Reverse DNS Lookup

You can't set your own PTR record — it lives in a zone your provider controls. Why that matters for mail delivery, and what FCrDNS proves that a PTR alone doesn't.

No serious threat intelligence platform relies on reverse DNS alone — residential proxy networks now produce PTR records indistinguishable from genuine residential ISP connections, defeating the simple "datacenter IP = higher risk" heuristic. Here's how reverse DNS combines with other signals in IP reputation scoring, why reverse DNS data decays in forensic reliability over weeks and months, and why FCrDNS doesn't protect against attackers who legitimately own a deceptively-named domain.

A PTR record can say anything — anyone who controls a server can configure their reverse DNS to claim any hostname. FCrDNS (Forward-Confirmed Reverse DNS) verifies authenticity by checking that the PTR hostname resolves back to the original IP. Here's how to read ISP and datacenter naming conventions in PTR records, how reverse DNS reveals email header forgery, and why PTR record changes can indicate BGP hijacking.

A PTR record saying "mail.example.com" for an IP doesn't prove that IP is operated by example.com — it proves whoever controls the reverse DNS zone for that IP chose to set that name. Here's the fundamental asymmetry between forward and reverse DNS, why "forward-confirmed reverse DNS" (FCrDNS) provides substantially more confidence than PTR alone, how Google uses FCrDNS to verify Googlebot traffic, and when PTR records are legitimately useful for logging even without cryptographic verification.

IPv4 and IPv6 reverse DNS use the same in-addr.arpa/ip6.arpa concept — but IPv6's vastly larger address space means most addresses simply don't have PTR records, by practical necessity rather than oversight. Here's how each zone's delegation works, who controls PTR record configuration, and why "no PTR record" is a much more common and unremarkable result for IPv6.