Reverse DNS Lookup

No serious threat intelligence platform relies on reverse DNS alone — residential proxy networks now produce PTR records indistinguishable from genuine residential ISP connections, defeating the simple "datacenter IP = higher risk" heuristic. Here's how reverse DNS combines with other signals in IP reputation scoring, why reverse DNS data decays in forensic reliability over weeks and months, and why FCrDNS doesn't protect against attackers who legitimately own a deceptively-named domain.

A PTR record can say anything — anyone who controls a server can configure their reverse DNS to claim any hostname. FCrDNS (Forward-Confirmed Reverse DNS) verifies authenticity by checking that the PTR hostname resolves back to the original IP. Here's how to read ISP and datacenter naming conventions in PTR records, how reverse DNS reveals email header forgery, and why PTR record changes can indicate BGP hijacking.

A PTR record saying "mail.example.com" for an IP doesn't prove that IP is operated by example.com — it proves whoever controls the reverse DNS zone for that IP chose to set that name. Here's the fundamental asymmetry between forward and reverse DNS, why "forward-confirmed reverse DNS" (FCrDNS) provides substantially more confidence than PTR alone, how Google uses FCrDNS to verify Googlebot traffic, and when PTR records are legitimately useful for logging even without cryptographic verification.

IPv4 and IPv6 reverse DNS use the same in-addr.arpa/ip6.arpa concept — but IPv6's vastly larger address space means most addresses simply don't have PTR records, by practical necessity rather than oversight. Here's how each zone's delegation works, who controls PTR record configuration, and why "no PTR record" is a much more common and unremarkable result for IPv6.

IP geolocation is 95–99% accurate at country level and 50–80% accurate at city level — and VPN users are always wrong by design. Here's how geolocation databases work, the legitimate business uses, the VPN problem for geo-dependent services, and what an IP lookup actually reveals beyond location.