes in reverse order, represented as decimal numbers, separated by dots with the suffix .in-addr.arpa. For example, the reverse lookup domain name corresponding to the IPv4 address 10.12.13.140 is 140.13.12.10.in-addr.arpa. A host name for 1.2.3.4 can be obtained by issuing a DNS query for the PTR record for that special address 4.3.2.1.in-addr.arpa. Internet Protocol version 4 is the fourth iteration of the Internet Protocol (IP) and it is the first version of the protocol to be widely deployed. ... The Domain Name System or DNS is a system that stores information about host names and domain names in a kind of distributed database on networks, such as the Internet. ...

Classless Reverse DNS

Historically, IP addresses were allocated in blocks of 256. Thus, each block fell upon an octet boundary. This made configuration of the PTR records easy, since the dot separators delimited each block. Today however, IP addresses are allocated in very much smaller blocks, and hence the traditional way of configuring a nameserver to perform reverse DNS cannot work. A means of overcoming this problem was devised and published as RFC 2317. It uses a CNAME entry which corresponds to each block. An IP address is a unique number, akin to a telephone number, used by machines (usually computers) to refer to each other when sending information through the Internet using the Internet Protocol. ...

IPv6 Reverse Lookup

Reverse DNS lookups for IPv6 addresses use similarly the special domain ip6.arpa. An IPv6 address is represented as a name in the ip6.arpa domain by a sequence of nibbles in reverse order, represented as hexadecimal digits, separated by dots with the suffix .ip6.arpa. For example, the reverse lookup domain name corresponding to the IPv6 address 4321:0:1:2:3:4:567:89ab is b.a.9.8.7.6.5.0.4.0.0.0.3.0.0.0.2.0.0.0.1.0.0.0.0.0.0.0.1.2.3.4.ip6.arpa. Internet Protocol version 6 (IPv6) is a network layer protocol for packet-switched internetworks. ... A nibble (or less commonly, nybble) is the computing term for the aggregation of four bits, or half an octet (an octet being an 8-bit byte). ...

Multiple PTR records

While most rDNS entries only have one PTR record, it is perfectly legal to have many different PTR records[1]. For example, if a webserver supports many virtual hosts, there can be one PTR record for each host and some versions of name server software will automatically add a PTR record for each host. Multiple PTR records can cause a couple of problems, including triggering bugs in programs that only expect there to ever be a single PTR record and, in the case of a large webserver, having hundreds of PTR records can cause the DNS packets to be much larger than normal. Virtual hosting is a method that web servers use to host more than one domain name on the same computer and IP address. ...

Records other than PTR records

While uncommon compared with PTR records, it is also legal to put other types of records in the reverse DNS tree. In particular, encryption keys can be placed there for, example, IPsec (RFC 4025), SSH (RFC 4255) and IKE (RFC 4322). Less standardized usages include comments placed in TXT records and LOC records to identify the location of the IP address. IPsec (IP security) is a suite of protocols for securing Internet Protocol (IP) communications by encrypting and/or authenticating each IP packet in a data stream. ... In computing, Secure shell, or SSH, is both a computer program and an associated network protocol designed for logging into and executing commands on a remote computer. ... IKE or Ike can refer to: Internet key exchange, a key agreement protocol Dwight D. Eisenhower, popularly known as Ike Chicagos Eisenhower Expressway, the main east-west expressway through the city, also known as The Ike Ike, a television miniseries about the life and action of Eisenhower during WWII... The LOC record (RFC1876) is a means for expressing location information in the Domain Name System. ...

Uses

The most common uses of the reverse DNS are:

• The original use of the rDNS was primarily for network troubleshooting tools, such as traceroute, ping, and the "Received:" trace header field for SMTP e-mail, web sites tracking users (especially on Internet forums), etc.

• One e-mail anti-spam technique is to check the domain names in the rDNS to see if they are likely from dialup users, dynamically assigned addresses, or home-based broadband customers. Since the vast majority, but by no means all, of e-mail that originates from these computers is spam, many mail servers also refuse e-mail with missing or "generic" rDNS names. [2] [3]

• A Forward Confirmed reverse DNS (FCrDNS) verification can create a form of authentication showing a valid relationship between the owner of a domainname and the owner of the server that has been given an IP address. While not very thorough, this validation is strong enough to often be used for whitelisting purposes, mainly because spammmers and phishers usually can't pass verification for it when they use zombie computers to forge domains.

tracert in action on Windows XP. traceroute, or tracepath on modern Linux systems, tracert on Windows operating system, is a TCP/IP utility which allows the user to determine the route packets take to reach a particular host. ... ping in a Windows 2000 command window ping is a computer network tool used to test whether a particular host is reachable across an IP network. ... Simple Mail Transfer Protocol (SMTP) is the de facto standard for email transmission across the Internet. ... A typical Internet forum discussion, with common elements such as emoticons, avatars, and quotes. ... To prevent e-mail spam, both end users and administrators of e-mail systems use various anti-spam techniques. ... FCrDNS, or Forward Confirmed Reverse DNS, is when an IP address has both forward (name -> IP) and reverse (IP -> name) DNS entries that match each other. ... A white list (or to whitelist, the action), as opposed to a black list, is a list of accepted people/companies/elements/etc. ... This article or section does not adequately cite its references or sources. ... This phishing attempt, disguised as an official email from a (fictional) bank, attempts to trick the banks members into giving away their account information by confirming it at the phishers linked website. ... A zombie computer, abbreviated zombie, is a computer attached to the Internet that has been compromised by a security cracker, a computer virus, or a trojan horse. ...

External links

• How Reverse DNS Works
• Reverse DNS Lookup Tool from Open RBL
• RFC 2317 documents a way to do rDNS delegation for CIDR blocks
• Considerations for the use of DNS Reverse Mapping (Internet draft)