What is reverse DNS (PTR), and why does email care?

Written by Aldo · blue-team threat hunter
Last updated November 9, 2026 · 4 min read

Ask DNS for dns.google and you get 8.8.8.8. Ask the other way round, “what's the name of 8.8.8.8?”, and you're using reverse DNS. It's a small feature that decides a surprising amount: whether your mail server is trusted, and whether a crawler is genuine.

How it works

Reverse names live in a special part of DNS. The address is written backwards under in-addr.arpa (IPv4) or ip6.arpa (IPv6), and the record there is a PTR, a pointer to a name:

8.8.8.8.in-addr.arpa.   PTR   dns.google.

Because the reverse zone follows the address blocks, it belongs to whoever holds the block: the registry delegates it to the provider, and the provider either sets the names or lets customers set them. That's why you can't add a PTR record in your domain's DNS panel. You set it with whoever gave you the address.

Look it up

dig -x 8.8.8.8 +short
host 8.8.8.8
nslookup 8.8.8.8                 # Windows, macOS, Linux
Resolve-DnsName 8.8.8.8          # Windows PowerShell

Then check the other direction: look up the name you got and see whether it returns the same address. When it does, the name is forward-confirmed. Anyone who controls a block can make its PTR say anything (“mail.yourbank.com”), but only the real owner of that name can make it point back. A reverse name without the forward match proves nothing.

A worked example: six addresses, three outcomes

We looked up six well-known addresses with iplover's IP lookup on 9 November 2026. It does both directions and reports whether they match:

Address	Reverse DNS name	Points back?	What it tells you
8.8.8.8	`dns.google`	Yes	Google's public DNS, named on purpose
1.1.1.1	`one.one.one.one`	Yes	Cloudflare's public DNS
66.249.66.1	`crawl-66-249-66-1.googlebot.com`	Yes	A genuine Googlebot address: this is how crawlers are verified
185.220.101.1	`berlin01.tor-exit.artikel10.org`	Yes	A Tor exit whose operator says so openly
172.224.226.33	`a172-224-226-33.source.akaquill.net`	No	A generic name built from the address (an iCloud Private Relay exit); it labels the address but proves nothing
3.5.140.1	None	n/a	A cloud address nobody named, as most are

The pattern is typical. Services that want to be recognised set a meaningful, forward-confirmed name. Large networks give their addresses generic names, often containing the address itself, or none at all. A missing PTR isn't suspicious for a web visitor. It is a problem for a mail server.

Why email cares

Receiving mail servers look at the address that connected to them. If it has no PTR name, or the name doesn't point back, or the name looks like a home connection (with words such as dynamic, dsl or pool, or the address spelled out), many servers reject the mail or score it as likely spam. Google's sender guidelines, for example, ask that sending addresses have a PTR record whose name resolves back to the same address.

So if you run your own mail server, or a service sends mail directly from your own server or VPS:

What you find	What it means	What to do
No PTR on your mail server's address	Many receivers will reject or junk your mail	Set one in your hosting provider's panel (often under networking or the server's settings), or ask support.
PTR is a generic provider name	Looks like any rented machine	Change it to your mail server's name, such as `mail.yourdomain.com`.
PTR set, but the name doesn't resolve to the address	Not forward-confirmed	Add an A (or AAAA) record for that name pointing to the address.
Name and address match, and the name is what your server says in its greeting (HELO/EHLO)	All consistent	Nothing to do.
You send through Google Workspace, Microsoft 365 or a newsletter service	Their servers send, not yours	Nothing to do: the provider handles reverse DNS. Focus on SPF, DKIM and DMARC.
Mail server on a home connection	You usually can't set a PTR, and home ranges are widely blocked	Relay outgoing mail through your provider or a mail service.

For IPv6 the same rules apply, with longer names. If your server sends over IPv6, it needs a PTR for its IPv6 address too; a correct IPv4 setup doesn't cover it.

What reverse DNS can't tell you

A reverse name is a label chosen by whoever controls the address, and nothing more. Without the forward check it can claim anything. Even forward-confirmed, it tells you whose network the address is on, not who's using it: a cloud name means a cloud server, rented by someone you can't see. It's evidence for one question (is this really Google's crawler, is this a proper mail server) and almost useless for the question people often hope it answers, which is who's behind an address.

Sources

Official documents we used to check the facts in this guide.