What can reverse DNS tell me about an IP address?¶
title: "What can reverse DNS tell me about an IP address?" card_id: "IP-042" status: "complete" source_document: "https://docs.google.com/document/d/1mJQDqiWG43AeEyaXucfNuVMGzl-bWPB_AhwCWaSLNJQ/edit?usp=drivesdk"
What can reverse DNS tell me about an IP address?¶
What can reverse DNS tell me about an IP address?¶
Ordinary DNS commonly starts with a name and returns an IP address.
Reverse DNS goes in the opposite direction.
It starts with an IP address and asks whether a hostname has been published for it.
This is normally done using a type of DNS record called a PTR record—short for pointer record.
For example, a reverse-DNS lookup of an address might return a name that appears to belong to an internet provider, mail server, cloud platform or other network service.
That name can provide useful clues.
It may suggest which organisation operates the infrastructure, whether the address is part of a residential broadband range or whether it appears to be used for hosting, email or another particular purpose.
Some providers use hostnames that contain apparent geographic references, customer-line identifiers or descriptions such as broadband, static, mail or server.
But those labels are chosen by the organisation controlling reverse DNS for the address.
They aren't independently verified descriptions of the device or its location.
A hostname containing the name of a city doesn't prove that the device was physically located there. It may refer to a network gateway, service region or internal naming convention.
Reverse DNS is also optional.
Many IP addresses don't have a PTR record at all. A failed reverse lookup doesn't mean that the address is invalid or unused.
Where a PTR record exists, it normally provides a selected hostname for the address.
It doesn't produce a complete list of every domain or website using that address.
An IP address used for shared hosting may support thousands of domain names while its reverse-DNS record shows only a generic name belonging to the hosting provider.
The reverse relationship may not match the forward relationship either.
A PTR record can point to a hostname even if that hostname doesn't currently resolve back to the same address.
Records can also be outdated, incorrectly configured or changed after the event being investigated.
Most importantly, a reverse-DNS name doesn't identify the customer who was using the address at a particular time.
It doesn't prove which website was visited, which device communicated or who was responsible for the activity.
Reverse DNS can help classify an address and identify possible infrastructure or providers.
It adds context to an IP address, but the returned hostname remains a network-administered label—not a verified identity.