Reverse DNS lookup is a process to determine the hostname associated with a given IP address.
Typically, the DNS is used to determine what IP address is associated with a given hostname; so to reverse resolve a known IP address is to lookup what the associated hostname for it is. A reverse lookup is often referred to simply as reverse resolving, or more specifically reverse DNS lookups.
|
Contents
- 1 IPv4 Reverse DNS
- 1.1 Classless Reverse DNS
- 2 IPv6 Reverse Lookup
- 3 Uses
- 4 External links
|
IPv4 Reverse DNS
Reverse DNS lookups for IPv4 addresses use the special domain in-addr.arpa. An IPv4 address is represented in the in-addr.arpa domain by a sequence of bytes in reverse order, represented as decimal numbers, separated by dots with the suffix .in-addr.arpa. For example, the reverse lookup domain name corresponding to the IPv4 address 101.102.103.104 is 104.103.102.101.in-addr.arpa. A host name for 1.2.3.4 can be obtained by issuing a DNS query for the PTR record for that special address 4.3.2.1.in-addr.arpa.
Classless Reverse DNS
Historically, IP addresses were allocated in blocks of 256. Thus, each block fell upon a octet boundary. This made configuration of the PTR records easy, since the dot separators delimited each block. Today however, IP addresses are allocated in very much smaller blocks, and hence the tradtional way of configuring a nameserver to perform reverse DNS cannot work. A means of overcoming this problem was devised and published as RFC 2317. It uses a CNAME entry which corresponds to each block.
IPv6 Reverse Lookup
Reverse DNS lookups for IPv6 addresses use similarly the special domain ip6.arpa. An IPv6 address is represented as a name in the ip6.arpa domain by a sequence of nibbles in reverse order, represented as hexadecimal digits, separated by dots with the suffix .ip6.arpa. For example, the reverse lookup domain name corresponding to the IPv6 address 4321:0:1:2:3:4:567:89ab is b.a.9.8.7.6.5.0.4.0.0.0.3.0.0.0.2.0.0.0.1.0.0.0.0.0.0.0.1.2.3.4.ip6.arpa.
Uses
Reverse DNS was designed to be primarily a tool for network troubleshooting. However, it is sometimes used as a poor defence against spam. When an Internet mail server receives incoming mail from an external machine, it may check that the reverse DNS record for the IP address of the originating server matches up with name by which the originating server identifies itself during the SMTP greeting.
For example:
- Mail Server A receives an incoming SMTP connection from machine B (it appears to A, that the connection from B originates from IP address X).
- As part of the SMTP transaction, machine B identifies itself to Server A by saying: "HELO mailserver.example.domain".
- Mail Server A then carries out a reverse DNS lookup on IP address X - if the reverse (PTR record) matches the name "mailserver.example.domain", then mail server A has a greater degree of certainty that the incoming mail is legitimate because, for machines which send out spam, this often isn't the case.
This is not a good defence against spam for several reasons. One is that a machine can have more than one IP address and any number of domain names, and the mapping between IP addresses and domain names is essentially arbitrary. Another, perhaps more relevant, reason is that a single client or server machine can legitimately send mail that is "from" an address in a domain different from that of the machine. There is no expected relationship between the domain name of a mail client or server and the domain names of the email addresses whose mail it originates or accepts. This is intentional, and essential to allow the outsourcing of a company's email handling. A third reason is that due to NATs the source IP address seen by the server may be different than the source IP address used by the client. However, notwithstanding the above, many mail servers do perform this check, so most mail clients take pains to ensure that the domain name that appears in HELO or EHLO commands matches the one resulting from a reverse DNS lookup of the source IP address.
External links
- How Reverse DNS Works
- Reverse DNS Lookup Tool