Reverse DNS (PTR Records): How to Check and Set Them with dig and host

This article is a localized edition of the Japanese original. Read the Japanese original

Reverse DNS is how you look up a hostname from an IP address. The reverse lookup data is stored as PTR records. If you run a mail server, you need to know how to set it up and check it, because receiving servers look up the reverse DNS of the sending IP.

This article covers the commands for checking reverse DNS, how to read the results, how to confirm that forward and reverse DNS match, and how to figure out where reverse DNS is configured. The example IP addresses and domain are the ones reserved for documentation: 203.0.113.0/24, 2001:db8::/32 and example.com.

How reverse DNS works

A forward lookup goes from mail.example.com to 203.0.113.25; a reverse lookup goes the other way. For IPv4, the PTR record lives at a name made by writing the four numbers of the IP address in reverse order and adding in-addr.arpa at the end.

Reverse lookup name for 203.0.113.25
25.113.0.203.in-addr.arpa.  3600  IN  PTR  mail.example.com.

For IPv6, write the address out in full, reverse its hexadecimal digits one at a time, and add ip6.arpa at the end.

Reverse lookup name for 2001:db8::25
5.2.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.8.b.d.0.1.0.0.2.ip6.arpa.

The in-addr.arpa and ip6.arpa zones are delegated along the path of IP address allocation: from the regional internet registries to providers, and from providers to their customers. That means the party that can set a PTR record is whoever manages the IP address: the provider, or the organization the address block is allocated to. Adding a PTR record in your own domain's DNS settings does nothing for reverse DNS.

Find your server’s IP address

Look up the global IP address of the server whose reverse DNS you want to check.

# IPv4
ip -4 addr show scope global

# IPv6
ip -6 addr show scope global

In some environments, such as AWS EC2, the server only has a private IP and outgoing traffic uses a separate global IP (an Elastic IP, for example). In that case, check the outgoing IP address in the provider's console. For email, what matters is the reverse DNS of the sending IP address as the other side sees it.

Commands for checking reverse DNS

dig

With -x, dig builds the reverse lookup name from the IP address and queries it. It comes in the bind9-dnsutils (or dnsutils) package on Ubuntu and Debian, and in bind-utils on RHEL-based systems.

# Show only the resulting hostname
dig -x 203.0.113.25 +short

# IPv6
dig -x 2001:db8::25 +short

# Querying the reverse name directly gives the same result
dig 25.113.0.203.in-addr.arpa PTR +short

Run it without +short to also see the response status (status:).

dig -x 203.0.113.25

host

host 203.0.113.25

If reverse DNS is set, you'll see something like this:

25.113.0.203.in-addr.arpa domain name pointer mail.example.com.

When you pass an IP address to host, it does a reverse lookup automatically. If you add in-addr.arpa without reversing the address, as in host -t ptr 203.0.113.25.in-addr.arpa, you query a different name and won't get the right result.

nslookup (Windows and Linux)

nslookup 203.0.113.25

In Windows PowerShell you can also use Resolve-DnsName.

Resolve-DnsName -Name 203.0.113.25 -Type PTR

Reading the results

If you still get the old result right after changing reverse DNS, your local resolver may have cached the previous answer. Querying the authoritative servers for the reverse zone directly avoids the cache.

# Find the name servers for the reverse zone (when it is delegated per /24)
dig +short NS 113.0.203.in-addr.arpa

# Query that name server directly
dig -x 203.0.113.25 @name-server +short

Check that forward and reverse DNS match

Many receiving mail servers also check whether the hostname from the reverse lookup resolves back to the original IP address. When this reverse-then-forward lookup matches, it's called FCrDNS (Forward-Confirmed reverse DNS).

ip=203.0.113.25
name=$(dig -x "$ip" +short | head -n 1)
echo "Reverse: $name"
dig +short "$name" A

If the output of the last command includes the original IP address (203.0.113.25 here), they match. For IPv6, replace A with AAAA.

Where reverse DNS is configured

Because reverse DNS is set by whoever manages the IP address, where you configure it depends on your environment.

If you're not sure where to set it, look up the reverse zone's name servers with dig +short NS as shown above. If the provider's name servers come back, set it in that provider's control panel or through its support.

Before you set it, point the forward record (an A record, or AAAA for IPv6) of the hostname you'll use at the same IP address in your own domain's DNS. Some providers won't accept a reverse DNS setting unless the forward lookup matches. Step-by-step instructions for each environment are in How to set up reverse DNS (PTR records).

/etc/hosts can’t set reverse DNS

Writing an IP address and hostname in the server's /etc/hosts only changes name resolution inside that server. It doesn't change the PTR record in DNS, so it has no effect on the reverse DNS that outside mail servers see. Because dig and host query DNS directly, the contents of /etc/hosts don't show up in their results.

What to align on a mail server

After setting reverse DNS, make the hostname your mail server announces when it connects (HELO / EHLO) match the reverse DNS hostname. In Postfix, set it with myhostname in /etc/postfix/main.cf.

myhostname = mail.example.com

sudo postfix check
sudo systemctl reload postfix

Reverse DNS tells others whose server an IP address belongs to. Proving that the sending domain is legitimate is the job of SPF, DKIM and DMARC. For how to check those, see How to check SPF, DKIM and DMARC.

Summary

• Check reverse DNS with dig -x IP-address +short, host IP-address or nslookup IP-address. If you write the in-addr.arpa name yourself, reverse the order of the IP address.
• NXDOMAIN or an empty answer means it isn't set. Right after a change, confirm by querying the authoritative servers directly.
• For a mail server, confirm that the reverse DNS hostname resolves back to the original IP (FCrDNS).
• PTR records are set by whoever manages the IP address. Writing them in your own domain's DNS or in /etc/hosts doesn't create reverse DNS.

Questions about WordPress? The publisher of this site is based in Japan and replies in Japanese. Contact (Japanese)