Reverse DNS lookup

In

Although the informational RFC 1912 (Section 2.1) recommends that "every Internet-reachable host should have a name" and that "for every IP address, there should be a matching PTR record," it is not an Internet Standard requirement, and not all IP addresses have a reverse entry.

Historical usage

The modern "reverse DNS lookup" should not be confused with the now-obsolete "inverse query" (IQUERY) mechanism specified in

Inverse queries take the form of a single

resource record (RR) in the answer section of the message, with an empty question section. The owner name of the query RR and its time to live (TTL) are not significant. The response carries questions in the question section which identify all names possessing the query RR which the name server knows. Since no name server knows about all of the domain namespace, the response can never be assumed to be complete. Thus inverse queries are primarily useful for database management and debugging activities. Inverse queries are not an acceptable method of mapping host addresses to host names; use the in-addr.arpa domain instead.^[2]

Historically, Internet registries and Internet service providers allocated IP addresses in blocks of 256 (for Class C) or larger octet-based blocks for classes B and A. By definition, each block fell upon an octet boundary. The structure of the reverse DNS domain was based on this definition. However, with the introduction of Classless Inter-Domain Routing, IP addresses were allocated in much smaller blocks, and hence the original design of pointer records was impractical, since autonomy of administration of smaller blocks could not be granted. RFC 2317 devised a methodology to address this problem by using CNAME records.

IPv6 reverse resolution

Reverse DNS lookups for IPv6 addresses use the special domain ip6.arpa (previously ip6.int^[4]). An IPv6 address appears as a name in this domain as a sequence of nibbles in reverse order, represented as hexadecimal digits as subdomains. For example, the pointer domain name corresponding to the IPv6 address 2001:db8::567:89ab is b.a.9.8.7.6.5.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.8.b.d.0.1.0.0.2.ip6.arpa.

Multiple pointer records

While most rDNS entries only have one PTR record, DNS does not restrict the number. Multiple PTR records are used, for example, when a web server supports many

Records other than PTR records

Record types other than PTR records may also appear in the reverse DNS tree. For example, encryption keys may be placed there for IPsec, SSH and IKE. DNS-Based Service Discovery uses specially-named records in the reverse DNS tree to provide hints to clients about subnet-specific service discovery domains.^[5] Less standardized usages include comments placed in TXT records and LOC records to identify the geophysical location of an IP address.

Uses

The most common uses of the reverse DNS include:

• The original use of the rDNS: network troubleshooting via tools such as
  SMTP e-mail, web sites tracking users (especially on Internet forums
  ), etc.
• One
  e-mail anti-spam technique: checking the domain names in the rDNS to see if they are likely from dialup users, or dynamically assigned addresses unlikely to be used by legitimate mail servers. Owners of such IP addresses typically assign them generic rDNS names such as "1-2-3-4-dynamic-ip.example.com." Some anti-spam filters assume that email that originates from such addresses is likely to be spam, and may refuse connection.^[6][7]
• A
  zombie computers
  to forge domain records.
• System logging or monitoring tools often receive entries with the relevant devices specified only by IP addresses. To provide more human-usable data, these programs often perform a reverse lookup before writing the log, thus writing a name rather than the IP address.