Reverse DNS (PTR): from number back to name

Module 4: Records for email · Reading time: 6 minutes

Learning objective: After this lesson, you can explain what reverse DNS is, who sets it up, and why receiving mail servers pay attention to it.

Key concepts: reverse DNS, PTR record, in-addr.arpa, ip6.arpa, managed by the owner of the IP address, forward-confirmed reverse DNS (FCrDNS), HELO/EHLO name

The other way round

So far, everything has gone from name to number: mail.example.com has A record 192.0.2.25. Reverse DNS goes the other way: the IP address 192.0.2.25 corresponds to the name mail.example.com. This is stored in a PTR record (pointer).

For an ordinary website, you don't need reverse DNS. For a mail server, you do: almost every receiving mail server checks, on an incoming connection, which name belongs to the sender's IP address. A server without reverse DNS, or with a generic name like 192-0-2-25.dynamic.provider.example, looks like a hacked home computer sending spam. Since February 2024, Gmail requires all senders to have a valid reverse DNS for their IP address that also points back correctly.

What does it look like?

Reverse DNS uses a special part of the DNS tree. For IPv4, this is in-addr.arpa, and the IP address appears there backwards:

192.0.2.25  →  25.2.0.192.in-addr.arpa.

25.2.0.192.in-addr.arpa.  3600  IN  PTR  mail.example.com.

Why backwards? A DNS name becomes more specific from right to left (lesson 1.2), while an IP address becomes more specific from left to right. By reversing it, the block 192.0.2 can be delegated as a single zone to the owner of that block.

For IPv6, the address is stored under ip6.arpa, also backwards, but per hexadecimal digit (nibble), with all zeros written out. For 2001:db8::25, this becomes a long name ending in ...8.b.d.0.1.0.0.2.ip6.arpa. You never have to type this yourself: panels and tools take care of it.

Who sets it up?

This is where the big difference with all other records lies. A PTR record is not in the zone of your domain, but in the reverse zone of the IP address. And that zone belongs to whoever manages the IP address: your hosting provider, your VPS provider or your internet provider.

This means:

• You cannot put a PTR record in the DNS management of your domain. A record of type PTR in your regular zone does nothing.
• If you rent a VPS or server, you'll usually find a field called "Reverse DNS" or "rDNS" in your provider's panel, or you can request it via support.
• If you use a hosting package or a mail provider such as Microsoft 365 or Google Workspace, that party handles the reverse DNS of its own mail servers. You don't need to do anything for this.
• If you run a mail server at home or in the office on an internet connection, your internet provider determines the reverse DNS. Many providers don't allow this for consumer connections.

Forward and reverse must match

Recipients don't just check whether a PTR exists, but also whether it matches in reverse:

1. The IP address 192.0.2.25 has PTR mail.example.com.
2. The name mail.example.com has A record 192.0.2.25.

If both sides match, this is called forward-confirmed reverse DNS (FCrDNS). In addition, the name the mail server introduces itself with (the HELO or EHLO name) should be the same, or at least a name that also exists.

The same applies for IPv6. If your server also sends mail via IPv6, the IPv6 address needs its own PTR and an AAAA record. A forgotten IPv6 PTR is a well-known cause of mail being rejected by Gmail, while everything works fine over IPv4.

Checking

With a command window (lesson 8.2):

dig -x 192.0.2.25 +short
nslookup 192.0.2.25

Online, most DNS tools let you do a "reverse lookup" or "PTR lookup" on an IP address.

In practice: what it looks like in a panel

In this example, we use the VPS screen in My WebOké: it has a tab for reverse DNS. If the domain is in the same DNS, the panel creates the A and AAAA records and the PTR in one go. If the domain is elsewhere, you first create the A and AAAA record with your DNS manager and then request the reverse DNS.

With other VPS and server providers, the field is called "Reverse DNS", "rDNS" or "PTR" and is usually found next to the server's IP address. The principle is the same: the provider sets the record, you choose the name.

Summary

• A PTR record links an IP address back to a name (in-addr.arpa for IPv4, ip6.arpa for IPv6).
• The manager of the IP address sets it up, not the manager of your domain.
• Receiving mail servers expect reverse and forward DNS to match (FCrDNS), for both IPv4 and IPv6.
• For websites, and for mail via a hosting provider or mail provider, you don't need to do anything yourself.

Quiz

Exercise

Exercise Z4.6: Looking up reverse DNS. Look up the MX records of wikipedia.org and choose a mail server. Look up the IPv4 address of that mail server, and then the reverse DNS (PTR) of that address. Enter the IP address and the name you found. Bonus: check whether the name points back to the same IP address. (Not a setup exercise: you can't set reverse DNS yourself in a practice zone, and that's exactly the lesson.)

Further reading

The steps in this article apply to WebOké's panels; with other providers it works similarly.

• Sending mail from your VPS and setting up reverse DNS
• DirectAdmin guide 18.10: I can't send email
• RFC 1035 section 3.5 (in-addr.arpa), RFC 3596 (ip6.arpa), Google's guidelines for senders (February 2024)