The domain name system (DNS) is one of the most important instances on the Internet. That is, without DNS and its union of name servers, using the global public computer network would be much more complicated. This registration system is precisely responsible for the management of project addresses on the World Wide Web: when a website is registered in DNS, an entry is created that contains both the domain address (easier for the user to read) as the linked IP address. Therefore, we can type the address example.es in the browser and access the corresponding website because a DNS server automatically translates these domain addresses into the corresponding IP addresses in the background.
In certain cases it may be useful to go the other way, that is, determining the domain address or host name from a specific IP address. This article explains how exactly this process called Reverse DNS (rDNS) or Reverse DNS lookup is carried out.
What is Reverse DNS?
The DNS query that allows determining the IP address from a given domain or host name is called Reverse DNS (rDNS) or Reverse DNS lookup . The requirement is that there is a so-called PTR ("pointer") record linked to the name and that it allows this type of "reverse" lookup in the domain name system. Those responsible for organizing these entries, which are located in their own namespace (domain), are various Internet providers. Modifications to this pointer are only possible after consultation with the provider.
When and for whom is a Reverse DNS lookup useful?
Like the standard lookup process, Reverse DNS provides not only name or IP address resolution, but also some additional information. In this way, in addition to the desired host name , with a Lookup you also obtain a geographical assignment of the IP and information about the responsible Internet service provider. This information is not particularly valuable for analysis of private users, since the automatically generated real names linked to IP addresses do not allow personal identification that would be relevant for marketing purposes. However, user location data can be very profitable, as it allows you to draw conclusions about the target markets you are targeting.
The information from Reverse DNS lookups is especially useful for B2B marketing: most companies have their own IP address, so in many cases it is possible to easily reconstruct when a particular company is using their website.
Note!
Reverse DNS is also often used for sending and transferring emails: numerous mail servers use this technology to verify that received messages do not come from spam servers. For this purpose, the PTR records of the corresponding sending servers are requested. If the indicated email domain does not correspond to the sender's address or if there is no Reverse DNS entry, the message will be marked as spam.
How does Reverse DNS (rDNS) work exactly?
Having a Reverse DNS lookup look up the IP address of a device or Internet server across the entire domain name system would be time-consuming. For reverse DNS lookups, a domain with three subdomains has been configured with in-addr.arpa (for IPv4 addresses) or ip6.arpa (for IPv6 addresses), allowing address resolution in a maximum of three steps. The subdomains have the following structure:
-
rDNS 1 subdomain: The subdomain immediately after in-addr.arpa or ip6.arpa represents the first component of the IP address.
-
rDNS 2 subdomain: At level 2 is the second component of the IP address.
-
rDNS subdomain 3: rDNS subdomain 3 contains the third component of the corresponding IP address.
The individual components of the IP address are arranged to the left of the main domain in the reverse or analogous order of their proximity. The third-level rDNS subdomain for all IPv4 addresses in the 192.0.2.x address space is, for example:
2.0.192.in-addr.arpaNote!
For IPv6 addresses there is not just a single Reverse DNS domain: in case the host name must be determined from one of these new addresses, instead of using the typical notation (eight blocks of bits separated by colons) They must use all numbers and letters (also all zeros) individually, each separated by a period.
Reverse DNS lookup explained in concrete examples
The easiest way to illustrate how Reverse DNS domains work is with a brief example search. In this way, the search for the IPv4 address 217.160.0.128 should look like this:
128.0.160.217.in-addr.arpaWhen you start this search with a Reverse DNS lookup tool you get the following result:
The hostname for 217.160.86.40 is 217-160-0-128.elastic-ssl.ui-r.com.The domain shown (elastic-ssl.ui-r.com) is operated by IONOS: specifically, it is a test website hosted on IONOS servers. This information can be provided by numerous Lookup tools.
The web project can also be accessed through the IPv6 address 2001:8d8:100f:f000::2e3, for which the rDNS Lookup would look like this:
3.e.2.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.f.f.0.0.1.8.d.8.0.1.0.0.2.ip6.arpaReverse DNS: Best Tools for Reverse DNS Lookup
With nslookup, most Linux, Windows and macOS systems already have a tool that allows you to perform any search in the domain name system. With this program it is possible to carry out both standard DNS lookups and Reverse DNS lookups, in which the local DNS server specified by the provider is contacted as standard. If necessary, it is also possible to define another server name.
Alternatively, address lookups can also be carried out with rDNS via the web. There are a variety of online tools based on nslookup that allow you to perform individual DNS server lookups directly in the browser. Among them are the following three solutions:
- MxToolBox: MxToolBox is a web service that offers different network diagnostic and Lookup tools. Although some of these offers are paid, the Reverse DNS check with SuperTool is always free. To use it, you just have to select the "Reverse Lookup" option and type the IPv4 or IPv6 address.
- WhatIsMyIP.com: Unlike what the name of the website implies, on WhatIsMyIP.com it is not only possible to check what the IP address is, but also to perform rDNS lookups. To do this, you must select the “Reverse DNS Lookup” point, enter the IPv4 or IPv6 address in the entry line and click on “Lookup”.
- Debouncer: The Debouncer web service is specifically designed to check whether one's own domain or commonly used mail server is on a spam blacklist. Through the “Reverse DNS check” option it is also possible to perform reverse DNS lookups, although it is only possible to check IPv4 addresses.