# Reverse DNS Lookup

Reverse DNS lookup: turn a public IPv4 or IPv6 address into the host names published in its PTR record (via in-addr.arpa / ip6.arpa) and verify forward-confirmed reverse DNS (FCrDNS) by resolving each name back to an address. Accepts an IP, an arpa name or a URL containing an IP. Private, loopback, link-local and documentation addresses are refused. Returns the names with TTLs, the response code, and per-name forward results with a confirmed/partial/failed verdict. A missing PTR record is a normal result, not an error.

**Not for:** Finding every domain hosted on an IP (that needs passive DNS), or WHOIS/ownership of the address block (use ip_whois).

- Tool id: `reverse-dns`
- Category: dns
- Execution: network
- MCP tool `reverse_dns` at https://lookupowl.com/mcp
- REST `GET https://lookupowl.com/api/v1/tools/reverse-dns` (or POST a JSON body)
- OpenAPI: https://lookupowl.com/api/openapi.json

## Input

| Field | Type | Required | Default | Description |
|---|---|---|---|---|
| `ip` | string | yes |  | A public IPv4 or IPv6 address, e.g. 8.8.8.8 or 2001:4860:4860::8888. A full in-addr.arpa / ip6.arpa name or a URL containing an address is reduced to the address. Private and reserved addresses are refused. max length 253 |
| `forwardConfirm` | boolean | no | `true` | Also resolve each returned host name (up to 5) and check that it points back to the same address (forward-confirmed reverse DNS, what mail servers and bot verification rely on). |

## Output

Results are wrapped in an envelope: `tool`, `version`, `requestId`, `data`, `summary`, `meta` (cache status, timing), `permalink`. `data` has these fields:

| Field | Type | Description |
|---|---|---|
| `ip` | string |  |
| `version` | number |  |
| `arpa` | string | The reverse name that was queried. |
| `status` | "found" \| "none" \| "failed" | found = at least one PTR record, none = the address has no PTR record, failed = the resolver returned SERVFAIL or REFUSED. |
| `rcode` | "NOERROR" \| "NXDOMAIN" \| "SERVFAIL" \| "REFUSED" \| "FORMERR" \| "NOTIMP" \| "TIMEOUT" \| "NETWORK" |  |
| `hostnames` | object[] |  |
| `forwardConfirm` | object |  |
| `resolver` | string |  |
| `ms` | number |  |
| `minTtl` | integer | min -9007199254740991, max 9007199254740991 |
| `notes` | string[] |  |

## Examples

### Reverse lookup of 8.8.8.8

```json
{"ip":"8.8.8.8","forwardConfirm":true}
```

```bash
curl 'https://lookupowl.com/api/v1/tools/reverse-dns?forwardConfirm=true&ip=8.8.8.8'
```

Web page: https://lookupowl.com/reverse-dns-lookup?q=8.8.8.8

### Reverse lookup of 1.1.1.1

```json
{"ip":"1.1.1.1","forwardConfirm":true}
```

```bash
curl 'https://lookupowl.com/api/v1/tools/reverse-dns?forwardConfirm=true&ip=1.1.1.1'
```

Web page: https://lookupowl.com/reverse-dns-lookup?q=1.1.1.1

### IPv6 reverse lookup

```json
{"ip":"2001:4860:4860::8888","forwardConfirm":true}
```

```bash
curl 'https://lookupowl.com/api/v1/tools/reverse-dns?forwardConfirm=true&ip=2001%3A4860%3A4860%3A%3A8888'
```

Web page: https://lookupowl.com/reverse-dns-lookup?q=2001%3A4860%3A4860%3A%3A8888

## Web pages

- https://lookupowl.com/reverse-dns-lookup
- https://lookupowl.com/ip-to-hostname

## Limits and caching

- Cost: 3 units for a live lookup, 1 unit for a cached one. Budgets are per network and published in the `RateLimit` response headers.
- Cache: the lifetime follows the data (for DNS, the record TTL, within a few minutes). Add `fresh=true` (MCP argument or query parameter) to look again; it costs 3 units per unit and is limited to 10 per hour.
- Timeout: 9 s.

## Related tools

- [DNS Lookup](https://lookupowl.com/tools/dns-lookup.md): Look up A, AAAA, MX, NS, TXT, CNAME, SOA, CAA, DS and DNSKEY records from a public resolver or the authoritative nameserver.
- [IP Location Lookup](https://lookupowl.com/tools/ip-location.md): Where an IP address is: city, region, country and the network that runs it, from DB-IP, with an honest accuracy note.
- [IP WHOIS Lookup](https://lookupowl.com/tools/ip-whois.md): Who owns an IPv4 or IPv6 address: network range, name, country, registry, abuse contact and origin AS, from RDAP.
- [ASN Lookup](https://lookupowl.com/tools/asn-lookup.md): Who holds an Autonomous System number: name, country, registry, dates and abuse contact, from RDAP.
- [What Is My IP Address](https://lookupowl.com/tools/what-is-my-ip.md): Show your public IP address, whether it is IPv4 or IPv6, its reverse DNS name and the network it belongs to.
- [IPv6 Compress and Expand](https://lookupowl.com/tools/ipv6-format.md): Shorten IPv6 addresses to RFC 5952 canonical form, or expand them to the full 32-digit form.

## Guide: Reverse DNS lookup

Find the hostname behind an IP address, and check that it points back.

### What reverse DNS is

Reverse DNS (rDNS) finds the hostname behind an IP address. The hostname is stored in a PTR (pointer) record, the mirror image of the A and AAAA records that turn names into addresses. LookupOwl then checks that the name points back to the same address, a test known as forward-confirmed reverse DNS (FCrDNS).

PTR records live in two special zones, `in-addr.arpa` for IPv4 and `ip6.arpa` for IPv6, and whoever owns the block of addresses that IP belongs to controls them. That is usually your ISP or hosting provider, not the owner of the domain. To look up `8.8.4.4`, the address is written backwards as `4.4.8.8.in-addr.arpa` and a PTR query is sent. IPv6 works the same way with one hex digit per label, and the [IPv6 expander](https://lookupowl.com/ipv6-expand) will show you the name for any address.

### How to use it

1. **Enter an IP address**: IPv4 or IPv6, written out in full or shortened. A full `in-addr.arpa` name or a URL that contains an address works too. Private addresses such as `192.168.1.10` have no public reverse record, so LookupOwl turns them down with an explanation instead of querying them.
2. **Read the PTR name**: An address can have none, one or several names. For a mail server, the name you want to see is a stable one that you control, like `mail.example.com`.
3. **Check that it points back**: LookupOwl looks up each name it found (the first five) for an A record, or AAAA for IPv6, and checks that the original address is among the answers. The result reads Forward-confirmed, Partly confirmed or Not confirmed, or Unverified if those lookups got no answer. Many mail servers want a confirmed result. To skip the check, switch off Verify the name resolves back in More options.

> **With an AI assistant** Connect the LookupOwl MCP server and ask: “What hostname does 1.1.1.1 have, and does it resolve back to the same address?” The assistant calls `reverse_dns` and gets the PTR names, the forward-confirmed verdict and the TTL. It is a quick way to check an address you spotted in a mail log without leaving the chat.

### What a good PTR looks like

| Result | What it tells you |
|---|---|
| PTR matches the server's name, and the name resolves back to the IP | Healthy FCrDNS. Good for mail servers and for tools that log by hostname. |
| PTR exists but the name resolves elsewhere | Not forward-confirmed. Mail from this IP may be rejected or filed as spam. |
| Some names confirmed, some not | Partly confirmed. Remove the names that don't resolve back. |
| Generic PTR such as `203-0-113-7.dyn.isp.example` | A default name an ISP gives to home or dynamic addresses. Many mail systems distrust these. |
| No PTR | The owner has not set one. Common on home connections and new cloud servers. |
| Several PTRs | Allowed, but mail systems treat them inconsistently. Keep one. |

### Why rDNS matters and how to fix it

- **Email delivery.** If your outgoing mail is bouncing or landing in spam, check the PTR first, then your [SPF](https://lookupowl.com/spf-record-checker) and [DMARC](https://lookupowl.com/dmarc-checker) records. Gmail's sender guidelines ask for valid forward and reverse DNS on the sending IP.
- **Forward and reverse don't match.** After you set a PTR to `mail.example.com`, make sure `mail.example.com` has an A (or AAAA) record with the same IP.
- **Your provider has delegated the block to you.** Then you run the reverse zone on your own nameservers. For blocks smaller than a /24, the delegation uses the classless method in RFC 2317.
- **A change isn't visible yet.** Reverse records are cached like any other DNS record, so wait for the TTL. The result shows it as Cached for.
- **“We couldn't check” or an error.** The nameservers for that address block did not answer properly. That is on the owner's side. Try again in a minute.

### How the lookup works

LookupOwl turns the address into its reverse name and asks Cloudflare's public resolver for PTR records (type 12). It then looks up each name it got, up to five, for A or AAAA records and checks that the original address is in the answer. Private, reserved and special-purpose addresses are turned away before any query is sent. Results are cached for 30 seconds to 5 minutes, and Check again fetches a fresh one.

```bash
dig -x 8.8.8.8 +short
dig -x 2001:4860:4860::8888 +short
nslookup 8.8.8.8
host 1.1.1.1

# Then check that the name points back
dig +short A dns.google
```

Standards: **RFC 1035** (PTR and `in-addr.arpa`), **RFC 3596** (`ip6.arpa`), **RFC 2317** (classless delegation) and **RFC 1912** (common DNS errors, including a missing PTR).

### Frequently asked questions

**What is a PTR record?**

A PTR record is a DNS record that maps an IP address to a hostname, the reverse of what an A or AAAA record does. It is published by whoever owns the IP block, and one address can have none, one or several of them. The hostname is only a claim by that owner, which is why LookupOwl checks that the name points back.

**What is forward-confirmed reverse DNS?**

Forward-confirmed reverse DNS (FCrDNS) is a two-step check. The IP's PTR record gives a hostname, and that hostname's A or AAAA record must give the same IP. It shows that whoever controls the address also controls the name, which is why mail servers and bot checks lean on it.

**Who controls the reverse DNS of an IP?**

The organisation that owns the address block, normally your ISP or hosting company. Domain owners cannot change it from their DNS panel unless the block has been delegated to them, which is why your registrar or DNS host usually cannot help with it.

**How do I set or change a PTR record?**

Ask whoever gives you the IP address, such as your hosting provider, cloud console or ISP. Many have a reverse DNS or rDNS field next to the server's IP. Enter the hostname you want, make sure that hostname has an A or AAAA record for the same IP, then check here once the old record's TTL has passed.

**Why does my mail server need a PTR record?**

Many receiving servers use it as a basic sign of a legitimate sender. A missing or mismatched PTR can lead to rejection or delivery to the spam folder. It is one check among several, alongside SPF, DKIM and DMARC, and it is cheap for a receiving server to run.

**Can an IP have more than one PTR record?**

Yes, but it is best to keep one. Software handles multiple records inconsistently, and some mail checks fail if there is more than one. LookupOwl lists up to 20 names, checks the first five and adds a note when it finds more than one.

**How is this different from IP WHOIS?**

WHOIS says who the address block is registered to. Reverse DNS gives the hostname the owner chose to publish for one address, which can hint at the provider or the role of the machine. Use both together: the [IP WHOIS lookup](https://lookupowl.com/ip-whois-lookup) shows the owner, and this page shows the name.